Privacy policy

Spysay checks how AI assistants and Google Maps recommend local businesses. This policy explains what personal data we collect to do that, why, who else handles it, and your rights. Spysay is responsible for this data. Contact us at support@spysay.com.

# What we collect

• Your account: your email address, and your name and picture if you sign in with Google or Apple.
• Your business: the website, name, cities, products and questions you give us, and the results of the checks we run for it. This is mostly business data, but it can include your name or phone number if they're on your listings.
• The free check: the website or Maps link and city you enter, the report, and a one-way hash of your IP address. We use the hash only to limit how many free checks one visitor can run; we can't turn it back into your IP address.
• Chats: what you write to Ask Spysay, files you attach, and its replies, so the conversation keeps its history.
• Billing: your plan, credit balance and payment history. Card details go straight to Stripe; we never see or store them.
• Technical data: your IP address and browser details when you use the site, kept in our hosting provider's logs for security.

We don't use advertising or tracking cookies, and we don't sell or rent personal data. See the cookie policy.

# Why we use it, and on what basis

• To provide Spysay to you (performing our contract with you): signing you in, running checks, writing reports and drafts, billing, and support.
• To keep Spysay safe and fair (our legitimate interest): stopping bots and abuse, limiting free checks, and fixing errors.
• To meet legal duties (legal obligation): keeping invoices and tax records.
• With your consent, where we ask for it, for example to email you about new features. You can withdraw consent at any time; it doesn't affect what we did before.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects.

# Who processes it for us

• Cloudflare hosts the site and its database, sends our emails, and runs the bot check (Turnstile).
• Stripe handles payments.
• Anthropic runs the AI that analyses answers and writes chat replies and drafts. It doesn't use our data to train its models.
• Google and Apple sign you in, if you choose them.

Each acts on our instructions under a contract that requires it to protect the data. To check AI answers, we ask ChatGPT, Google, Gemini and Perplexity the questions customers ask. Those questions name your business and city, never you.

We may also share data when the law requires it, or with a buyer if Spysay is sold, who must then follow this policy.

# Transfers abroad

Our providers store and process data in the United States and other countries outside Vietnam and the European Economic Area. Where the law requires it, we protect these transfers with the safeguards it provides for, such as the European Commission's standard contractual clauses, and we keep the records Vietnamese law requires for transfers abroad.

# How long we keep it

• Account, business and chat data: while your account is open. When you close it or ask us to, we delete it within 30 days.
• Free reports and their IP hash: kept with the report so its link keeps working. Ask us to delete one at any time.
• Invoices and payment records: as long as tax law requires.
• Hosting logs: deleted by our providers on their own short schedules.

# How we protect it

Data is encrypted in transit and stored with providers that encrypt it at rest. Sign-in uses one-time email links or Google and Apple, so we store no passwords. Only people who need access to run Spysay have it. If a breach puts your data at risk, we'll notify you and the authorities as the law requires.

# Your rights

You can ask us to:

• tell you what data we hold and give you a copy;
• correct it, or delete it;
• restrict or object to how we use it;
• send it to you or another service in a common format;
• stop using it where we rely on your consent.

Email support@spysay.com. We'll answer within 30 days, sooner where the law requires, and may ask you to confirm who you are. You can also complain to your data protection authority. In Vietnam that is the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the Ministry of Public Security.

# Children

Spysay is for businesses and isn't meant for anyone under 18. We don't knowingly collect children's data; if you think we have, tell us and we'll delete it.

# Changes

If we change this policy in a way that matters, we'll email account holders before the change takes effect and update the date above.