Legal
Privacy Policy
This policy explains how Joe IT Solutions d.o.o. (“we”) handles personal data when you use the SaySpec website, the account portal, the SaySpec desktop app with a SaySpec account, and SaySpec Cloud. It follows the EU General Data Protection Regulation (GDPR).
1. Who is responsible
For account, billing and website data, the controller is Joe IT Solutions d.o.o., Peteranečki put 2, 10000 Zagreb, Croatia, OIB 07752073300, contact@joe-it-solutions.com.
For personal data inside your workspace content (for example names or screens that appear in a recording), the workspace owner’s organization is the controller and we process that data on its behalf. A data processing agreement is available on request.
2. What we collect and why
- Account data: your name, email address and sign-in credentials (passwords are never stored in readable form). We need them to provide your account. Legal basis: contract.
- Workspace data: workspace name, members, roles, company code and seat use. Legal basis: contract.
- Workspace content in SaySpec Cloud (Pro and Beta): tests, recordings, screenshots, narration transcripts, run reports and proposed fixes that members choose to store or share there. Legal basis: contract, on behalf of the workspace.
- Narration audio transcription: sent to Vertex AI to produce a transcript and not kept by SaySpec Cloud. We record the minutes used per workspace. Legal basis: contract.
- Billing data (Pro): the billing name, address, email, VAT ID and payment method are collected and processed by Stripe. We keep the Stripe customer reference, subscription status, number of seats and invoices. Legal bases: contract and our legal obligations under tax and accounting law.
- Contact form: the name, email address, company and message you send through the custom implementation form on the website, so that we can answer your enquiry. Legal basis: steps you ask for before a contract, and our legitimate interest in answering business enquiries.
- Website analytics: the pages you view, the website or link that brought you here, the buttons and links you click, Mac app downloads, and your browser and device type. Nothing is stored on your device. To count visitors per day, a hash is made from your IP address, your browser’s user agent and a random value that is replaced and deleted every day; your IP address itself is not kept. We cannot tell who you are from this data. Legal basis: our legitimate interest in understanding how people find and use our website.
- Security data: technical logs and rate-limit counters (with IP addresses and account IDs stored only as hashes) to protect the service from abuse. Legal basis: our legitimate interest in a secure service.
Tests stored only on your computer or in a folder you choose stay there; we do not receive them. AI assistants such as Claude or Codex run on your computer with your own accounts; data you send them is governed by your agreement with their providers, not by us.
3. Cookies and similar storage
We do not use advertising or analytics cookies; website analytics works without storing anything in your browser. The portal keeps you signed in with browser storage and remembers short-lived page state (such as a checkout in progress) in session storage. Stripe sets its own cookies on its checkout and billing pages to prevent fraud.
4. Who processes data for us
- Google hosts the service and transcribes narration. Workspace data is stored and processed in the EU.
- Stripe processes payments, invoices and tax calculation. Stripe is also an independent controller for some payment data, for example for fraud prevention.
- Formspree delivers messages sent through the website’s contact form.
- PostHog provides the website analytics and stores it in the EU.
These providers may process data outside the EU, for example in the United States. Such transfers are covered by the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.
5. How long we keep data
- Account and workspace data: while the account or workspace exists, and deleted within 30 days after you ask us to delete it.
- Workspace content in SaySpec Cloud: until it is deleted in the app or the workspace is deleted.
- Invoices and payment records: as long as Croatian tax and accounting law requires.
- Contact form messages: as long as needed to answer your enquiry and handle any business that follows from it.
- Website analytics: up to 12 months.
- Security logs and rate-limit counters: for a short period, normally no longer than 30 days.
6. Your rights
You can ask us for access to your personal data, and to correct, delete, restrict or export it, and you can object to processing based on our legitimate interests. Write to contact@joe-it-solutions.com. For data in a workspace, we may refer you to the workspace owner. You also have the right to lodge a complaint with a supervisory authority; in Croatia this is the Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).
7. Changes
We will update this policy when our handling of personal data changes and show the date of the last change at the top. For significant changes we will also tell account holders by email or in the portal.