Privacy Policy

Last updated: October 9, 2026

1. Data We Collect

When you use SayWhat Technology, we may collect:

• Account information (such as email address and user role)
• Directory and membership information (name, phone number, mailing address, and unit and occupancy role), where you or your community board provide it. These fields are optional, and you control who can see your email and phone in the community directory.
• Documents you upload, including HOA governing documents (stored per community)
• User interactions, including questions submitted and responses generated
• Usage data, such as session timestamps and query counts, for billing, performance, and reliability purposes
• Aggregate engagement with community announcements (banners). When your HOA board posts an announcement banner, we count how many residents have seen and dismissed it so the board can understand reach. Anonymous visitors (people not signed in) are counted via a daily, irreversible bucket derived from their network address — never linked to a name or stored as a raw IP. Signed-in residents are counted using their account identifier, but their individual viewing activity is never shown to your board or to other residents — only aggregate totals are visible. This data is retained for up to 365 days and removed automatically when an account is deleted.
• Sign-in activity. Every sign-in attempt — whether successful or not — is recorded so your community board can investigate auth health and detect abuse (repeated failed attempts, sign-ins from new locations, brute-force patterns). Each row contains the time, the outcome (success / wrong password / expired link / etc.), the IP address, the user-agent string, parsed device family (desktop / mobile / tablet), parsed browser and operating system, and approximate country-level geo (when configured). Successful sign-in rows are retained for up to 180 days; failed sign-in rows are retained for up to 365 days because security incidents are sometimes investigated months after the fact. The email address attempted on a failed sign-in is removed after 30 days; the count + IP / user-agent / location stay for abuse analysis but the individual identity drops out. In communities with fewer than 25 active members, individual sign-in details are hidden from your board (only aggregate counts are shown) to protect member privacy. We notify you with a one-time in-app notice the first time you sign in after this feature is enabled.
• Feedback you send us. If you use the in-app feedback form, we store your message, its type and severity, a screenshot of the page you were on, any files you attach, and the page address, browser and app version it was sent from, together with your account and community.
• Community activity you take part in, where your community uses the feature: event sign-ups (RSVPs and guest counts), requests you submit to your board (such as architectural, maintenance, or reservation requests, including any address or details you enter), and pool check-ins recorded by a pool attendant (the name and number of guests of each resident checked in).

2. How We Use Your Data

We use your data to:

• Provide document analysis and AI-powered assistance
• Enforce strict per-community data isolation
• Monitor and enforce plan limits and usage
• Improve answer quality: a detailed record of each question and its answer (including the document passages used) is kept for 90 days and may be reviewed by SayWhat staff for that purpose. Your conversation history is separate: it is kept as described in section 5 until you delete the conversation

We do not sell your data or use it for advertising.

3. AI Processing and Third-Party Sub-Processors

To provide AI-generated responses, certain data (such as user queries and relevant document excerpts) may be processed by third-party AI providers. We use the following sub-processors to deliver the service:

