Say & Sell
Privacy Policy
Last updated 5 October 2026
This policy explains what Say & Sell collects, why, and what we do with it.Say & Sell is operated by Say & Sell Ltd (company number 17392474) registered in England and Wales at 52 Whirlow Grove, Sheffield, United Kingdom, S11 9NR. If anything here is unclear, email hello@sayandsell.com and a person will answer.
One platform, several names
Say & Sell is the platform. Some people reach it under a different name, because coaches and creators run it for their own audiences under their own branding. Whichever name you arrived under, the service is the same one described here and it is operated by Say & Sell Ltd.
Who this is for
Say & Sell is a business tool. Our customers are the coaches and creators who sign in and build pages with it. This policy covers both them and the visitors who land on a page one of them has published.
What we collect
If you are a customer
- Your name, email address and the brand details you enter.
- The pages, offers, prices and emails you create.
- Which accounts you have connected, and the access tokens for them (stored encrypted, see below).
- Your conversations with the AI in the hub, and the facts it remembers about your business, so it can pick up where you left off.
- If you connect Instagram, the account data described in the Instagram section below.
- Basic usage records, so we can bill fairly and see what is breaking.
If you are a visitor to a customer’s page
- The name and email address you type into a form, which go to the customer whose page you are on.
- Anonymous page view counts. We do not build an advertising profile of you.
Google user data
You can connect a Google account so that Say & Sell can send email as you and manage bookings on your calendar. Connecting is optional and the product works without it. We request the narrowest permissions that make those features work, and here is every one of them, in plain terms.
| Permission | What we do with it |
|---|---|
gmail.send | Send the emails you have written, to the people who opted in or bought from you, from your own address. This permission cannot read your inbox, and we do not have any permission that can. We never read, search, store or delete your existing email. |
calendar.freebusy | Check which times you are already busy, so your booking page never offers a slot you cannot take. We receive only busy and free time ranges. We do not receive the titles, guests, locations or notes of your existing events. |
calendar.events | Create a calendar event when somebody books a call with you, including a video link, and update or cancel that event if the booking changes. |
Limited Use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data to serve advertising, we do not sell it, we do not transfer it to others except as needed to provide the features above or where the law requires it, and we do not allow humans to read it except with your explicit consent, to resolve a specific problem you have reported to us, for security purposes, or where the law requires it.
We do not use Google user data to train AI models. The product uses AI to help you write pages and emails. That AI is given what you type into Say & Sell. It is never given your inbox, your existing emails or the contents of your calendar.
Instagram user data
You can connect an Instagram professional account so that Say & Sell can show you how your posts are performing, and help you handle the messages and comments they bring in. Connecting is optional and the product works without it. As with Google, we request the narrowest permissions that make those features work, and here is every one of them.
| Permission | What we do with it |
|---|---|
instagram_business_basic | Read your profile, so the hub knows whose account it is showing: your username, name, profile picture, follower count, biography and account type. Also read your own posts and their details, such as the caption, the image or video, the link to it, when it went out, and how many likes and comments it has. |
instagram_business_manage_insights | Read the numbers Instagram keeps on your own account and posts: reach, views, saves, shares, follower growth, and the audience breakdowns Instagram provides. This is what fills in your analytics. |
instagram_business_manage_messages | Read the direct messages sent to your account and send replies from it, so you can answer people asking about your offers without leaving the hub, and so an automation you have set up can send the first reply for you. We only ever act on the account you connected. |
instagram_business_manage_comments | Read comments on your posts and mentions of your account, and reply to them, so that somebody commenting a keyword can be turned into a direct message conversation. |
What we deliberately do not ask for. We do not request permission to publish posts, so Say & Sell cannot post to your Instagram grid, stories or reels. We do not request any Facebook Page or advertising permissions. We do not read the accounts of people who message or comment beyond the public username and profile picture Instagram attaches to their message.
Your Instagram data is yours alone. It is shown only to you inside your own hub. We do not sell it, we do not share it with other members, we do not use it to target advertising, and we do not pool it with anyone else’s data.
AI and your messages. When you ask Say & Sell to draft a reply to a direct message or a comment, the text of that message and your brand details are sent to Anthropic’s Claude to write the draft. Nothing is sent to Anthropic unless you have asked for a draft, and your Instagram data is never used to train AI models, ours or anyone else’s.
