How Say It Once handles your data.

Say It Once turns material you already have, spoken or written, into written content in your voice. To do that it processes what you bring in and what you generate. Your content trains only your own voice profile, never a shared model. We do not sell data, we do not run advertising trackers, and you can delete everything yourself at any time.

Account: your name, email address, and sign-in credentials. Authentication is handled by Clerk; Say It Once never stores passwords.

Source material: whatever you choose to bring in. Transcripts from your own public YouTube channel, text you paste, documents you upload, audio files you upload, podcast episodes by link or RSS, articles you link, and your own social posts. You control entirely what you feed the system.

Voice recordings: if you record a spoken note inside Say It Once, the audio is sent for transcription and the transcript is kept as source material.

Generated content: the drafts Say It Once produces, your ratings and edits of them, and the reason you give when you tell us a draft does not sound like you.

Profile: brand colors, fonts, language preference, and voice-profile settings, including any personal guardrails you set.

Connected accounts: if you connect Google Drive, we store the Google address you connected with and the access tokens that let us open the files you pick. Nothing else about your Drive is stored, and the tokens are reachable only by the server.

Payments: handled entirely by Stripe. Say It Once stores your subscription status and plan, never card numbers.

Usage and diagnostics: generation counts, what each generation cost us at each vendor, feature settings, standard server logs, and error records. Error records say what failed, for which account, and when. They do not record what you wrote.

We do not ask for or process special-category data by design. You control what content you feed the system.

Account, content, and payment processing happen because the service cannot function without them (performance of contract). Your ratings and edits are used to improve your own voice profile, and we keep error records and per-generation cost records so that faults are visible and the service stays affordable to run (legitimate interest). Where an optional feature needs consent, such as connecting a third-party account, we ask for it.

Your data lives with a small set of processors, each doing one job:

• Supabase: database and storage, hosted in the EU (Ireland, eu-west-1).
• Vercel: application hosting.
• Clerk: sign-in and accounts (US-based, EU transfers under Standard Contractual Clauses).
• Anthropic: AI generation (US-based). Your source material is sent to generate your drafts. Per Anthropic's commercial policy, API inputs and outputs are deleted within 30 days and are not used to train Anthropic's models.
• OpenAI: speech transcription (US-based). Audio you record or upload is sent to be turned into text. Under OpenAI's API terms, API data is not used to train their models.
• Resend: service email, EU region. Handles the address we send to and what the message says.
• Brandfetch: if you ask Say It Once to pull your brand colours from a website, the address of that site is sent to Brandfetch. Nothing else is.
• Supadata: fetches transcripts for public YouTube videos.
• Stripe: payments (US-based).
• Google: if you connect Google Drive, we hold tokens for your Google account and read the individual files you pick (Google LLC, US-based). Its transfer position is quoted in the Google Drive section below.
• GoHighLevel: welcome and account email, and the checkout pages that sell Say It Once (HighLevel, Inc., US-based). Its transfer position is quoted in the GoHighLevel section below.

Where a processor is US-based, transfers rely on Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. The full processor list and data processing agreements are available on request.

Say It Once uses essential cookies only, the ones that keep you signed in. There are no advertising or marketing trackers on this site and no analytics product of any kind.

One exception you control yourself: playing the launch video on our front page loads YouTube's player from Google, which then sets its own cookies. Nothing loads before you press play. Until then the page shows a still image served from this site, and Google is not contacted at all.

Connecting Google Drive is optional and you ask for it yourself, in Settings. When you do, Google asks you to grant one permission, drive.file, and that permission is the whole posture: Say It Once can open only the files you pick in Google's own picker. It cannot list your Drive, search it, or reach a single file you have not handed over. We do not ask for the broader read-only or full-Drive permissions, and we will not, because they would put your whole Drive within reach to save you a click.

What we store: the Google address you connected with, and the access and refresh tokens that keep the connection working. Both live in our EU database, reachable only by the server. When you pick a document, we read that file once, turn it into text, and store the text as source material in your library exactly like anything else you bring in. The file itself is not copied, and nothing about the rest of your Drive is stored.

How to disconnect: Settings, then Disconnect on the Google Drive card. That deletes our tokens immediately. To remove Say It Once from your Google account as well, use Google's own permissions page at myaccount.google.com/permissions. Deleting your Say It Once account removes the tokens too, along with everything else.

Say It Once's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Drive data for advertising, we do not sell it, and no human at Say It Once reads it except where you ask us to help with a specific problem, or where the law requires it.

Transfers out of the EU: Google LLC states in its own data transfer frameworks policy, effective 23 August 2025, that it has certified adherence to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and to the UK Extension to the EU-U.S. framework, as set out by the US Department of Commerce, and that it relies on Standard Contractual Clauses for transfers where those are required and are not covered by an adequacy decision. That is Google's statement rather than ours, and it is here so you can read it yourself: policies.google.com/privacy/frameworks.

GoHighLevel is where our email and our checkout pages live. It is how you get a welcome message when you create an account, and how you hear from us about your account afterwards. If you buy Say It Once through one of our checkout pages rather than inside the product, that page is a GoHighLevel page and your payment still goes to Stripe.

What it receives, in full: which thing happened (you created an account, a subscription started, a subscription was cancelled, a payment failed), your email address, the time it happened, and, when we have them, your first name, your last name, and the name of your plan. That is the entire list. No source material, no transcript, no draft, nothing from your library, and nothing you have written.

GoHighLevel is US-based. You can ask us to stop sending you marketing email at any time, by writing to hello@sayitonce.app. Messages about your account and your payments are a part of the service rather than marketing: they are sent for as long as you have an account, and stopping the marketing does not stop them. Deleting your account stops both.

Transfers out of the EU: HighLevel, Inc. states in its own customer data processing addendum, last updated July 2026, that it is certified to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, and that addendum incorporates the Standard Contractual Clauses for restricted transfers. That is HighLevel's statement rather than ours, and it is here so you can read it yourself: gohighlevel.com/data-processing-agreement.

You can delete your account and everything in it at any time, yourself, from Settings, no email to us and no waiting. Deletion removes your profile, your sources and transcripts, every piece you generated, your voice profile, your plan calendar, your uploaded images and your login, and it stops any subscription so you are not charged again.

Three things survive, and we would rather say so than imply otherwise: encrypted backups, which are deleted on their own schedule within seven days; payment records at Stripe, which Swedish bookkeeping law requires us to keep for seven years; and server logs, which record requests rather than content and are deleted after 30 days. Records of technical errors are kept with your identity detached from them.

You can also download everything you have made at any time from Settings, every piece and every source, either as a readable document or as structured data to take into another tool. That is data portability, and you do not have to ask us for it.

You also have the right to access, correction, to object to processing, and to complain to your supervisory authority (in Sweden: IMY). For anything other than deletion and export, write to us at the address below.

The data controller today is Caroline Ravn AB, Stockholm, Sweden. Say It Once is being transferred to a new Swedish company wholly owned by the same founder. The processors, the hosting regions and the retention described on this page do not change with it, and account holders will be told before the transfer takes effect.

Caroline Ravn AB, Stockholm, Sweden.
hello@sayitonce.app