Privacy Policy

1. Introduction

Sailsy.ai is an AI-powered sales management platform operated by Sailsy ("we", "our", or "us"), which is responsible for your account data; for CRM data your organisation is the controller (see section 2). The platform is developed with our technology partner Son of a Coder (Stockholm, Sweden), which works on our behalf as a supplier. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our application and services.

2. Our Role

Your account: For your own account, billing and usage information, we are the controller.

Your organisation's CRM data: Contacts, companies, deals, notes and data found in connected mailboxes are processed on behalf of the organisation that uses Sailsy. That organisation is the controller and decides what is processed; we act as its processor. If you are a contact in a customer's CRM and want to exercise your rights, contact that organisation — we will help it respond.

3. Information We Collect

Account Information: When you create an account, we collect your name, email address, and authentication credentials.

Usage Data: We automatically collect information about how you interact with our services, including pages visited, features used, and timestamps.

CRM Data: Contacts, companies, deals, and other business data you enter, import, or approve for import into the platform.

Connected Services: When you connect services such as Google (Gmail, Calendar), Microsoft (Outlook, Calendar), Twilio, or HubSpot, we access data as authorized by you through those services' consent flows. Section 5 describes mailbox data in detail.

4. How We Use Your Information

• To provide, maintain, and improve our services
• To personalize your experience and deliver the AI-powered features you use
• To communicate with you about your account and service updates
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations

5. Mailbox Data (Gmail and Outlook)

If you connect a Google or Microsoft mailbox, we use the data only to provide the following features you choose to use:

• Reply detection and activity logging: recognising replies and email activity with contacts already in your CRM, so they are logged automatically.
• Sending: sending emails through your own mailbox that you write, schedule in a sequence, or that your booking page sends (confirmations, reminders, reschedules and cancellations). Reading your inbox never sends anything.
• Calendar and scheduling: showing availability and creating the meetings you book.
• Contact discovery ("Read my inbox"): when you turn it on, we read the sender, recipients and dates of messages from the last 12 months to find the people you correspond with. Newsletters, no-reply and automated senders are not kept. For the strongest business relationships (people you have both written to and heard from), up to three recent messages from each person are analysed by our AI provider to find their job title, phone number, company, a short summary of the relationship and any open quote amount. We filter out messages that appear to concern health, beliefs, union membership, sexual orientation, criminal matters or private family matters before anything is sent to the AI, and instruct the AI to leave such topics out; messages from people using personal email addresses (such as gmail.com) are never sent to the AI. Organization owners and admins can turn contact discovery off for everyone.

What contact discovery stores: the email bodies and subject lines it reads are not stored. It keeps only the details listed above, as suggestions visible to you alone. Nobody is added to your CRM until you import them. Suggestions you do not import are deleted after 60 days; disconnecting the mailbox, or choosing "Delete inbox suggestions now", deletes them immediately.

Google Limited Use: Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We apply the same rules to Microsoft mailbox data. Mailbox data is never sold, never used for advertising, and never used to develop, improve, or train generalized AI or machine-learning models. Our staff do not read it unless you ask us to (for example, for support), it is necessary for security or to comply with the law.

6. Service Providers (Subprocessors)

We do not sell personal information. We share data only with providers that help us run the features you use, under agreements that restrict their use of it. Our main providers are:

• Hosting and infrastructure: Supabase (database hosted in the EU — Ireland), DigitalOcean (application hosting), Upstash (scheduled delivery), Google reCAPTCHA (abuse protection)
• AI processing: Anthropic (primary) and OpenAI (fallback), or another model provider your organisation connects with its own API key; ElevenLabs and Deepgram for voice features. An organisation can turn AI off, or choose EU-only processing: AI then runs only on Anthropic's Claude models on Amazon Web Services (Amazon Bedrock) in EU regions, and voice features are off.
• Email, calls and meetings: Google and Microsoft (your connected accounts), Resend (email delivery), Twilio (calls and SMS), Daily (video meetings)
• Payments: Stripe
• Product analytics (only with your cookie consent): Google Analytics, Microsoft Clarity
• Company research and prospecting (only when you use those features, mostly public business data): Apollo, Hunter, Firecrawl, Apify, LinkdAPI, ScrapingDog, Perigon, NewsAPI, Pexels
• Legal Requirements: When required by law, regulation, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets

Some of these providers process data outside the EU/EEA, mainly in the United States. Such transfers rely on appropriate safeguards, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

7. Data Security

We implement industry-standard security measures including encryption in transit and at rest, access controls, and regular security assessments. However, no method of transmission over the Internet is 100% secure.

8. Data Retention

• Account and CRM data: kept while your account is active, and deleted when you or your organisation delete it.
• Inbox and file import suggestions: deleted 60 days after they were last updated if not imported; imported or dismissed suggestions are deleted after 30 days (the CRM record is what remains).
• Mailbox access tokens: deleted when you disconnect the mailbox.

You may request deletion of your account and associated data at any time.

9. Your Rights

Under the GDPR and similar laws you have the right to access, correct, delete, restrict, or port your personal data, and to object to processing based on legitimate interests. To exercise these rights, contact us at the email below. If you object to being in a Sailsy customer's CRM, the customer can delete you and block your address from being suggested for import again; to honour the objection a pseudonymised fingerprint of the address (and a masked hint such as a•••@example.com) is kept. You also have the right to lodge a complaint with a data protection authority — in Sweden, Integritetsskyddsmyndigheten (IMY).

10. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised date.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Sailsy
Email: privacy@sailsy.ai