Sayo Privacy Policy
This Policy describes how Sayo handles personal information across released features. A required data flow, contract, retention, or security fact that is not yet verified is not replaced with an estimate.
1. Scope
This Privacy Policy explains how Liouville Labs Inc. handles personal information through Sayo websites, accounts, AI-assisted research features, support, and paid services. It applies only to processing for which the operator acts as controller or business; a linked third party's separate policy governs its independent processing.
2. Categories and storage
The release must replace every unresolved entry below with a reviewed public fact.
| Processing area | Data categories and required/optional status | Collection source | Data subjects | Storage location |
|---|---|---|---|---|
| account | Email address, account status (active or blocked), and account creation time, together with the Google account identifier and the email address the identity provider returns. Sign in is Google OAuth only, so no password is collected. The same account record also mirrors subscription state: the plan tier, the payment provider's customer identifier, the subscription status, and the end of the current billing period. The account table holds nothing beyond those eight columns: the account key, the email address, the status, the creation time, and the four subscription mirror fields. | Provided by the data subject through Google OAuth sign in, and generated by the service when the account record is created. | Registered users of Ask Sayo. | Supabase managed PostgreSQL operated by Supabase Pte. Ltd. (Singapore). The data itself is processed and stored in the United States, in the AWS us-east-1 region. Supabase Auth runs in the same project. |
| authentication | Google OAuth identifiers and the session and refresh tokens Supabase Auth issues, together with the sign-in and administrative audit entries Supabase Auth keeps. No separate record of policy consent events is stored. Where a user connects a third-party AI account, the connection row holds the provider account identifier in clear text and the provider tokens as an AES-256-GCM sealed envelope. | Generated by Supabase Auth during the sign-in exchange, and, for third-party account connections, returned by the third-party provider when the data subject authorises the connection. | Registered users of Ask Sayo. | Supabase managed PostgreSQL operated by Supabase Pte. Ltd. (Singapore). The data itself is processed and stored in the United States, in the AWS us-east-1 region. Supabase Auth runs in the same project. |
| conversation | Conversation sessions and their titles, and message bodies stored as structured JSON holding the message text, its citations, the conversation context and the mode. Message bodies are stored in clear text and may contain anything the data subject chooses to type. Agent runs keep the plan, the step checkpoint, token usage counters and an append-only event ledger. The research features store what the data subject writes and asks for: investment theses and every saved version of the thesis text, the questions and the answers of a diagnostic run, the asset snapshot a run was opened on, monitoring watch targets, custom card requests, perspective runs, run status broadcasts, and related-search runs holding the search text together with an identity key that is either the account identifier or, for a signed-out visitor, their internet protocol address. Where a conversation is shared by link, a snapshot of the conversation, the share token, the view count and the time it was last viewed are stored; this repository ships no route that reads or writes that store. The community board keeps an author nickname, the post text with the account that wrote it, the post's moderation status and the moderation judge record, and a report row naming the account that reported a post. The board endpoint answers on production today and nothing in the request path rules out a signed-in request creating a board row, although no page of the website links to it. | Provided by the data subject when they write to the service, and generated by the service as responses, tool calls, citations and run records. One item is neither: for a search run by a signed-out visitor, the internet protocol address kept as the identity key is derived from the network request itself, not supplied by the visitor. | Registered users of Ask Sayo, any person a user chooses to mention in the text they submit, and signed-out visitors who run a related search, whose internet protocol address is held as the identity key for that run. | Supabase managed PostgreSQL operated by Supabase Pte. Ltd. (Singapore). The data itself is processed and stored in the United States, in the AWS us-east-1 region. Request content is additionally transmitted to the AI processors listed in this policy for the duration of the request. |
