Privacy Policy

Last updated: September 30, 2026 · Version française

This policy explains what personal data SayPage processes, why, for how long, and what your rights are. It covers the saypage.ai website, the SayPage connector and skills used by AI assistants, the pages hosted on saypage.page, and the Instagram features. Words with a capital letter (such as Request, Page or Follower) have the meaning given in our Terms of Service.

1. Who we are

SayPage is operated by Fuxet Olivier EI, a French sole proprietorship (entrepreneur individuel) trading as “Twist Labs”, SIREN 807437645, located at 8 Bis Rue Abel, 75012 Paris, France (“SayPage”, “we”, “us”). For privacy questions, write to hello@saypage.ai. We have not appointed a data protection officer, as the law does not require one for our activity.

2. Our role

• SayPage is the controller of the data about its users (account holders), about people who report a Page, and about Visitors, and of the data it processes for security, moderation and its legal obligations.
• SayPage is a processor for its users when it processes the data of people who interact with their Instagram account (Followers), and the personal data their Pages contain. The user is then the controller: SayPage only acts on their instructions, under the Data Processing Annex of our Terms. Section 5 is written for Followers.
• Meta (Instagram) and the provider of the AI assistant a user connects (for example Anthropic or OpenAI) are independent controllers of the data they process.

3. Data about SayPage users

• Account: your name, email address, sign-in identifiers and sign-in method, managed by our sign-in provider, Clerk; the date your account was created; your plan.
• Requests from your AI assistant: what your assistant sends to SayPage’s tools, and our answers. SayPage never receives your conversation, your assistant’s memory or the files you share with it, except what your assistant puts in a Request. We log each Request: time, operation and IP address.
• Your content: your Pages (drafts, previews and published versions), your images (we keep a re-encoded copy; the original file is deleted about an hour after upload), your Site address and its former addresses, and your Automations (posts, keywords, messages, buttons, links, options).
• Your Instagram account: its username, name and identifiers, a copy of its profile picture (refreshed daily), its access token (stored encrypted), the permissions you granted, and the details and thumbnails of the posts you use in Automations. When your assistant asks for them, we fetch your posts, their comments and your statistics from Meta and pass them to your assistant without storing them. When you publish a post, we send its image and caption to Meta; a private copy of the image is kept for about a day so that Meta can fetch it, then deleted.
• Moderation and security: the Pages and images refused by our checks and why, strikes, takedowns, suspensions and bans, and the identification data French law requires hosting providers to keep (section 10).
• Communications: the emails we send you, and your messages to us.
• Technical data: IP addresses, requested addresses, times and error reports.

Your account details are necessary to create and use an account: without them, we cannot provide SayPage.

4. Data about Visitors of SayPage Pages

Pages on saypage.page run in a sandbox that restricts their scripts, browser storage and network access. SayPage sets no cookies on them. These restrictions do not prevent requests to the third-party services whose content an author embeds, as described below. When someone opens a Page, we record a visit with the Page, the Visitor’s country (worked out from the IP address, which is not kept in these visit records), the domain of the referring website, and a recognized source category from the link, if any (for example source=instagram). Only fixed source categories are accepted; other source values are discarded. We do not assign Visitor identifiers, and the Page’s author only sees visit counts. Our hosting provider, Cloudflare, processes IP addresses to deliver and protect Pages, and keeps short-lived technical logs.

An author may embed content from other services in a Page, such as a YouTube or Vimeo video, a Spotify, Apple Music or SoundCloud player, a Calendly or Typeform form, a Google Map, an Instagram or TikTok post. Loading that content sends a request to the service, which can receive technical data such as your IP address and browser information. Depending on the service and browser restrictions, it may also use cookies or collect data you provide, under its own privacy policy. Authors must obtain any legally required consent before loading embedded content. If they cannot do so, they must use an external link instead.

5. If you interact with a creator who uses SayPage

This section is for people who comment on, or send messages to, an Instagram account that uses SayPage (“Followers”). The holder of that account (the “creator”) decides how your data is used, and is responsible for it as controller. SayPage processes it on the creator’s behalf, only to carry out what the creator set up.

