1. What data we store
- Account details — the name, email, phone number, and business details you provided when signing up.
- Your business data — the contacts you uploaded, the messages you sent and received, campaigns, and settings. This data is yours; we only store and process it to run the service.
- Usage data — technical activity logs (login times, errors) for operations and security.
2. Where your data lives
Our servers are hosted in the European Union (Germany/Finland), with end-to-end encrypted communication (HTTPS) and encrypted daily backups.
3. Who sees what
- Only your organization sees its own contacts and messages. The system is multi-tenant with full isolation between customers.
- If you purchased the service through a partner/reseller — they see usage and billing data only. Never message content, never contacts — unless you explicitly grant them support access, which is time-limited and logged.
- The iSaySo team accesses your data only for support you requested or when legally required.
4. What we don't do
- We don't sell data, don't share it with advertisers, and never use your contacts for any purpose of our own.
- We don't store credit card details. When online payment is enabled it will run through a secure payment provider on the provider's own page, and only the last 4 digits will be kept here — a full card number never enters our system at any stage.
5. Cookies and third-party components
Cookies on this site fall into three categories. Only the necessary ones run immediately; analytics and marketing are not loaded at all until you have accepted them, and you can change your choice at any time via "Cookie settings" at the foot of every page.
Necessary — always on
- Login cookie (ours) — created only after you sign in to my.isayso.app, and keeps you signed in for 14 days. It cannot be read by scripts, is sent only over encrypted connections, and is deleted when you log out. Without it, staying signed in isn't possible.
- Spam protection — Cloudflare Turnstile — runs on the account signup form only, to stop bots from creating accounts. The component loads from Cloudflare's servers, so they receive your IP address and may set technical storage for the challenge itself. We chose Turnstile over reCAPTCHA for exactly this reason — it does not build an advertising profile.
- Your choice itself — what you picked in the cookie dialog is kept in local browser storage, not in a cookie. A cookie dialog that sets its own cookie is a joke at your expense.
Analytics — only with your consent
- Google Analytics — shows us which pages are viewed, where visitors came from, and where they leave, in aggregate. It is how we learn what is broken or unclear. Without your consent the script is not loaded at all.
Marketing — only with your consent
- Google Ads and Meta Pixel — let us measure which ad brought you here, and show you relevant ads on Google's and Meta's platforms. They set their own cookies and pass information about your visit to those companies, under their own privacy policies.
- These are the only components on the site that build a profile, and they are off by default. If you decline, they are never loaded and nothing is sent to them.
You can block all of this in your browser settings. Blocking the login cookie means you won't be able to stay signed in.
6. How long we keep your data
As long as your account is active. Message history is deleted automatically according to the retention policy you set for your organization. Closed your account? Your data is deleted within 30 days, except what we're legally required to keep (invoices, for example).
7. Your rights
To access, correct, export, or delete your data — write to us at hello@isayso.app and we'll handle it within 30 days.
8. Updates
Any material change to this policy will be announced in advance in the dashboard or by email.