| billing | Append-only credit ledger entries holding the credit change, the entry kind, the request identifier the entry settles, the measured model usage for that request, the markup multiple applied and, for manual grants, a free-text reason. While a request is running, a credit hold is recorded against the account and released when the request settles. The account record additionally mirrors the payment provider's customer identifier, the subscription status, the plan tier and the end of the current billing period. No card number, bank account or other payment instrument data is processed by Sayo: buyers enter payment details on the checkout page hosted by Stripe, and Sayo receives only the identifiers and status listed above. | Generated by the service when a request is metered or when the operator grants credit manually. | Registered users of Ask Sayo. | Supabase managed PostgreSQL operated by Supabase Pte. Ltd. (Singapore). The data itself is processed and stored in the United States, in the AWS us-east-1 region. |
| security | Sign-in and administrative audit entries kept by Supabase Auth, which include the internet protocol address and user agent of the request, the account status flag used to block abuse, and the runtime request logs kept by the hosting provider. | Generated by the authentication provider and the hosting provider as a by-product of serving the request, and set by the operator when an account is blocked. | Registered users of Ask Sayo and visitors whose requests reach the service. | Supabase Auth audit records in Supabase managed PostgreSQL operated by Supabase Pte. Ltd. (Singapore), processed and stored in the United States in the AWS us-east-1 region, and runtime request logs held by Vercel Inc. (United States), whose functions execute in the iad1 region (Washington, D.C.). |
| analytics | [UNRESOLVED:data.analytics.categories] | [UNRESOLVED:data.analytics.sources] | [UNRESOLVED:data.analytics.subjects] | [UNRESOLVED:data.analytics.storage_locations] |
The account inventory covers the Google account identifier and email address, the account status and creation time, and the fields that mirror subscription state. The authentication inventory covers the sign-in session and refresh tokens and the authentication audit records. Sayo keeps no separate consent-history database for terms or notice acknowledgements. Consent to the pre-payment notice for a monthly subscription (the notice version, the notice variant, and the time of consent) is recorded at Stripe as checkout session and subscription metadata when the checkout session is created. The conversation inventory covers sessions, messages, attachments, model requests and responses, tool calls, and the operational data that citations need.
Link sharing is not offered today: the service has no screen and no request path that turns it on. Connecting a user's own third-party AI account is not open today, as checked on 2026-09-20. Its fields are listed here so that what it would hold is stated in advance. The storage for both already exists, so both are listed on the conversation and authentication rows above. If sharing opens, it keeps a conversation snapshot, the share token, the view count, and the time of the last view. Where account connection is open, it keeps the third-party account identifier in clear text and the third-party tokens in a sealed envelope.
The community board answers on production today. A signed-in request can leave a post now, although no page of the website links to the board. The board keeps an author nickname, the post text, the account that wrote it, the post's moderation status and judge record, and the account that reported a post.
Subscription payments take place on a checkout page hosted by Stripe. Sayo processes subscription, credit, transaction, refund, and dispute identifiers, but never receives or stores a card number or authentication value; you enter payment details on the Stripe page directly. Payments run through Stripe Managed Payments, and the merchant of record for these transactions is Stripe's affiliate Sold through Link, LLC. Under section 6.1 of the Stripe Managed Payments Terms, Stripe and its affiliates process personal data under their data processing agreement and also use it, as determined by Stripe, for the service and ancillary activities such as customer support, order management, tax remittance, and legal compliance; the Stripe and Link privacy policies govern that use. Under section 6.2, Sold through Link, LLC handles deletion requests that a buyer makes to Link within Stripe systems, and Sayo handles the requests it receives. Stripe states that it transfers personal data internationally, including to the United States and India; the payments row of the country table in section 6 records the processing country.
3. Purposes and legal bases
We limit each processing activity to its disclosed purpose and applicable legal basis.
