Last updated 21 October 2026. Effective 21 October 2026.
This policy explains what personal information Sayliss Technologies collects, why, who we share it with, where it is kept, how long we keep it and how you can have it removed. It applies to our website and to the messaging service we operate for businesses ("clients").
In short: we receive the messages and comments people send to our clients on Facebook, Instagram and WhatsApp, and the emails people send to mailboxes a client connects, so the client can answer them. Conversations are stored in the client's own database account and processed by AI in the client's own AI provider account. We do not sell personal information, use it for advertising or use it to train AI models.
Sayliss Technologies is a trading name of Jacked Jellies (Pty) Ltd, registration 2025/428262/07, registered in South Africa, registered office 502 Forest Hill B, Main Road, Cape Town, Western Cape, 7705. Contact: [email protected].
The client decides why messages it receives are processed. Under the Protection of Personal Information Act, 2013 ("POPIA") the client is the responsible party and Sayliss is an operator acting on the client's written instruction (under the GDPR: controller and processor). You may contact the business or us, and we will act.
4.1 Messages and comments. Content (text, voice notes, photos, video, documents); the sender's platform-scoped identifier (for WhatsApp, the phone number); the name and profile picture the platform provides; timestamps and message IDs; and anything the sender volunteers, such as an order number. Transcripts and descriptions of media are made from this content. For email, this also includes the sender's email address and name, the subject, the other addresses the email was sent to, and the email's identifiers, which keep replies in the same thread. Photos, audio and PDFs attached to an email are kept; other attachments are listed but not kept.
4.2 Business records. Records in systems the client has connected, such as an order and its delivery status.
4.3 People who use the Sayliss app. For client staff who sign in: name, email, role and a record of their actions.
4.4 Website visitors. No advertising cookies or third-party analytics. Our web host keeps standard server logs.
4.5 Data received from Meta. Where a client connects its Facebook Page, Instagram professional account or WhatsApp Business account through Meta's consent screens, we receive incoming messages and comments, sender identifiers, names and profile pictures, the client's account identifiers, and the content of the client's posts that receive comments. We use it only to provide that client's messaging service, under Meta's Platform Terms and Developer Policies.
4.6 Data from connected mailboxes. Where a client connects a mailbox with an app password it creates, we read mail that arrives in the inbox after it is connected. We never mark mail read, move it or delete it. Newsletters, notifications, automatic replies and mail from no-reply addresses are skipped and not stored. Replies a person approves are sent from that mailbox through its own mail server. The client can disconnect a mailbox at any time, and we then delete the stored app password. If the client switches it on, we also read mail its provider files as spam. We keep only the text, do not send it to AI and do not suggest replies to it.
| Purpose | Lawful basis (POPIA / GDPR) |
|---|---|
| Receiving messages, comments and emails and showing them to the client's team | Our contract with the client; the client's legitimate interest in answering people who contact it |
| Transcribing voice notes, describing photos and reading documents | Contract; legitimate interest in understanding what the customer sent |
| Looking up an order to suggest an accurate reply | Contract; legitimate interest of customer and business in a correct answer |
| Confirming that a person asking about an order is the customer on it | Legitimate interest in not disclosing one person's order to another |
| Sending replies a person approved, or that a rule the client switched on sends | Contract |
| Recording who or what sent each message; short operational records | Legitimate interest in accountability, security and reliability |
| Complying with law | Legal obligation |
Every reply starts as a suggestion. A client may switch specific kinds of message to automatic. Automatic replies are only sent within 24 hours of the person's last message, never for anything the client has marked as needing a person, and never when a fact could not be checked. An automatic reply says it comes from the business's automated assistant, and the person can ask for someone at the business at any time. The client can turn all automatic replies off at once. Email replies are never sent automatically.
| Provider | What they do | Where |
|---|---|---|
| Meta Platforms | Delivers messages and comments to and from Facebook, Instagram and WhatsApp | International |
| The client's email provider (for example Google Workspace) | Hosts the client's mailbox; we read new mail from it and send replies through it, in the client's account | Chosen by the client |
| Supabase | Hosts Sayliss's connection service | European Union (Frankfurt) |
| The client's database provider | Hosts the client's workspace, in the client's account | Chosen by the client |
| The client's AI provider (for example OpenAI) | Transcribes, describes and reads media; suggests replies; in the client's own account | Chosen by the client; typically United States |
| Cloudflare | Hosts this website and the Sayliss web app client staff sign in to | International |
| 1-grid | Hosts our email | South Africa |
We may disclose information where the law requires it, or to establish, exercise or defend a legal claim.
Some providers process information outside South Africa, including in the European Union and the United States. We rely on section 72 of POPIA (recipients bound by agreements giving comparable protection) and on standard contractual clauses where the GDPR applies.
| What | Where | How long |
|---|---|---|
| Incoming messages as received from Meta | Sayliss connection service | Up to 30 days |
| Record of each message sent (who or what sent it, when, Meta's response) | Sayliss connection service | Up to 12 months |
| Conversations, comments, files, transcripts, suggested replies, decisions | Client's workspace | As the client decides; we recommend no more than 12 months after the conversation ends |
| Access keys to a client's Meta accounts | Sayliss connection service, encrypted | Until the client disconnects or ends the agreement |
| App passwords for connected mailboxes | Sayliss connection service, encrypted | Until the client disconnects the mailbox or ends the agreement, then deleted at once |
| Operational and error logs | Sayliss connection service | Up to 90 days |
| Records the law requires | Where required | As the law requires |
When a client ends its agreement, we delete what we hold in our connection service within 60 days, revoke our access to its accounts, and remove our software from its workspace if it asks. The client keeps its own data.
Access keys and mailbox app passwords are stored encrypted and never shown to people. Every message Meta sends us is checked for Meta's signature. Each client's data is kept separate from every other client's. Connections are encrypted. Every send is recorded with who or what sent it and why. If a security compromise affects your information, we will notify the Information Regulator and affected people as section 22 of POPIA requires.
Under POPIA and, where it applies, the GDPR, you may ask what we hold about you, ask us to correct or delete it, object to processing based on legitimate interest, ask for a portable copy, and complain to a supervisory authority. Email [email protected]; we reply within 30 days and may first confirm your identity. South Africa: Information Regulator (inforegulator.org.za). EU/UK: your national data protection authority.
Email [email protected] with the subject "Data deletion request", saying which business you contacted and the phone number, Instagram username, Facebook name or email address you used. We acknowledge within 5 working days and complete within 30 days. Full details: sayliss.com/data-deletion.
Our service is for businesses and is not directed at children. If you believe we hold information about a person under 18 without a competent person's consent, contact us and we will delete it.
We update this page and its date when our practices change, and tell clients directly about material changes.
Jacked Jellies (Pty) Ltd trading as Sayliss Technologies, 502 Forest Hill B, Main Road, Cape Town, Western Cape, 7705, South Africa · [email protected]