• Data: your Instagram-scoped identifier and username; your comments on the posts the creator uses with SayPage (text and time); the messages you send to that account (text and time, and the buttons you tap); the messages and replies sent to you; and whether you follow the account, when the creator asks for that check.
• Source: Instagram, through Meta’s official programming interface.
• Purposes: sending you the message or link you asked for by commenting a keyword; letting the creator read and answer comments through their AI assistant; and respecting Instagram’s messaging rules, such as its 24-hour window.
• Retention: the text of your comments and messages is deleted 30 days after we receive it, and the records of the messages sent to you 13 months after they were sent. Everything is deleted sooner if the creator deletes their SayPage account or their Instagram data.
• The creator’s AI assistant: when a creator asks their AI assistant to read or answer comments, the comments are passed to the assistant they chose (for example Claude or ChatGPT) and are then handled under that assistant’s own terms.
• Your rights: contact the creator. You can also write to hello@saypage.ai; we will forward your request to them. To stop receiving messages, tell the creator, or block the account on Instagram.

6. Data about people who report a Page

When you report a Page, we keep its address, your reason and, if you give them, your name and email address, to handle the report, confirm that we received it and tell you our decision. We use your IP address for about a minute to limit abuse of the report form; we do not store it with the report.

7. Why we use data, and on what legal basis

For the processing SayPage carries out as controller:

• Providing the service (your account, hosting and publishing your Pages, carrying out your Requests, your Automations and the Instagram features, service emails): performance of our contract with you (GDPR, article 6(1)(b)).
• Keeping the service safe (automated checks before publication, moderation, handling reports and contests, bans, preventing fraud, phishing and abuse): our legitimate interest in protecting Visitors, Followers, our users and the service, and in complying with Meta’s rules (article 6(1)(f)); and our legal obligations as a hosting service under the Digital Services Act for reports and statements of reasons (article 6(1)(c)).
• Counting Page visits for authors: our legitimate interest in giving authors statistics on their Pages (article 6(1)(f)).
• Keeping the data that identifies the authors of hosted content, and answering requests from authorities: our legal obligation (article 6 of French law n° 2004-575 “LCEN” and decree n° 2021-1362; GDPR, article 6(1)(c)).
• Diagnostics (error reports and logs): our legitimate interest in keeping the service running (article 6(1)(f)).
• Answering your requests, and establishing or defending legal claims: our legal obligations and our legitimate interest (article 6(1)(c) and (f)).

You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. Write to hello@saypage.ai.

8. Automated decisions

Before a Page is published, automated checks look for forbidden technical elements, have an AI model read the Page’s visible text to detect illegal or harmful content (sexual content, hate, violence, dangerous or criminal content, self-harm, phishing, impersonation, scams), and open the Page in a browser. Uploaded images are checked by a moderation model. When these checks object, the Page or the image is refused automatically, and the reason is returned to your assistant. You can ask a person to review the decision by writing to hello@saypage.ai. Section 11 of our Terms describes how we moderate.

9. Who receives data

Our providers process data on our behalf, only as needed to run the service, and each is bound by data processing terms:

• Clerk, Inc. (United States): sign-in and account management.
• Cloudflare, Inc. (United States, worldwide network): hosting and storage of Pages and images, content delivery and protection, visit counting, and the browser check before publication.
• Render Services, Inc.: hosting of the SayPage application and its database, in its Frankfurt region (Germany).
• Vercel Inc. (United States, worldwide network): hosting of saypage.ai.
• TypeSafe AI: automated reading of a Page’s visible text before it is published.
• OpenAI (United States): automated moderation of uploaded images.
• Resend (United States): sending emails.
• Functional Software, Inc., “Sentry” (United States): error monitoring.

Data is also received by:

• Meta, when you connect Instagram and for every Instagram Action, as an independent controller (see Instagram’s Privacy Policy);
• the provider of your AI assistant, which receives SayPage’s answers to the Requests it sends, as an independent controller (see for example the privacy policies of Anthropic and OpenAI);
• anyone who visits your published Pages, which are public;
• authorities, when the law requires us to disclose data;
• a successor, if SayPage’s business is transferred (for example, if SayPage becomes a company), under this policy.

Some of these recipients are located outside the European Economic Area, in particular in the United States. These transfers rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, for certified providers, or on the Standard Contractual Clauses adopted by the Commission. You can ask us for a copy of these safeguards, and for the identity of the recipients of your data.

