Privacy notice

Last updated: 9 October 2026

The short version

We hold what Say It Where needs to run your social media: your account, your business's details, your connections to each network, the posts it makes, the comments and messages people send your business, and the results of your posts. We use it only to provide the service to you. We do not sell it or use it for advertising. You can delete your account, and everything in it, at any time in Your account → Delete my account.

The data controller is Cleardeskpro Software Ltd, registered in England and Wales, company no. 17193344. Postal address: PO Box 189, Huddersfield, HD8 1DY. Contact: privacy@sayitwhere.com.

This website

• The early-access form: your email address, and, if you choose to give them, your website and what kind of customer you are.
• Basic server logs kept by our hosting provider (Netlify), such as IP address and browser type, used for security and to keep the site running. This site sets no advertising or tracking cookies.
• Visit counts: we count how many times each page is opened, the name of the website a visit came from (such as google.com, never the full address) and how many visits reach each step of joining. This uses no cookies and we keep no IP address, browser details or anything else that could identify you: only the totals for each day. Visits by people signed in to Say It Where are not counted. If you open any page with ?notrack=1 at the end of the address, we set one small cookie called "notrack" so that your visits are not counted; ?notrack=0 removes it.

We process your form details because you asked us to contact you about the launch (your consent). We keep them until the launch emails have been sent, or until you ask us to delete them, whichever is sooner. Every email has an unsubscribe link. The form is processed and stored by Netlify, Inc. (our website host) on our behalf. Launch emails are sent through an email delivery service acting on our instructions.

The Say It Where service (for customers)

When you join, buy and use Say It Where, we hold the following so that the service can work:

• What you type when you join: your email address, your website address, and your name if you give it. We use them to set up your account, email you a sign-in code, and start reading your website.
• Your account: your name and email address (from the join page), your password (stored only as a one-way hash, never readable), the people you add to your account and what each may do, and the record of your purchases, refunds, subscription status and Say It Where AI credit (every top-up and every piece of work it paid for).
• Payments: card payments for plans, Say It Where AI credit and automatic top-ups are taken by Stripe, our payment processor. We never see or store your full card number: we keep Stripe's reference for you and, if you switch on automatic top-ups, the reference to the card you saved.
• Your business details: the website address you enter, the public pages we read from it, and the profile, strategy, drafts, posts, answers, reports and results the service produces for you.
• Comments and direct messages people send your business: on each network you connect or log in to, Say It Where reads the comments on your posts and the direct messages people send your business (their name or handle, their picture, and what they wrote), to draft answers for your OK (or send them, if you switch automatic answers on), to tell you when something needs you, and to learn what your audience responds to. Our lawful basis is legitimate interests: yours and ours in answering the people who contact your business. We keep them while your account is open, and delete them with your account or after 12 months, whichever is sooner. We suggest you mention in your own privacy notice that you use a service like Say It Where to read and answer messages.
• Public posts of competitors, and public trends: Say It Where reads the public posts of the competitors you name, and public trending topics and conversations in your field, to plan what to post and, if you switch it on, to find conversations you could join. It reads only what anyone can see publicly. Our lawful basis is legitimate interests. This is kept while your account is open and deleted with it.
• Your social media connections: (Say It Where's own businesses only; not offered to customers during the beta.) the sign-ins to your social networks that you give Say It Where's own browser, by logging in on its screen or with the login helper (kept encrypted, for your business only, used only to post, read and answer for it; deleted when you log out on a network's card), and the name and picture of each account it is signed in to. If you choose to let it log back in by itself, your password for that network is kept encrypted too and is never shown to anyone. The login helper has its own short privacy page.
• The results of your posts: through the official connections to Facebook and Instagram (where Meta gives that permission), and, for Say It Where's own businesses only, through its browser for the other networks (we do not use Google permissions to read results), we read the reach, clicks, comments and results of the posts Say It Where published, to report them to you and to improve your plan.
• TikTok, when you connect it the official way: (Say It Where's own businesses only; not offered to customers during the beta.) when you press "Connect TikTok" and approve Say It Where on TikTok's own page, TikTok gives us permission keys for your TikTok account (kept encrypted), your account's TikTok ID, display name and profile picture, and the choices you make for your posts (who can see them; comments, duets and stitches). We use them to post the videos you approve to that account, to show which account is connected, and, where TikTok gives that permission, to read the results of the videos Say It Where posted. Through this connection we do not read your followers or your other videos. Disconnecting TikTok in Say It Where deletes all of this and ends the permission on TikTok; you can also remove it in TikTok's own settings.
• YouTube, when you connect it the official way: see Google user data (YouTube) below.
• Facebook and Instagram, when you connect them the official way: when you press "Connect Facebook & Instagram" and approve Say It Where on Meta's own page, Meta gives us permission keys for the Facebook Pages (and the Instagram accounts linked to them) that you tick (kept encrypted), and each Page's and account's ID, name and picture. We use them to publish the posts you approve to the Page and Instagram account you choose, to show which ones are connected, and to read the reach, clicks, likes, comments and shares of the posts Say It Where published (reach and clicks only where Meta gives that permission). We never sell or share this data. Disconnecting in Say It Where deletes it and ends the permission with Meta; you can also remove it in Facebook's settings (Business integrations).
• Basic logs: sign-in times and technical logs used for security and fault-finding.

