Privacy policy

Last updated: 28 October 2026 · Pilot in Limassol, Cyprus

saylist connects small businesses ("sellers") with people whose AI assistant (Claude, ChatGPT and others) looks for a service and books it for them ("customers"). This page says what we collect, why, who else sees it, how long we keep it and how to have it deleted. We wrote it from what our code does today; when that changes, this page changes.

Who we are

The data controller is [to be filled: operator name], [to be filled: operator address]. Contact for anything about your data: [to be filled: support email].

In short

• We collect what is needed to put a business in front of assistants and to pass a customer's request to that business. Nothing else.
• No advertising, no selling or renting of data, no paid placement in search results.
• Our pages set no tracking cookies and run no analytics. The only cookie is a short-lived one while you sign in with Google (see below).
• While the pilot runs we keep sellers' conversations with our assistant, to see where it goes wrong. You can have them erased at any time.

If you are a seller

You talk to our assistant in Telegram. We keep:

• Your Telegram chat id, which is how we recognise you, and your Telegram app's language setting, used to greet you in your language.
• Your phone number, only if you share your contact with the bot.
• Your business: name, what you do, where you work, contacts, working hours, offerings and prices, and the languages you speak. Nothing is published until you confirm it.
• The conversation: what you write, the text of your voice notes, our replies, and the assistant's working steps for each message (what it looked up and why). We keep these for the length of the pilot and the saylist team reads them, behind a password, to improve the assistant.
• Voice notes are sent to OpenAI to be turned into text. We keep the text, not the audio.
• Messages we send you (new requests, reminders) and their delivery status.
• Usage counts: how many AI calls your conversation needed and what they cost. No content.

What becomes public. Your business name, what you offer, prices, working hours and your town or district are shown to customers' assistants. Your exact address and contacts are shown to a customer only after you accept their booking.

If you are a customer

Your assistant talks to saylist for you. The assistant itself (Claude, ChatGPT, …) is run by another company, and its own privacy policy covers what you tell it.

• Searches. We do not store what you searched for. When a search finds nothing we record the category, the town or district (never an address), filters that do not exist yet and the number of words in the wish, so we know which businesses to bring in.
• Booking requests: your name, phone, the service, the times you can make, your note to the seller, and, only when the seller comes to you, your address and how to get in.
• Which assistant you used: the product name from the connection (for example "claude-user"), to count where customers come from.
• Signing in. When you connect your assistant to saylist, you sign in once.
  • With Google: Google tells us your Google account id, your email address and that Google has verified it, and your name and profile picture (Google's basic profile). We keep the account id and the email; we do not store your name or picture. We never see your Google password and get no access to your Google account, mail or files. While you are at Google we set one cookie, for at most 30 minutes, that ties the sign-in to your browser; it is deleted when you come back.
  • With an emailed code, where offered: your email address and the one-time code we send to it (kept only in a form that cannot be read back).
  • Then: which assistant you connected and the access it holds, so it can show you your own bookings. Sellers never see your email.

What the seller gets. With the request: what you asked for, when, your name and note, and your address if they come to you. Your phone number once they accept. That is what they need to answer and to do the job.

Each booking has a tracking page. Anyone who has its link can open it, so share it only with people you choose. It shows the booking and the seller's details, not your phone or address.

Why we use it (legal bases)

• To provide the service you asked for: publishing a seller's business, passing a request and its answer (performance of a contract, GDPR Art. 6(1)(b)).
• To keep the service working, safe and improving: reading pilot conversations, counting searches with no result, which assistant brings customers (our legitimate interests, Art. 6(1)(f)). You can object; see "Your rights".
• To meet legal obligations, if any apply (Art. 6(1)(c)).

Who else processes it

• Anthropic (Claude API, United States): runs our assistant. It receives sellers' messages and the details of requests a seller is answering, and translates our messages to the seller's language. When a seller asks what others charge, it may search the web.
• OpenAI (United States): turns sellers' voice notes into text.
• Railway: hosts our servers and database, in its EU West region. Like any host it keeps short-lived request logs, which include IP addresses.
• Telegram: carries messages between sellers and our bot, under Telegram's own privacy policy.
• Google: confirms who you are when you choose "Continue with Google", under Google's own privacy policy. Google learns that you signed in to saylist.
• An email delivery provider, to send sign-in codes if you sign in by email.
• The seller who receives your request, as described above.

Anthropic and OpenAI process this data for us under their API terms, which do not allow them to train their models on it. Transfers to the United States rely on safeguards recognised under the GDPR, such as the EU Standard Contractual Clauses in their data processing terms.

How long we keep it

• During the pilot there are no automatic deletion periods yet. We keep data until you ask us to delete it, and before the pilot ends we will set retention periods and publish them here.
• Our internal event log records what happened (a request sent, accepted, expired) with ids, counts and times, never names, phones, addresses or messages. It is kept without a time limit.
• Our application logs carry ids and counts, not personal data: the setting that would add message texts is never turned on in production.

Deleting your data

Sellers can tell the bot "delete my business". It stops appearing in search, no new requests arrive and the conversation is erased. This is refused while booked work is still ahead, so cancel it first. Some records stay after that: your account (Telegram id and phone), the business marked as deleted, past requests and messages we sent you. To erase those too, write to [to be filled: support email].

Customers: write to [to be filled: support email] with the email you signed in with, the booking code from your tracking page or the phone number you gave, and we will delete your requests. Erasing your sign-in ends your assistant's access at once and deletes the link to your Google account.

We answer every request within one month.

Your rights

Under the GDPR you may ask for a copy of your data (access), have it corrected (rectification), erased (erasure), handed to you in a reusable format (portability), or object to how we use it (objection), and you may ask us to restrict its use. Write to [to be filled: support email]. If you think we got it wrong, you can complain to the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or to the authority where you live.

Children

saylist is not meant for children. Sellers must be adults.

Changes

When what we collect or why changes, we update this page and its date. For a change that matters, we tell sellers in Telegram before it applies.