| Processing area | Purposes | Legal bases |
|---|---|---|
| account | Creating and identifying the account, authenticating sign in, customer support, handling data subject requests, and holding the subscription state the billing surfaces read. | Performance of the service the data subject requested. The account record is the minimum needed to deliver an authenticated session and cannot be omitted for that function. |
| authentication | Authenticating the data subject, maintaining and refreshing the signed-in session, detecting and preventing unauthorised access, and, where a third-party account connection exists, dispatching the data subject's own requests to that provider under their own credentials. | Performance of the service the data subject requested. A third-party account connection is created only on the data subject's own explicit authorisation of that provider. |
| conversation | Producing the answer the data subject asked for, keeping the conversation readable across turns, resuming and auditing an interrupted agent run, and metering the cost of the request. | Performance of the service the data subject requested. The conversation record is what the requested feature produces and operates on. |
| billing | Metering the cost of requests, keeping the credit balance correct, preventing a request from being charged twice, and recording manual credit grants. | Performance of the service the data subject requested. The ledger is what makes metered usage possible and auditable. |
| security | Detecting and preventing unauthorised access and abuse, investigating incidents, and keeping the service available. | The operator's legitimate interest in keeping the service secure and available, limited to what that purpose needs. |
| analytics | [UNRESOLVED:data.analytics.purposes] | [UNRESOLVED:data.analytics.legal_bases] |
We do not repurpose user content for model training, general product improvement, advertising, or unrelated evaluation. The provider no-training evidence published by each provider is:
Fireworks AI privacy notice, section 1 Key Privacy Commitments: "We do not use your prompts, training data, or API inputs to train or improve our AI models without your explicit opt-in." That notice states of itself that it "is not a contract and does not create any legal obligations", so it is a published commitment rather than a contractual term. Anthropic commercial terms of service, a contractual document, section B: "Anthropic may not train models on Customer Content from Services." Anthropic privacy centre: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models." Anthropic states one exception: if feedback or a bug is explicitly reported to them, or use is otherwise allowed, they may use that material for training. Sayo does not send such feedback.
4. Required and optional information
The category table identifies required and optional elements for each processing area. The signup or transaction screen repeats what is required to create an account, secure access, answer a request, or complete a purchase. Optional information is labeled separately, and refusing optional information does not block unrelated core functions. Optional analytics requires a separate opt-in, which, when analytics is on, can be changed or withdrawn at any time through the "분석 설정" (Analytics settings) control at the bottom of public pages.
5. Processors and subprocessors
The AI processing, authentication, hosting and storage, and payment processors are in use today. Each row shows its contracting entity and agreement status as recorded facts, and a status that is not yet confirmed shows as such. The product analytics row applies only to visitors who allow analytics.
| Function | Contracting entity | Country | Purpose | Data | Retention | Subprocessors | Transfer timing | Transfer method | Contract status |
|---|---|---|---|---|---|---|---|---|---|
| ai | Fireworks AI, Inc. for conversational answering, and Anthropic, PBC for the investment thesis judgement lane. Fireworks' own data processing addendum spells the entity Fireworks.ai, Inc., which is the spelling that appears in its contractual document. | [UNRESOLVED:processors.ai.country] | Generating the answer, judgement or structured output the data subject asked for, for the duration of that request. | The conversation messages, prompts and attachments the request carries, the tool inputs and outputs for that request, and the model response. No account identifier is required by the request body. | {"count":30,"exceptions":["Anthropic: longer retention where the customer uses a service with longer retention under their control, such as the Files API","Anthropic: longer retention where the parties have agreed otherwise, such as a zero data retention agreement","Anthropic: up to 2 years for inputs and outputs, and up to 7 years for trust and safety classification scores, where a conversation is flagged by automated trust and safety systems as violating the Usage Policy","Anthropic: longer retention where needed to enforce the Usage Policy or to comply with the law","Fireworks: prompt and generation data for open models is not logged or stored at all without explicit opt in"],"starts_at":"the input or output is received or generated by the provider","unit":"days"} | Fireworks lists its authorised sub-processors in Schedule 4 of its data processing addendum. Anthropic publishes its subprocessor list at anthropic.com/subprocessors. | At the moment each request is made, and only for that request. | An encrypted HTTPS application programming interface call from the service runtime to the provider endpoint. | [UNRESOLVED:processors.ai.contract_status] |
