SaysData Privacy Policy
Version: 2026-09-28
SaysData is operated by 17237324 Canada Inc. ("SaysData", "we"). This policy explains what personal information we collect when you use saysdata.com or the SaysData MCP server, what we do with it, and the control you have over it. SaysData is a service for businesses; the Cloud Service Agreement with your organization governs the service itself.
In short
- We collect only what we need to run your account and the service.
- We never sell your personal information, and we do not use advertising or cross-site tracking.
- We keep your requests, linked to you, for 60 days so you can check your usage. After that they are deleted.
- We keep copies of requests with identifying details removed, leaving out any we believe still identify you or your organization, and use them to improve SaysData. We may also publish, sell, or license that collection.
- Datasets and files you upload are never used to train AI models and never go into that collection.
- Our service providers host your information in the United States.
- You can see, correct, and delete your information. Questions go to privacy@saysdata.com.
What we collect
Sign-in and account details. Your name, email address, username, and password or sign-in provider; your organization's name and verified email domain; and your role in it. Our sign-in provider, Clerk, holds your name, email, and credentials. We hold your username, your sign-in ID, your organization, its verified email domain and payment account ID, and your role.
Requests. The searches, queries, and other instructions sent to SaysData through your account, usually by your AI assistant (search text, SQL, and the datasets involved), with the time, the result (for example, whether it counted toward a limit), and the name of the AI assistant or app you connected. Under the Agreement, your organization must not put personal information in requests.
Uploaded datasets and files. Whatever your organization uploads. We process it only to provide the service to your organization.
Billing details. If your organization subscribes, our payment processor, Stripe, collects the name, billing address, and payment details. We keep Stripe's customer and subscription references, the number of Paid seats, and payment status. We never see full card numbers.
Technical information. IP addresses, browser and device details, and request logs, collected by our hosting and security systems. When you choose a username, Cloudflare Turnstile checks that you are a person, using your IP address. Our logs include the start of your search text.
Messages. What you send us by email.
We do not ask for sensitive information about you, such as health information, and we do not buy information about you from others.
How we use it
- To run the service: signing you in, connecting your AI assistant, answering requests, counting and enforcing plan limits, billing, and showing you your request history.
- To keep it secure: preventing abuse, investigating problems, and fixing errors.
- To contact you about your account, the service, and changes to our terms or this policy. We do not send marketing email unless you ask for it.
- To improve SaysData, using usage statistics and the de-identified request collection described below.
- To comply with the law and to establish or defend legal claims.
By creating a sign-in, you consent to these uses. You must give us your sign-in details to use SaysData. We make no decisions about you by automated means.
If you are in the European Union or the United Kingdom, our legal bases are: our legitimate interests in providing the service your organization signed up for, keeping it secure, improving it, and building the de-identified collection; our contract with you, where you are the customer; and our legal obligations.
The de-identified request collection
Each day, we copy the previous day's requests into a separate collection. We remove identifiers (names, user and organization identifiers, IP addresses, and exact times; only the date is kept), remove email addresses, phone numbers, and similar details from the text, and leave out any request we know or reasonably believe still identifies you, your organization, or anyone it works for, or that contains other personal information.
Requests from one session may share a random identifier that we create for the collection and do not keep with your account, but entries in the collection are not linked to you or your organization, so they cannot be found or deleted on request, and they are kept after your sign-in or account is deleted. There is no opt-out: requests sent through SaysData are included. We use it to improve SaysData, including to train AI models, and we may publish, sell, or license it.
It never includes uploaded datasets or files, or any request that involves an uploaded dataset or file.
Uploaded data and AI
We never use your uploaded datasets or files, or anything derived from their contents, to train AI models.
We use AI models run by Cloudflare on our behalf: to match your search text to datasets, and to describe the columns of a dataset you upload (using its name, description, column names, and a small sample of values).
The AI assistant you connect to SaysData (for example, Claude or ChatGPT) is run by another company. It sees your questions and our answers, and your agreement with that company governs what it does with them.
Who we share it with
Our service providers, who process it for us under contract (Stripe also uses payment information for its own fraud-prevention and legal duties):
| Provider | What it does | What it receives |
|---|---|---|
| Clerk | Sign-in and organization membership | Sign-in and account details |
| Cloudflare | Hosting, storage, AI processing, security, and logs | Everything that passes through the service |
| Neon | Database | Account details, request history, and billing references |
| Stripe | Payments, once you subscribe | Billing details |
We keep this list current.
Your organization. Administrators of your organization's account can see who belongs to it, their roles, and each member's usage. We do not currently show them the text of other members' requests.
When the law requires it, or when needed to protect people's safety or our legal rights.
In a sale or merger. If SaysData or its business is sold or merged, your information may transfer to the new owner, who must continue to protect it as this policy describes.
We never sell your personal information.
Where it is stored
Our service providers store and process your information in the United States, and Cloudflare may process requests in the country nearest to you. Authorities there may be able to access it under their laws. For information from the European Union or the United Kingdom, we rely on our providers' contractual safeguards, such as Standard Contractual Clauses or the EU–US Data Privacy Framework.
How long we keep it
| Information | How long |
|---|---|
| Request history | 60 days, then deleted |
| Sign-in details | Until you delete your sign-in |
| Uploaded datasets and files | Until your organization deletes them or its account |
| Logs | 7 days |
| Backups | 7 days |
| Billing records | As long as tax law requires (in Canada, generally six years) |
| De-identified request collection | Indefinitely |
When you delete your sign-in, or your organization's account is deleted, we delete the related information within 60 days, except copies in backups and logs (deleted on the schedule above) and records we must keep by law or need to establish or defend legal claims.
Cookies
We use only the cookies needed to run the site: Clerk's sign-in cookies, one that remembers how you arranged the page, and a short-lived one while you connect an AI assistant. Cloudflare may set security cookies. We may use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across sites. We use no advertising cookies.
Your rights and choices
Wherever you are, you can:
- See and correct your sign-in details in your account settings, and see your request history in the app.
- Delete your sign-in in your account settings. An account owner can delete your organization's account, and with it everything the organization holds.
- Ask us for a copy of your information (in a portable format on request), to correct, delete, or restrict anything else, or to object to a use. Email privacy@saysdata.com. We answer within 30 days, or tell you why we need longer, and may need to confirm who you are. Because the de-identified collection cannot be linked to you, requests cannot reach it.
Some information belongs to your organization's account, such as uploaded datasets. We may refer requests about it to your organization's account owners.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in the European Union or the United Kingdom, to your local data protection authority.
Security
We encrypt information in transit, encrypt sign-in tokens at rest, and limit who can access production systems. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
Children
SaysData is for businesses and is not for anyone under 18. We do not knowingly collect information about children.
Changes to this policy
Each version is posted at its own dated address. If a change materially reduces your privacy, we will email everyone with a SaysData sign-in at least 30 days before it takes effect.
Contact
Privacy Officer, 17237324 Canada Inc. — privacy@saysdata.com