Legal
Privacy Policy
This policy explains what personal data SayLive processes, why, and the rights you have over it.
Two roles, and the difference matters
SayLive is a product of KERN-IT SRL, Rue Belliard 2A, 1040 Brussels, Belgium (VAT BE0845906217). KERN-IT is the data controller for the data described on this page: the data of the people who hold a SayLive account.
There is a second set of data we touch and do not control: the data your site collects from its own visitors, through a contact form, a review ticket or a visit count. For that, you are the controller and we are only your processor. What we may and may not do with it is set out in the Data Processing Agreement, not here.
What we collect about you
- Account data: your email address, your organisation, and the members you invite
- Payment data: handled by Stripe, our payment processor. We never see or store card numbers
- Site data: the files you publish, the addresses they are served on, and the activity log of each site
- Email data: which of our emails were sent to you, and whether they were opened. Every email carries an opt-out for commercial mail; receipts and service notices are not covered by it
- Security data: sign-in events, and truncated IP addresses used to rate-limit sensitive endpoints
When a member of our staff opens a support session inside your account, it is recorded, time-limited, revocable, and a banner tells you it is happening while it does.
Why we process it
- To provide the service: create your account and publish your sites
- To bill the one-time payment and prevent fraud
- To keep the service secure and functioning
Our legal bases are the performance of our contract with you, our legitimate interest in a secure service, and consent where required.
Who processes data for us
| Processor | What for | Where |
|---|---|---|
| Stripe | Taking the one-time payment | EU / US, standard contractual clauses |
| Cloudflare | Storing and serving published sites, and their media | EU / global network |
| Scaleway | The servers running the SayLive application itself | France |
These processors act on our instructions under data-processing agreements. The list is kept current on the Data Processing Agreement page, which is also where you find it as a customer whose visitors' data we process.
Retention
We keep account and site data for as long as your account and sites are active, and as required to meet legal and accounting obligations. Two things expire on their own:
- The screenshots attached to review tickets are deleted after 12 months, along with the tickets themselves. A screenshot records what was on a stranger's screen, which is not something to keep indefinitely
- The working draft of a trial that expired and that nobody touched again is emptied after 90 days
Nothing else degrades on its own. A site you paid for keeps its versions and its draft for as long as the account exists: that is the promise of a one-time payment, and it applies to your data too.
Your rights
Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to certain processing.
To exercise a right, or to reach us on data matters, contact [email protected]. You also have the right to lodge a complaint with a supervisory authority, in Belgium the Data Protection Authority (Autorite de protection des donnees, Rue de la Presse 35, 1000 Brussels).
If your request concerns data collected by a site we host rather than your own account, we forward it to that site's owner: they are the controller for it, not us.
International transfers
Where data is processed outside the European Economic Area, we rely on appropriate safeguards such as standard contractual clauses.