10. How long we keep data

• Your account, content and Instagram connection: as long as your account is active. When you delete your account, your Site goes offline immediately and your data is deleted from our systems, usually within the hour and always within 30 days. Backups are overwritten within 30 more days.
• Previews: preview links expire after about an hour, and preview copies are deleted within a day.
• Images prepared for Instagram: about 24 hours.
• Followers’ data (processed for our users): comment and message text, 30 days after receipt; records of messages sent, 13 months.
• Visit records: about three months.
• Technical logs and error reports: up to 90 days.
• Reports: until they are handled, then 12 months.
• Pages and images refused by our checks: 30 days, including after the account is deleted, so that we can find and correct the checks’ mistakes.
• Strikes, takedowns and suspensions: 12 months, including after the account is deleted, so that someone whose Pages broke our rules cannot start again with a new account.
• Bans: the sign-in identifier and the Instagram account identifiers of the banned person, with the reason, until the ban is lifted, including after the account is deleted.
• Identification data required by law (article 6 of the LCEN and decree n° 2021-1362): after an account is closed, we keep the email address, name and phone number (if we have them) for 5 years; the account identifier, Instagram usernames and identifiers, and Site addresses for 1 year (and, after a Meta deletion request, the Instagram username and identifiers for 1 year). For each creation, change or deletion of hosted content, we keep the IP address, time and operation for 1 year. This data is kept only to answer requests from judicial authorities, and access to it is restricted.
• Proof of an account deletion: a scrambled identifier, for 30 days after the deletion is complete.
• Your messages to us: as long as needed to answer them, then as long as they may be needed to establish or defend a legal claim.

11. Your rights

You have the right to access your data, to correct it, to have it deleted, to receive a copy of it in a portable format, to object to its processing or to have it restricted, as provided by the GDPR. To exercise these rights, write to hello@saypage.ai. You can also delete your account yourself from your account page, and disconnect Instagram at any time. We answer within one month, and we may ask you to prove your identity.

You can also give us instructions about what should happen to your data after your death, and name a person to carry them out (article 85 of the French law n° 78-17 “Informatique et Libertés”). If we learn that a user has died, we close their account and delete their data as described in this policy, unless their instructions say otherwise. Tell us, by writing to hello@saypage.ai, whether you want your data to be passed on to a third party you designate.

You can complain to a supervisory authority. In France, it is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (cnil.fr).

12. Instagram data

We process the data we receive from Meta on behalf of the creator who connected their account, only to provide the features they use, and in line with Meta’s Platform Terms. We never sell it or license it, and never use it for advertising, profiling, surveillance or decisions about anyone’s eligibility for anything.

Disconnecting access. When you disconnect an Instagram account, SayPage’s access stops immediately and its credentials are erased. Disconnection does not delete the stored account record or all previously received data. The account record may remain while your SayPage account is active; other data follows the retention periods in section 10.

Requesting deletion. You can have your Instagram data deleted:

• by deleting your SayPage account;
• by removing SayPage from the apps and websites connected to your Instagram account, then requesting the deletion of your data. Meta then sends us a deletion request, and you get a confirmation code and a link to follow its progress. This deletes our copies of that Instagram account’s data: its profile, posts, comments, messages and deliveries.

A Meta deletion request does not delete your SayPage account, your Pages or your Site (delete your account for that), nor the moderation records and bans that mention the Instagram account, nor its username and identifiers, which the law requires us to keep for one year (section 10), nor anything held by Meta. A message already delivered cannot be recalled.

13. Your AI assistant

SayPage only receives what your AI assistant sends to its tools. We never ask for, read or store your conversation, your chat history, your assistant’s memory or your files. What SayPage sends back (for example your Pages, the comments on your posts or your statistics) becomes part of your conversation, and is handled by your assistant’s provider under its own terms and privacy policy.

14. Cookies

saypage.ai only uses the cookies that are strictly necessary to sign you in and to secure sign-in, set by Clerk. It uses no analytics or advertising cookies, which is why it shows no consent banner. SayPage sets no cookies on the Pages it hosts, but content from other services embedded in a Page may (section 4).

15. Security

Data is encrypted in transit. Instagram access tokens are stored encrypted. Access to data is limited to what running the service requires, and every Page is isolated on its own sandboxed origin. No system is perfectly secure: if a breach affects your data, we will inform you and the authorities as the law requires.

16. Children

SayPage accounts are for adults (18 and over), and the service is not directed at children. If you believe a child has given us personal data, contact us and we will delete it.

17. Changes

We may update this policy. If a change is significant, we will tell you before it takes effect. The date at the top of this page shows the latest version.

18. Contact

Write to hello@saypage.ai, or to Fuxet Olivier EI, 8 Bis Rue Abel, 75012 Paris, France.