Privacy policy
Last updated 18 October 2026. Sayo is run by Enrico Mattiazzi. Contact: [contact address not set: SAYO_SUPPORT_EMAIL].
Sayo helps you study: it turns what you learn into notes, flashcards and quizzes and schedules your review. This policy explains what Sayo stores, why, who processes it on Sayo's behalf, how long it's kept and what you can do about it. Enrico Mattiazzi is the data controller for Sayo under the EU General Data Protection Regulation (GDPR).
What Sayo stores
- Your account: email address, name if your sign-in provider shares it (Apple or Google), language, time zone, daily goal, plan.
- What you study: recordings and files you add, transcripts, notes, flashcards, quiz questions, study sets saved from an AI assistant, and courses Sayo writes for you.
- How you study: flashcard reviews and their schedule, quiz answers and grades, tutor chat messages, lesson progress, XP and streaks.
- Connected assistants: which assistants you connected to Sayo, when, and when they last used it. Sayo stores only fingerprints (hashes) of their access tokens.
- Usage and cost records: how much recording time and voice you used, so plan limits work.
- Product analytics: pages and screens viewed and actions taken (for example "quiz completed"), tied to a random device id and, once you sign in, your Sayo user id. Never your name, email or study content. See Analytics.
- Push tokens if you allow notifications on your phone.
Why (legal bases)
- To provide Sayo (performance of our contract with you): your account, your study material, review scheduling, assistants you connect, subscriptions.
- To improve Sayo (legitimate interest): product analytics without personal details, error logs.
- Notifications (your consent, which you can withdraw in your phone's settings).
Sayo doesn't sell your data, show ads, or use your study material to train AI models.
Who processes it for Sayo
These providers handle data only to run Sayo, under data processing agreements. Several are in the United States; transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
| Provider | What for | What they receive |
|---|---|---|
| Supabase | Sign-in, database, file storage (EU, Ireland) | Your account and everything you store in Sayo |
| Railway | Hosting the Sayo web app and API | Requests passing through the app |
| Inngest | Running background work (writing notes, lessons) | Ids of the lecture, course and user being processed |
| Anthropic, OpenRouter and the model providers it routes to | Writing notes, cards, quizzes and lessons; grading answers; the tutor | The text being worked on (a transcript, your notes, your answer) |
| Voyage AI (directly or through OpenRouter) | Search inside your lessons for the tutor | Lesson text |
| OpenAI (directly or through OpenRouter) | Drawing a lesson picture when no suitable image exists | A description of the picture |
| ElevenLabs | Transcribing recordings and spoken answers; reading aloud | Audio you record; text to be read |
| Wikimedia Commons | Finding pictures for lessons | Search terms from the lesson topic only |
| Apple (App Store, RevenueCat, push notifications) | iPhone subscriptions and notifications | Your Sayo user id, purchase status, push token |
| Stripe or Polar | Web subscriptions, when you subscribe on the web | Your email, plan, payment details (Sayo never sees card numbers) |
| Cloudflare (Lens) | Product analytics, run by Sayo on Cloudflare | See Analytics |
| Google Fonts | Loading the web app's fonts | Your IP address and browser details |
Claude, ChatGPT and other assistants
If you connect an AI assistant to Sayo, it can read and update your study in Sayo (courses, study sets, reviews, quizzes and progress) when you ask it to, and it can't delete anything or change your plan. What the assistant sends to Sayo (for example a study set it wrote, or how you answered) is stored like anything else you add. Your conversations with the assistant are governed by that assistant's own privacy policy, not this one. You can disconnect an assistant at any time in Sayo under Settings → Connected apps, which stops its access immediately.
Analytics and cookies
Sayo uses only the cookies it needs to keep you signed in. Product analytics run on Lens, a tool built and operated for Sayo: it stores a random id in your browser's local storage (not a cookie), the page or screen, the action and its few properties, your country (from your IP address, which isn't stored), and your device type, browser and system. There are no advertising or third-party tracking cookies.
Sharing your notes
If you create a share link for a lesson, anyone with the link can read its notes until you turn sharing off.
How long it's kept
- Raw audio is deleted once it has been processed. The transcript and study material stay until you delete them.
- Everything else stays while your account exists. Deleting your account (Settings → Delete my account) removes your recordings, transcripts, notes, cards, quiz history and connected assistants at once.
- Billing records are kept as long as tax law requires. Analytics events carry no name, email or study content.
Your rights
You can ask to access, correct, export or delete your data, to restrict or object to processing, and you can withdraw consent at any time. Write to [contact address not set: SAYO_SUPPORT_EMAIL]; Sayo answers within one month. You can also complain to your data protection authority; in Italy that's the Garante per la protezione dei dati personali.
Age
Sayo is for people aged 14 or older, the age of digital consent in Italy. Where the local age is higher, you need a parent's or guardian's permission below it.
Security
Traffic is encrypted, access tokens are stored only as hashes, uploads go straight to storage through short-lived signed links, and every request checks that the data belongs to you.
Changes
If this policy changes in a way that matters, Sayo will announce it in the app. The date at the top shows the latest version. See also the terms of service.