Privacy Policy
Last updated: 29 Sep 2026
This policy explains how StayKeasy SRL processes personal data across SayCity and Say, StayKeasy and its AI employees Moss and Pebble, the HUB, our websites and mobile apps, customer messaging, and existing Mobility transfer records.
1. Scope and Responsibility
StayKeasy SRL, Via Cardinale Ascanio Sforza, 11, 20136 Milan, Italy, VAT IT14009510968, is the controller for personal accounts, subscriptions, our websites and service operations. Contact support@staykeasy.com about privacy or your rights.
When a business uses StayKeasy to manage its customers, conversations and orders, that business determines the purposes of that processing and is normally the controller; we process those records on its behalf. The business's own privacy notice also applies. Contact that business about its customer records; we can help route your request.
2. Information and Sources
Account and business information: name, email, optional phone and photo, authentication and session data, language, timezone, workspace membership, business details, products, customer contacts, orders, invoices and payment status. Clerk handles sign-in; Stripe handles payments. We do not store full payment-card numbers.
Agent content: messages, photos, documents, audio and transcripts, responses, generated files, saved preferences and memories, skills, scheduled tasks, feedback, and records of actions and their results. Persistent agent computers and repositories can retain files, browser sessions and work needed to continue your tasks.
Connected services and customers: information you authorize us to access from email, calendars, files and other connected accounts; customer messages through Pebble, websites and WhatsApp; supplier and partner information; and public sources used for research. Depending on your task, this can include contacts, financial documents, search or browsing activity and location information.
Voice and calls: when you use voice or ask an agent to call, we process audio, transcripts, phone numbers, the call purpose and results. Telephone providers may retain recordings and call records. Only share sensitive information or another person's data when you have a valid reason and any permission required.
Technical information: IP address, device/browser and app version, session identifiers, notification tokens, usage events, errors, performance data and diagnostic traces. Camera, photos, microphone and notifications depend on the feature and your device permissions. Declining an optional permission limits that feature, not the whole account.
3. Purposes and Legal Bases
We process information necessary to perform our contract with you: create your account, provide agents and connected tasks, maintain conversation continuity, manage subscriptions, and deliver requested communications. Without the information needed for a feature, we cannot provide it.
We rely on legitimate interests for service security, fraud prevention, troubleshooting, support and proportionate quality monitoring, balanced against your rights. We process required billing and compliance records to meet legal obligations. Optional cookies and marketing use consent where required; you can withdraw consent without affecting earlier lawful processing.
4. AI and Connected Actions
Say, Moss and Pebble send relevant instructions, conversation context and content to AI providers to produce responses and perform tasks. Saved history, memories and scheduled work provide continuity. Authorized staff and service providers may access relevant content for support, safety, diagnostics and quality review; internal operational tools may assist that work.
Connecting an account authorizes access within the permissions you grant. Actions can send information to people or services involved in your request. You can manage connections and action permissions in the product and revoke access with the original provider. Disconnecting stops future access through that connection; it does not recall messages already sent or erase records already created.
AI output can be incorrect. Review important results before relying on them. Our agents are not intended to make solely automated decisions that have legal or similarly significant effects on people. A business remains responsible for how it uses customer information and agent results.
5. Recipients and Providers
We share relevant information with authorized workspace members, businesses or recipients involved in your tasks, and providers needed to operate the service. Workspace content may be visible to other authorized members. We do not sell personal information or give private conversations to advertisers.
Hosting, storage and authentication providers process account details, service content and technical data to keep the service available and secure.
AI, search and integration providers process relevant requests and content to complete your tasks. Communications providers handle messages, calls, emails and notifications; payment providers process the information needed for transactions.
Support, security and measurement providers process relevant diagnostics, feedback and usage data. Sharing depends on the feature used; not every provider receives every category of data. Providers may process data internationally, as explained below. We may also disclose information to meet legal requirements or protect people and the service.
7. Retention and Deletion
Account history, memories, files and recurring tasks are retained to provide the ongoing service until removed or the account is deleted. Unattached Say uploads expire after seven days. Archiving a workspace pauses it and keeps its records for 90 days, until an owner restores or deletes it. After 90 days, we delete it; its owners are emailed 7 days before. Deleting a workspace erases its records, except the invoices Stripe keeps.
Retention also depends on unresolved transactions, statutory accounting duties, disputes, security investigations and the need to diagnose failures. Relevant records can remain after account deletion for those purposes. Backups and provider logs follow their own retention cycles; deletion is not necessarily immediate in every system. Contact us for information about a particular record or an erasure request.
8. Your Choices and Rights
Subject to applicable law, you can request access, correction, erasure, restriction or a portable copy of your data, and object to processing based on legitimate interests. You can withdraw consent and object to direct marketing at any time. We may verify your identity and will explain any lawful limits on your request.
You can contact support@staykeasy.com without first closing your account. Where GDPR applies, we normally respond within one month and notify you if a permitted extension is needed. You can complain to the Italian Garante per la protezione dei dati personali or your local supervisory authority, whether or not you contact us first.
9. Security and International Processing
We use encrypted connections, authentication and access controls. No system is completely secure. Providers may process information outside your country, including the United States. International transfers subject to GDPR require a valid transfer mechanism, such as an adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for details of the safeguards applicable to your data and how to obtain a copy.
10. Age and Policy Updates
Our account-based services are intended for adults aged 18 or over. If you believe a child has provided personal information improperly, contact us. We update this notice when our processing changes and communicate material changes through the product or other appropriate channels. A policy update does not itself provide consent for new processing.
This policy is adapted from Automattic’s open-source privacy policy, rewritten for StayKeasy. The policy text is available under CC BY-SA 4.0.