| authentication | Supabase Pte. Ltd. (Singapore) | United States. The contracting entity is incorporated in Singapore, but the project that processes and stores the data runs in the AWS us-east-1 region in the United States. | Operating the Google OAuth sign-in exchange, issuing and refreshing session tokens, and keeping the authentication audit record. | The Google account identifier and email address returned by the identity provider, the session and refresh tokens, and the internet protocol address and user agent of the sign-in request. | [UNRESOLVED:processors.authentication.retention] | Supabase publishes the sub-processors it engages in a subprocessor list; the list in force when this fact was verified was dated 1 June 2026. | At sign in, at each session refresh, and whenever an authenticated request is verified. | An encrypted HTTPS call from the browser and from the service runtime to the Supabase project endpoint. | [UNRESOLVED:processors.authentication.contract_status] |
| hosting | Supabase Pte. Ltd. (Singapore) for the managed database and object storage, and Vercel Inc. (United States) for application hosting and runtime logging. | United States. The managed database and object storage run in the AWS us-east-1 region, and the application functions execute in the Vercel iad1 region (Washington, D.C.). The database and storage provider, Supabase Pte. Ltd., is incorporated in Singapore, but the data is processed in the United States. | Storing the service's records, serving the application, and keeping the runtime logs needed to operate it. | Every category this policy lists is stored in the managed database. The hosting runtime logs additionally hold request metadata such as the internet protocol address, the user agent and the requested path. | {"count":60,"exceptions":["Supabase daily backups: the longest documented tier is 30 days (Enterprise), point in time recovery is documented up to 28 days","Vercel runtime logs: the longest documented tier is 30 days (Observability Plus)","no log drain to a third party is configured or documented in this repository"],"starts_at":"the daily backup or runtime log that carries the data is taken","unit":"days"} | Supabase publishes a subprocessor list dated 1 June 2026, and Vercel publishes its subprocessors, including their functions and locations, in its trust centre. | Continuously, for as long as the records are stored, and at the moment each request is served. | Encrypted HTTPS and database connections from the service runtime and the browser to the providers' managed endpoints. | [UNRESOLVED:processors.hosting.contract_status] |
| payments | Stripe, Inc. (United States) under the Stripe Services Agreement, and its affiliate Sold through Link, LLC (United States) as merchant of record for Stripe Managed Payments transactions | [UNRESOLVED:processors.payments.country] | Hosting the checkout page and taking the payment, calculating, collecting and remitting indirect tax, sending receipts, invoices and subscription emails, handling refunds, disputes, fraud screening and transaction support, and reporting subscription and payment events back to the service | Sent by the service: the account identifier as the checkout reference and in metadata, the plan tier and billing interval, the checkout notice consent record for a subscription checkout (the notice version, the notice variant and the consent time, in the session and subscription metadata), and the Stripe customer identifier once one exists. Entered by the buyer on the Stripe checkout page: payment method details and the contact and location details Stripe asks for there. Returned to the service: customer and subscription identifiers, subscription status and period end, and payment, refund and dispute event identifiers. | [UNRESOLVED:processors.payments.retention] | Stripe publishes its service providers, sub-processors and affiliates, with their locations and purposes, in its service provider list; the list in force when this fact was verified was dated 27 September 2026. | When the buyer starts checkout or opens the subscription portal, at each renewal charge, and whenever Stripe reports a payment, subscription, refund or dispute event to the service | A redirect of the buyer to a Stripe hosted checkout or portal page, encrypted HTTPS application programming interface calls from the service runtime to Stripe, and signed webhook requests from Stripe to the service | [UNRESOLVED:processors.payments.contract_status] |
| [UNRESOLVED:processors.email.contract_legal_name] | [UNRESOLVED:processors.email.country] | [UNRESOLVED:processors.email.purpose] | [UNRESOLVED:processors.email.data_categories] | [UNRESOLVED:processors.email.retention] | [UNRESOLVED:processors.email.subprocessors] | [UNRESOLVED:processors.email.transfer_timing] | [UNRESOLVED:processors.email.transfer_method] | [UNRESOLVED:processors.email.contract_status] | |
| analytics | [UNRESOLVED:processors.analytics.contract_legal_name] | [UNRESOLVED:processors.analytics.country] | [UNRESOLVED:processors.analytics.purpose] | [UNRESOLVED:processors.analytics.data_categories] | [UNRESOLVED:processors.analytics.retention] | [UNRESOLVED:processors.analytics.subprocessors] | Only after the visitor chooses allow in the analytics bar: from then on, on each eligible public page view and the engagement events that page produces. Nothing is sent before a choice, after decline or withdrawal, or from a page whose address carries a query other than utm campaign tags. | HTTPS requests sent directly from the visitor's browser by the Google tag (gtag.js) to Google Analytics collection endpoints. Sayo servers do not forward analytics data. | [UNRESOLVED:processors.analytics.contract_status] |
A brand name alone is not a verified processor identity.