Why: to provide the service you asked for (performance of a contract), to keep it secure (legitimate interests), and, for comments, messages, competitors' public posts and trends, the legitimate interests described above. We do not sell your data or use it for advertising.

Who handles it for us: our hosting and database provider; our email delivery service (for sign-in and account emails); Stripe (card payments). The AI providers behind Say It Where AI receive the text and pictures needed to do the work you ask for, including the comments and messages it drafts answers to. Each social network receives what you publish to it, under your own account with them and their terms. Some of these companies are in the United States; where data leaves the UK or EEA it is covered by the safeguards those providers offer, such as standard contractual clauses.

How long: for as long as your account is open, except comments and direct messages, which are deleted after 12 months at the latest. If your purchase is refunded or ends, posting stops at once and your data is kept for up to 90 days in case you return, then deleted. Ask us and we will delete it sooner. Purchase records are kept as long as tax law requires.

Google user data (YouTube)

Say It Where uses YouTube API Services. This section covers the data Say It Where receives from Google when you press "Connect YouTube" and approve Say It Where on Google's own page ("Google user data").

What we access. Two things only: (1) permission to upload videos to your YouTube channel (the YouTube "upload" permission), and (2) the email address of the Google account you approved with (Google's basic sign-in), so we can show you which account is connected. When the first video is uploaded, YouTube tells us the ID and name of the channel it went to, which we keep to show you where your videos go. We do not ask for, and cannot read, your other videos, playlists, comments, subscribers, YouTube Analytics, Gmail, contacts or anything else in your Google account.

How we use Google user data. Only to provide the feature you turned on: uploading the videos you approve to your channel, scheduled for the time on your calendar, with the title, description, who can see it (public, unlisted or private) and declarations (such as "made for kids" and "altered or synthetic content") you set; and showing you, in Say It Where, which Google account and channel are connected. We do not use Google user data for advertising, we do not sell it, we do not use it to build profiles of you or anyone else, and we do not use it to train or improve AI or machine-learning models. People at Say It Where do not read it, except with your permission to help you with a problem, where needed for security or to comply with the law.

Who we share it with. We do not sell, share, transfer or disclose Google user data to anyone, except: (a) our hosting and database provider (Railway), which stores it for us on our instructions only, encrypted, and cannot use it for anything else; and (b) where the law requires it. The videos themselves go only to YouTube, to your channel. Say It Where's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it. Google's permission keys (access and refresh tokens) are encrypted with AES-256-GCM before they are stored, with the encryption key kept separately from the database; they are only ever sent to Google over encrypted connections (HTTPS/TLS), and all traffic to and from Say It Where uses HTTPS. Only Say It Where's server uses them, only to upload your videos, and only for the business you connected. Access to our systems is limited to the people who run the service. Each business's data is kept separate from every other customer's.

How long we keep it, and deleting it. Only for as long as YouTube is connected. What YouTube's API gives us is the channel's ID and name, and the ID and link of each video we upload for you; these are updated each time a video is uploaded. Pressing Disconnect on the YouTube card (Connect socials) deletes the keys, the email address, the channel details and the video IDs and links at once, and ends the permission with Google; removing a business, or deleting your Say It Where account, does the same. You can also remove Say It Where's access at any time on Google's third-party access page: Say It Where checks with Google every day, and the day it finds the access removed it deletes everything it held from YouTube. By connecting YouTube you also agree to the YouTube Terms of Service; Google's own handling of your data is covered by the Google Privacy Policy.

Deleting your data

Everything, at once: Your account → Delete my account deletes your Say It Where account, your businesses, strategy, posts, results, the comments and messages we held, and any credit left on it, straight away and for good. Anything already posted stays on the networks it went out on. You can also email privacy@sayitwhere.com from the address you signed up with and write "Delete my data"; we delete it within 30 days and confirm by email.

One network: under Socials, press Log out (or Disconnect) on a network's card, and the login or permission kept for that network is deleted at once. You can also remove Say It Where's access in each network's own settings (for Facebook and Instagram: Settings → Business integrations or Apps and websites; for YouTube: Google's security settings page; for TikTok: Settings → Security → Manage app permissions); when a network tells us you have done so, we delete what we held for that network.

Your rights

You can ask to see, correct or delete the details we hold about you, object to how we use them, or withdraw your consent, at any time. If someone who wrote to a business on Say It Where wants to use these rights, they can contact that business or us at privacy@sayitwhere.com. If you are in the UK or EU you also have the right to complain to your data protection authority (in the UK, the Information Commissioner’s Office).

Contact

Cleardeskpro Software Ltd, registered in England and Wales, company no. 17193344. Postal address: PO Box 189, Huddersfield, HD8 1DY. Email: privacy@sayitwhere.com.