• OpenAI — AI processing: answering questions, analysing documents, classifying documents, and transcribing uploaded audio and video (Whisper). Data sent: the text of every uploaded document (to index it for search), your questions and the document excerpts used to answer them, and the audio of uploaded recordings. OpenAI does not use API data to train its models under our agreement.
• Amazon Web Services (AWS) — Cloud hosting and compute, and file storage (S3) for uploaded documents and recordings, event attachments, and feedback screenshots and attachments. All data is hosted in the US-East-1 (N. Virginia) region.
• Neon — Managed PostgreSQL database hosting. Stores everything described in section 1 other than files: user accounts and directory information, document metadata, questions and answers, sign-in activity, feedback, and community activity.
• Qdrant Cloud — Vector database for semantic search. Stores a numerical representation of each document passage together with the passage's text and the document's name, filtered so each community can only search its own.
• Stripe — Payment processing. Processes billing information for the community's subscription; SayWhat does not store card numbers.
• Better Stack — Monitoring, error tracking, logs, and uptime monitoring. Receives request logs and traces (the page or API path requested, never anything after the “?” in a web address, so no sign-in or invitation token; IP addresses; browser user-agent strings; response codes and timings; and internal account and community identifiers), application logs (an error about sending an email can include the recipient's email address, and a log about an unanswered question can include the first part of the answer generated), and error reports from the app and your browser (what failed and where, without web-address query strings or the values being processed at the time).
• Resend — Transactional email delivery. Receives each recipient's email address and name and the message content (sign-in links, invitations, event and request notifications, and, for administrators, feedback notifications that include the sender's email address, message, and screenshot).
• Google Workspace — Email for SayWhat's own mailboxes, including privacy@saywhat.tech. Receives the messages you send to those addresses, with your email address and anything you include.
• Plausible Analytics — Website analytics on saywhat.tech, our public website, including its sign-in page. Your community's own web address (its community portal or custom domain) loads no analytics. Receives the site and path of each page viewed and of the referring page, never anything after the “?” in a web address (so no sign-in or invitation token), and browser, device, and approximate country, derived from your connection. Plausible does not use cookies and does not store IP addresses.
• Slack — Internal notifications to the SayWhat team. When feedback is submitted in the app, Slack receives the feedback's type, the first 500 characters of the message, the sender's email address, and the community.
• CARTO — Map tiles for community map pages, where a community has one. Your browser requests map images from CARTO, which receives your IP address and the map area viewed.
• DNSimple — DNS management for community web addresses and custom domains. Receives domain names only.

Each sub-processor processes data only as necessary to deliver the service and is subject to its own privacy policy and data processing agreements. We do not permit sub-processors to use your data for advertising or unrelated purposes.

4. Data Isolation

SayWhat Technology is designed with strict multi-tenant isolation. Each community's documents, user data, and interactions are logically separated and are not accessible to other communities. We do not share tenant data across communities.

5. Data Retention

Tenant data (including documents, messages, and user accounts) is retained while your subscription is active. When a subscription is cancelled, the community's user accounts, messages, document records, and search index are deleted 90 days after cancellation, unless a longer retention period is required by law or for legitimate operational purposes (such as billing reconciliation or dispute resolution). Uploaded files are removed from our file storage within 30 days after that deletion. Files of documents deleted on or before October 6, 2026 may still be in our file storage; to have them removed, contact privacy@saywhat.tech.

6. Data Security

We implement reasonable administrative, technical, and organizational safeguards designed to protect your data from unauthorized access, disclosure, alteration, or destruction. However, no system can be guaranteed to be completely secure.

7. Cookies and Usage Tracking

We may use cookies or similar technologies to:

• Maintain user sessions
• Support authentication and security
• Collect basic usage analytics to improve service performance, through Plausible Analytics, which does not use cookies (see section 3)

You can control cookie behavior through your browser settings.

8. Your Rights and Controls

• Administrators can export their community's audit, change-log, and event records, and delete documents they have uploaded, from the admin dashboard. Deleting a document removes it from the community's library and from search immediately, and from our file storage, normally within 30 days. Files of documents deleted on or before October 6, 2026 may still be in our file storage; to have them removed, contact privacy@saywhat.tech. To export or delete all of your community's data, contact privacy@saywhat.tech
• Individual users may request account deletion by contacting us at privacy@saywhat.tech

We will respond to requests in accordance with applicable laws.

9. European Data Subject Rights (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (“right to be forgotten”).
• Portability: Request a machine-readable export of your data.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing based on legitimate interest.

Our legal basis for processing personal data is contract performance (providing the service you subscribed to) and legitimate interest (improving service quality and maintaining security). To exercise any of these rights, contact privacy@saywhat.tech. We will respond within 30 days.

10. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete: Request deletion of your personal information.
• Right to opt out: We do not sell personal information. No opt-out is necessary.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact privacy@saywhat.tech. We will verify your identity before processing the request.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the service after changes are posted constitutes acceptance of the revised policy.

12. Contact

For privacy-related questions or requests, contact: privacy@saywhat.tech

See also: Terms of Service · Data Security