Say Less Office

Privacy Policy

Last updated September 8, 2026

This Privacy Policy explains how Say Less Office ("Say Less Office", "we", "us") collects, uses, shares, and protects information when you use our website and content workspace (the "Service"). It applies both to the social media managers who use Say Less Office to plan and manage content and to the clients they invite into a workspace. By using the Service, you agree to the practices described here.

Our role

Say Less Office is a workspace where social media managers plan content and collaborate with their clients. Because of that, we handle two kinds of information differently:

  • For your own account and how you use the Service, Say Less Office is the data controller.
  • For information you add about your clients (such as their contact details), or that your clients add about themselves, you - the account holder - are the controller, and Say Less Office acts as a processor that stores and processes that information on your behalf and under your instructions. If you manage other people's information in the Service, you are responsible for having a lawful basis to do so.

Information we collect

  • Account and profile information - your name, email address, and password (stored only in hashed form), plus optional profile details such as an avatar and short bio, and your settings such as timezone and notification preferences.
  • Workspace and client information - the name and branding of your workspace, the client projects you create, and the contact and business details you enter about your clients (for example a client's name, email, phone number, business name, website, and social handles). When you invite a client or collaborator, we store their email address and an invitation token.
  • Content you create - posts, drafts, captions, hashtags, content ideas, comments, internal notes, reusable snippets, labels, calendar entries, tasks, and brand assets you add to the Service.
  • Media you upload - the images, video, and documents you upload, which are stored as files in private cloud storage.
  • Billing information - if you subscribe to a paid plan, your payment is handled by our payment provider, Lemon Squeezy, acting as the merchant of record. We receive and store billing references such as a customer ID, subscription ID, plan, seat count, and subscription status. We do not receive or store your full card number. We also store any invoices you create for your own clients within the Service.
  • Communications and email activity - when we send service emails to you or to clients you invite (such as sign-in links, password resets, invitations, and notifications), we keep delivery records, including whether a message was delivered, bounced, or opened, so we can operate and troubleshoot these messages.
  • Technical and usage data - we automatically receive certain information from your device and browser, including your IP address, approximate location derived from it, device and browser type, and server logs. We use a lightweight performance tool (Vercel Speed Insights) to measure page performance. We also use Google Ads measurement on this marketing website to understand whether a visit came from one of our advertisements - see "Cookies and advertising" below.

How we use your information

  • To provide, operate, and maintain the Service.
  • To authenticate you and keep your account and workspace secure.
  • To enable collaboration between you and the clients and collaborators you invite.
  • To process payments and manage subscriptions, through Lemon Squeezy.
  • To send service-related messages, and - only where permitted or with your consent - occasional product updates.
  • To monitor performance, debug, and improve the Service.
  • To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
  • To comply with our legal obligations.

Legal bases for processing

If you are in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases:

  • Performance of a contract - to provide the Service you have signed up for.
  • Legitimate interests - to secure, maintain, troubleshoot, and improve the Service and communicate with you about it, balanced against your rights.
  • Consent - for any optional marketing messages and for non-essential cookies, where required. You can withdraw consent at any time.
  • Legal obligation - where we must process information to comply with the law.

Where you use Say Less Office to process your clients' personal information, you are responsible for establishing the legal basis for that processing.

How we share information

We do not sell your personal information. We use Google Ads measurement to tell whether a visit to this website came from one of our advertisements, which is described in "Cookies and advertising" below; apart from that we do not share your information for advertising purposes. We share information only in these cases:

  • Service providers (subprocessors). We rely on a small number of trusted providers to run the Service. They process information only to provide services to us and are bound to protect it:
    • Vercel - application hosting, content delivery, and server infrastructure;
    • Neon - our managed database, where account, workspace, and content data is stored;
    • Cloudflare R2 - private file storage for the media and documents you upload;
    • Resend - delivery of transactional emails;
    • Lemon Squeezy - payment processing and subscription billing, as merchant of record;
    • Google - advertising measurement on this marketing website, so we can tell whether a visit came from one of our advertisements.
  • Legal and safety - when required by law, or to protect the rights, property, or safety of Say Less Office, our users, or the public.
  • Business transfers - if Say Less Office is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will notify you of any change in control of your personal information.

We keep this list current and will update this policy if our subprocessors change materially.

Artificial intelligence

We do not send the content you create to third-party AI services, and we do not use your content to train AI or machine-learning models.

Where and how we store your data

Say Less Office is entirely cloud-hosted. We do not run on-premise infrastructure or operate our own servers. The Service runs on the following managed platforms, with primary data residency in the European Union:

  • Application and server infrastructure - Vercel's serverless platform.
  • Structured data - a managed PostgreSQL database (Neon), holding accounts, workspaces, client records, posts, comments, and settings.
  • Files - a private Cloudflare R2 bucket, holding the media and documents you upload.