Your AI
The AI inside the hub. When you ask the AI for something, the hub sends it what it needs for that request, such as your brand details, the post or message you are working on, and the facts it remembers about your business. The AI is provided by Anthropic (Claude) and, for some features such as video analysis, Google (Gemini), reached through Vercel’s AI service. They process it to give you an answer and are not allowed to use it to train their models. They cannot open your account or read our database: they only ever see what is sent for the request you made.
Your AI in your own Claude or ChatGPT. You can add Say & Sell to your own Claude or ChatGPT with your personal connector link. Your Claude or ChatGPT can then fetch your Say & Sell data, including your Instagram stats and messages, when you ask it to. What happens to it there is covered by your Claude or ChatGPT account and its privacy settings (Anthropic for Claude, OpenAI for ChatGPT), not by us. It never sends a message or replies to anyone without you approving it first.
Your connector link is private, like a password. Anyone who has it can use that connection. Do not share it or post it in screenshots. If it does get out, press Reset my AI link in Settings: the old link stops working immediately and you add the new one to Claude or ChatGPT.
How we keep your data safe
- Everything travels encrypted (HTTPS), between your browser and us and between us and our providers.
- Our database and files sit on secure servers that are encrypted when stored.
- The logins and keys for the accounts you connect (Google, Microsoft, Zoom, Instagram, your payment provider and similar) are encrypted again by us before they are stored, using AES-256-GCM, with the key held separately from the database. They can’t be read even by someone looking at the database, and are only unlocked in memory at the moment we use them for something you asked for.
- Sign-in is handled by Clerk. We never see or store a password for you.
- Card details go straight to the payment provider and never reach us.
- Only the people who run Say & Sell can access our systems, and only to run and support the service.
- If a security problem ever affects your personal data, we will tell you without delay, and tell the UK Information Commissioner’s Office within 72 hours where the law requires it.
Disconnecting. You can disconnect Google, Microsoft or Zoom from the hub at any time, which deletes their stored logins. To disconnect Instagram, remove Say & Sell in the Instagram app under Settings, then Website permissions, then Apps and websites. That stops our access immediately, and we delete the stored Instagram login within 24 hours. For Google you can also revoke access at myaccount.google.com/permissions.
Who handles your data
We don’t sell your data, and we never let anyone use it for advertising. To run Say & Sell we use a small number of trusted providers. Each one only handles the data it needs to do its one job, under a contract that forbids using it for anything else:
- Vercel hosts the app and Supabase hosts the database, on secure servers where everything is encrypted. Your connected account logins are encrypted again by us before they are stored, so they can’t be read even on those servers.
- Clerk runs sign-in, so it holds your name and email address.
- Stripe processes payments. Your card details go straight to Stripe and never reach us.
- Anthropic and Google power the AI. They only see what you ask the AI about, at the moment you ask, and can’t use it to train AI models.
- Meta (Instagram), when you connect your account, so we can read the data you have allowed.
- Apify, for the free Instagram audit, which looks only at public profile information.
- Emails you send to your own audience go out through the email account you connect (Google, Microsoft or your own mail server), not through a third party of ours.
None of them can use your data for their own purposes, and their staff can only access it in tightly controlled cases, such as a security issue or a legal requirement.
Where your data is stored. Our providers store and process data mainly in the United States and the European Union. When data leaves the UK, it is protected by each provider’s data processing agreement and the safeguards UK law approves for international transfers.
Why we use your data
- To provide the service you signed up for (our contract with you): your account, your pages, your AI, your connections.
- Because you chose to (your consent): connecting Instagram, Google or other accounts. You can withdraw it at any time by disconnecting.
- To keep Say & Sell safe and working (our legitimate interests): security, fixing problems and preventing abuse.
- Because the law says so (legal obligation): for example keeping payment records for tax.
How long we keep it
- Your account and what you have built: for as long as your account is open. Ask us to close it and we delete your content within 30 days, other than records the law requires us to keep, such as payment records for tax.
- Connected account logins: deleted as soon as you disconnect, or within 24 hours of you removing Say & Sell inside Instagram.
- The text of a comment or message that set off one of your automations: cleared after 90 days. The record that the automation ran is kept, so your numbers still add up.
- Technical logs of incoming Instagram events, which hold no message content: deleted after 30 days.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@sayandsell.com and we will act within 30 days. If you think we have got something wrong, you can complain to the UK Information Commissioner’s Office at ico.org.uk, or to your own data protection regulator if you are elsewhere.
Children
Say & Sell is a business tool and is not intended for anyone under 18.
Changes
If we change how we handle your data we will update this page and change the date at the top. If the change is significant we will tell you by email rather than expecting you to notice.