SaylaLast updated: November 10, 2026
This policy explains what data Sayla uses, why, where it is kept and what rights you have. We've written it in plain language. If anything is unclear, email us at hello@getsayla.com.
1. Who is responsible
The controller of your data is [Name or company], [Address], Portugal ("Sayla", "we"). Contact: hello@getsayla.com.
2. What Sayla stores and where
Without an account, everything stays on your phone. Your tasks, timetables, pacts, home, colours, profile photo and preferences (name, wake-up, work and sleep times, when you're most productive, language) are kept in your browser's local storage. We don't receive them.
With an account (optional), we also store on our servers:
- your email and name;
- if you sign in with email: a salted, hashed version of your password (PBKDF2). We never store the password itself;
- if you sign in with Google: your Google account ID, email, name and photo address, as confirmed by Google;
- a copy of your app data (the same data that's on your phone), to sync between your phones;
- open sessions (we only store a hash of the session code).
Shared home and pacts. When you invite someone, the home (people's names, chores, who did what) or the pact (goal, bet, days completed) moves to a shared space that every member can see and change. Your name is shown to the other members.
Students. If you ask for the student price, we store your university email and university to confirm the discount.
3. Voice, text and photos (artificial intelligence)
- Voice: when you speak, your phone records and sends the audio to our server, which turns it into text with a speech recognition model (Whisper) running on Cloudflare. We don't keep the audio: it's processed on the spot and discarded.
- Text: what you said or typed is sent to a language model (Llama) on Cloudflare to pick out tasks, days and times, or to answer "Ask Sayla" (in that case a summary of your next 14 days is sent too). The answer goes back to your phone. We don't keep the request.
- Timetable photos: the photo is shrunk on your phone and sent to a vision model on Cloudflare, which reads the classes and dates. We don't keep the photo.
- According to Cloudflare, data sent to Workers AI is not used to train models.
- AI can make mistakes. You always review the result before saving it.
4. Why we use your data and the legal basis
- Providing the service (organising tasks, syncing, sharing the home and pacts, understanding your voice): performance of our contract with you (Art. 6(1)(b) GDPR).
- Security (preventing abuse, limiting sign-in attempts): legitimate interest (Art. 6(1)(f)). For this we use your IP address for 15 minutes.
- Answering your requests and meeting legal obligations: contract and legal obligation (Art. 6(1)(b) and (c)).
We don't show ads, sell data, build marketing profiles or use behavioural analytics tools.
5. Who we share data with
- Cloudflare, Inc.: app and website hosting, account database and AI models (Workers AI). Acts as our processor.
- Google: only if you choose "Continue with Google" (Google confirms who you are). The app and this website also use the Inter font served by Google Fonts, which makes your browser contact Google's servers.
- People you invite to your home or a pact, as described above.
- Authorities, only when the law requires it.
6. Transfers outside the EU
Cloudflare and Google have infrastructure in several countries, including the US. These transfers rely on the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
7. How long we keep data
- Data on your phone: until you delete it (Profile → Delete my data) or clear your browser data.
- Account data: for as long as the account exists. When you delete your account (Profile → Account → Delete account), we delete the account and the data in it.
- Shared spaces: while they have members. When the last member leaves, the space is deleted.
- Sessions: expire after 180 days without use. Sign-in attempts: 15 minutes.
- Server technical logs (requests and errors): a few days, to fix problems.
- Audio, text sent to the AI and photos: not stored.
8. Security
Connections are encrypted (HTTPS). Passwords and session codes are only stored as cryptographic hashes. We limit sign-in attempts. No system is 100% secure: if we learn of a breach affecting your data, we'll tell you and the relevant authority, as the law requires.
9. Your rights
You can ask to access, correct or delete your data, restrict or object to its processing, and receive a copy in a readable format (portability). Many of these rights are built into the app (edit, delete data, delete account). For anything else, email hello@getsayla.com; we'll reply within one month. You also have the right to complain to the Portuguese data protection authority (CNPD, www.cnpd.pt) or the authority in your country (in the UK, the ICO).
10. Children
Under Portuguese law, anyone under 13 may only create an account with the permission of a parent or guardian. If you know of an account created without that permission, let us know and we'll delete it.
11. Other people's data
If you enter other people's names (for example, your flatmates or a pact friend), use only what's needed and make sure they're happy with it, especially before you invite them.
12. This website
getsayla.com doesn't use cookies, advertising or tracking across sites. It's served by Cloudflare, which may process your IP address briefly to deliver and protect the site.
Visit statistics. We use Cloudflare Web Analytics to count visits (pages viewed, country, device type and the site you came from). It doesn't use cookies, doesn't store your IP address and doesn't build a profile of you; we only see totals.
Live demo. If you try the demo on our homepage, the text you type (or say, turned into text by your own browser) is sent to a language model on Cloudflare Workers AI to build the example plan, and the answer comes straight back to your page. We don't store the text. To prevent abuse, your IP address is used for one hour to limit how many times the demo can be run.
Waitlist. If you join the waitlist, we store your email address, whether you said you're a student, the page you came from, your browser language, your country (as detected by Cloudflare), the date you joined, your personal invite code, how many friends joined with it and, if you were invited, which code you used. We use it only to tell you when Sayla launches on the App Store and Google Play (legal basis: your consent, Art. 6(1)(a) GDPR). It's kept on Cloudflare until launch plus 6 months, or until you ask us to delete it, whichever comes first. To leave the list, reply to any email from us or write to hello@getsayla.com. To prevent abuse, your IP address is used for 10 minutes to limit repeated sign-ups.
13. Changes
This policy will change as Sayla grows (for example, with payments or notifications). We'll update the date at the top and, for important changes, let you know in the app.