Both the database and the file storage encrypt data at rest at the storage layer.

International data transfers

Say Less Office stores data on managed infrastructure located in the European Union. Some of our providers operate in the United States or other countries, so your information may be transferred to and processed in countries outside your own, including the United States. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

Cookies and advertising

We use cookies and similar technologies in three ways:

  • Essential cookies. These keep you signed in and remember your preferences. The Service does not work without them, and they are set on the basis of providing the Service you asked for rather than consent.
  • Performance measurement. We use Vercel Speed Insights, a privacy-friendly tool, to measure page performance. It does not profile you or follow you across other websites.
  • Advertising measurement. If you arrive from one of our advertisements, Google Ads measurement records that the visit came from that ad, using cookies Google sets on this marketing website. We use it to tell whether our advertising works, not to build a profile of you or to show you ads. It runs only on this website: the Say Less Office app sets no advertising cookies at all.

Advertising measurement is not essential to the Service. We ask for your consent before those cookies are set, and nothing non-essential loads until you accept. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of this website. You can also control cookies through your browser settings, though some features will not work without the essential ones.

Data retention

We keep your information for as long as your account or workspace is active, or as long as needed to provide the Service and meet our legal, accounting, and security obligations. In practice:

  • Content you create - posts, captions, comments, notes, and uploaded media are kept until you delete them or delete your account.
  • Account and workspace records - kept for the life of the account.
  • Email delivery records - kept as a delivery audit trail for the life of the account, so we can troubleshoot messages that did not arrive.
  • Sign-in and verification tokens - short-lived by design; expired tokens are purged automatically by a daily maintenance job.
  • Billing records - retained for as long as accounting and tax law requires, which may be longer than the life of the account.

Deleting your data

Deleting content or media removes it from our active systems immediately. You can also delete your entire account at any time from the account settings in the Service, without emailing us. Account deletion is a hard delete rather than a flag:

  • If you own a workspace, deleting your account removes the workspace and everything in it - client projects, posts, media, invoices, labels, and comments - along with your own user record.
  • If you are a client with portal access, deleting your account unlinks you from the portals you were invited to and removes your user record, comments, and notifications. Your social media manager's own project data is unaffected.
  • Uploaded files are removed from file storage once the corresponding database records are deleted.
  • Account deletion is blocked while a paid subscription is still active, so billing is wound down first. Cancel the subscription, then delete the account.

Before deleting, you can download a complete export of your data from the same settings screen. After deletion:

  • Database records stay recoverable from our database provider's point-in-time restore history for up to 6 hours. After that window passes they are unrecoverable, including by us.
  • Uploaded files are deleted from file storage at the same time as the records that reference them.

We may retain information we are required by law to keep, such as billing records.

Your rights

Depending on where you live, you may have some or all of the following rights over your personal information: to access it, correct it, delete it, export it (portability), object to or restrict certain processing, and withdraw consent. To exercise any of these rights, contact us at the address below, and we will respond as required by applicable law. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

If your personal information is held in a workspace managed by a social media manager who is our customer, please contact them first, as they control that information; we will assist them in responding to your request.

California privacy rights

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its "sale" or "sharing." We do not sell your personal information. We use Google Ads measurement as described under "Cookies and advertising", which depending on interpretation may amount to "sharing" under California law; you can opt out at any time through our cookie controls or your browser settings. We will not discriminate against you for exercising your rights. The categories of personal information we collect are described in "Information we collect" above - identifiers such as your name and email; commercial information such as subscription records; internet and network activity such as IP address and email-delivery records; and the content and files you choose to provide. To exercise your rights, contact us using the details below; you may use an authorized agent where permitted.

Security

We use technical and organizational measures to protect your information:

  • All traffic is served over encrypted connections (HTTPS).
  • Account passwords are stored only in hashed form. We never store them in plain text and cannot read them.
  • Access to workspace and client data is enforced by role-based access checks on every request, so members of one workspace cannot reach another workspace's data, and a client can reach only their own portal.
  • Uploaded files are held in private storage. They are not publicly listable, uploads use short-lived signed URLs, and downloads are served through the application only after an access check.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Reporting a security issue

If you believe you have found a security vulnerability in Say Less Office, please email security@saylessoffice.com with enough detail for us to reproduce it. We aim to acknowledge reports within two business days and will keep you updated while we investigate. Please give us a reasonable opportunity to address the issue before disclosing it publicly. We will not pursue legal action against researchers who report in good faith and who avoid privacy violations, data destruction, and service disruption.

Children

The Service is intended for businesses and professionals and is not directed to children. You must be at least 16 years old to use the Service, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.

Contact

Questions about this policy, or want to exercise your rights? Email us at hello@saylessoffice.com.

← Back to home