6. International transfers
Personal information of users in Korea is processed outside Korea today. While Sayo provides AI answers, sign-in, hosting and storage, and card payment, the categories in the table below are sent to the recipients in the table at the times and by the methods shown. The product analytics row applies only to visitors who allow analytics. The legal basis for this cross-border processing is [UNRESOLVED:transfers.cross_border.legal_basis], the user rights method is [UNRESOLVED:transfers.cross_border.rights_method], and the contract verification record is [UNRESOLVED:transfers.cross_border.contract_verified_at].
Recipients, processing countries, categories, timing, and method, by area:
| Area | Recipient | Processing country | Categories | Timing | Method |
|---|---|---|---|---|---|
| AI processing | Fireworks AI, Inc. for conversational answering, and Anthropic, PBC for the investment thesis judgement lane. Fireworks' own data processing addendum spells the entity Fireworks.ai, Inc., which is the spelling that appears in its contractual document. | [UNRESOLVED:processors.ai.country] | The conversation messages, prompts and attachments the request carries, the tool inputs and outputs for that request, and the model response. No account identifier is required by the request body. | At the moment each request is made, and only for that request. | An encrypted HTTPS application programming interface call from the service runtime to the provider endpoint. |
| Authentication | Supabase Pte. Ltd. (Singapore) | United States. The contracting entity is incorporated in Singapore, but the project that processes and stores the data runs in the AWS us-east-1 region in the United States. | The Google account identifier and email address returned by the identity provider, the session and refresh tokens, and the internet protocol address and user agent of the sign-in request. | At sign in, at each session refresh, and whenever an authenticated request is verified. | An encrypted HTTPS call from the browser and from the service runtime to the Supabase project endpoint. |
| Hosting and storage | Supabase Pte. Ltd. (Singapore) for the managed database and object storage, and Vercel Inc. (United States) for application hosting and runtime logging. | United States. The managed database and object storage run in the AWS us-east-1 region, and the application functions execute in the Vercel iad1 region (Washington, D.C.). The database and storage provider, Supabase Pte. Ltd., is incorporated in Singapore, but the data is processed in the United States. | Every category this policy lists is stored in the managed database. The hosting runtime logs additionally hold request metadata such as the internet protocol address, the user agent and the requested path. | Continuously, for as long as the records are stored, and at the moment each request is served. | Encrypted HTTPS and database connections from the service runtime and the browser to the providers' managed endpoints. |
| Payments | Stripe, Inc. (United States) under the Stripe Services Agreement, and its affiliate Sold through Link, LLC (United States) as merchant of record for Stripe Managed Payments transactions | [UNRESOLVED:processors.payments.country] | Sent by the service: the account identifier as the checkout reference and in metadata, the plan tier and billing interval, the checkout notice consent record for a subscription checkout (the notice version, the notice variant and the consent time, in the session and subscription metadata), and the Stripe customer identifier once one exists. Entered by the buyer on the Stripe checkout page: payment method details and the contact and location details Stripe asks for there. Returned to the service: customer and subscription identifiers, subscription status and period end, and payment, refund and dispute event identifiers. | When the buyer starts checkout or opens the subscription portal, at each renewal charge, and whenever Stripe reports a payment, subscription, refund or dispute event to the service | A redirect of the buyer to a Stripe hosted checkout or portal page, encrypted HTTPS application programming interface calls from the service runtime to Stripe, and signed webhook requests from Stripe to the service |
| Product analytics | [UNRESOLVED:processors.analytics.contract_legal_name] | [UNRESOLVED:processors.analytics.country] | [UNRESOLVED:processors.analytics.data_categories] | Only after the visitor chooses allow in the analytics bar: from then on, on each eligible public page view and the engagement events that page produces. Nothing is sent before a choice, after decline or withdrawal, or from a page whose address carries a query other than utm campaign tags. | HTTPS requests sent directly from the visitor's browser by the Google tag (gtag.js) to Google Analytics collection endpoints. Sayo servers do not forward analytics data. |
| [UNRESOLVED:processors.email.contract_legal_name] | [UNRESOLVED:processors.email.country] | [UNRESOLVED:processors.email.data_categories] | [UNRESOLVED:processors.email.transfer_timing] | [UNRESOLVED:processors.email.transfer_method] |
A fact that has not been confirmed is not guessed at, so a cell that remains unconfirmed shows as such.
7. Retention
We use category-specific periods with a number, unit, start event, and explicit exceptions.
| Processing area | Verified retention schedule |
|---|---|
| account | [UNRESOLVED:data.account.retention] |
| authentication | [UNRESOLVED:data.authentication.retention] |
| conversation | [UNRESOLVED:data.conversation.retention] |
| billing | [UNRESOLVED:data.billing.retention] |
| security | [UNRESOLVED:data.security.retention] |
| analytics | [UNRESOLVED:data.analytics.retention] |
Qualitative phrases such as “as long as needed” do not replace these values. A legal hold or statutory record rule is separated from ordinary service data and access is restricted.
8. Deletion
You may delete an individual chat; it is removed from active use under the verified conversation schedule [UNRESOLVED:data.conversation.retention]. Account deletion cannot be requested inside the product today. Neither the route that would accept the request nor the automated erasure that would carry it out is switched on in production, as checked on 2026-09-20. Send an account-deletion request through the contact route in the rights section instead. The periods that apply to account data are published as [UNRESOLVED:data.account.retention], and no deadline is stated here until that fact is settled, because a deadline that nothing carries out would not be a promise. Required legal records are isolated and used only for the retention exception, and a restored backup is reconciled against the deletion list before ordinary processing resumes.
9. Security
We use risk-appropriate administrative, technical, and organizational measures, including access control, encryption in transit and where appropriate at rest, credential separation, logging, change review, vulnerability response, and processor oversight. No system is perfectly secure; please report suspected compromise promptly and do not send secrets through support. AI model calls are made today, and the AI provider agreement status is [UNRESOLVED:processors.ai.contract_status].
10. Age limits
Sayo is not directed to children. The minimum age is 18 in the United States and 19 in Korea. We do not knowingly open accounts below the applicable age; if we learn that an ineligible account was created, we block it and review deletion and required notices.
11. Privacy rights and requests
Depending on location and law, you may request access, a copy, correction, deletion, restriction or suspension, portability or transmission, withdrawal of consent, and information about processing. Submit a request to [UNRESOLVED:contacts.privacy.email]. We verify identity proportionately, support authorized agents where required, explain a denial, and do not discriminate for exercising a right.
12. U.S. state privacy rights
Where a U.S. state privacy law applies, residents may have rights to know or access, delete, correct, obtain portable data, opt out of covered sale, sharing, targeted advertising, or profiling, limit certain sensitive-data uses, and appeal a denial. Under the applicable statutory definitions, we do not sell or share personal information and do not use it for targeted or cross-context behavioral advertising. This promise must be checked against every contract, SDK request, and disclosure category before release; if the practice changes, we will add legally required notices and controls before the change.
13. Korean rights and relief
Korean users may exercise rights provided by the Personal Information Protection Act through the contact above and may seek advice or dispute resolution from the competent Korean privacy authorities and relief bodies. The privacy-officer role is [UNRESOLVED:privacy_officer.role] and contact is [UNRESOLVED:privacy_officer.contact]. Domestic-agent applicability is [UNRESOLVED:domestic_agent.applicability]; if required, the verified agent details are [UNRESOLVED:domestic_agent.name], [UNRESOLVED:domestic_agent.address], [UNRESOLVED:domestic_agent.phone], and [UNRESOLVED:domestic_agent.email].
14. AI and automated tools
Sayo uses automated tools to organize information and generate research assistance. Outputs may be wrong and do not by themselves make a legally or similarly significant decision about a user. If a future tool makes or materially supports such a decision, we will assess applicable notice, explanation, opt-out, objection, and human-review rights before release.
15. Security incidents
We investigate suspected incidents, contain affected systems, preserve restricted evidence, determine affected information and jurisdictions, coordinate with processors, and notify users or authorities when and within the time required by law. We do not delay a legally required notice to wait for perfect information.
16. Changes
Every change creates a new immutable policy version and history entry. We give advance notice of material changes and seek renewed consent where law or the changed purpose requires it. A new processor, destination, purpose, category, or longer retention receives review before activation.
17. Contact
Privacy contact: [UNRESOLVED:contacts.privacy.email]. Published response target: [UNRESOLVED:contacts.privacy.response_time]. The operator, Liouville Labs Inc., handles questions, complaints, and rights requests through the same verified contact shown in the product.