Overview

SaySo is a feedback collection platform that respects your privacy. This policy explains how we handle information when you give feedback through a SaySo touchpoint: a web page opened from a QR code, a kiosk, or a tap-to-respond screen.

SaySo is operated by Hoxton Analytics Ltd (HoxtonAi), 51 Eastcheap, London EC3M 1DT, United Kingdom, on behalf of the organisation whose touchpoint you used. That organisation decides what feedback it asks for and how it uses it. Interviews recorded by an organisation's own staff at events are not covered here; the person interviewing you will explain how your interview is used.

Anonymous Feedback

Your feedback is collected anonymously. We do not ask for your name, email address, phone number or age, and we do not store anything about your device or your location.

Audio Recording Processing

When you record audio feedback:

• Your audio recording is securely transmitted to our servers for processing
• We use commercial AI models to transcribe and analyse your feedback
• The audio file is permanently deleted as soon as it has been processed, unless the organisation has chosen to keep recordings for a set period or indefinitely. Where it keeps them, its staff can listen to the recording
• If a recording cannot be processed, we keep the audio for up to 30 days so that we can try again, and then delete it
• Otherwise only the text transcript and analysis are retained, to help organisations improve their services

If you tap an option instead of recording, we store the option you chose.

PII Redaction

To further protect your privacy, we automatically redact personally identifiable information (PII) from feedback transcripts:

• Names, email addresses, phone numbers, addresses and other personal identifiers are automatically detected and removed. This includes the names of other people you mention
• Redacted information is replaced with generic placeholders (e.g., [NAME], [EMAIL])
• This happens during transcription, before the transcript is stored. If redaction cannot be completed, no transcript is stored
• Organisations receiving feedback see only the redacted transcript

Detection is automated and, although we work to make it reliable, it may occasionally miss an identifier. Please avoid saying personal details you would not want the organisation to read.

IP Address Collection

We collect and temporarily store your IP address for the following legitimate purposes:

• Bot and fraud detection: To identify and prevent automated or malicious submissions
• DDoS attack prevention: To protect our services from distributed denial-of-service attacks
• Security monitoring: To detect and respond to security threats

IP addresses are not stored with your feedback and are never shown to the organisation. They are held in a security log that only HoxtonAi can access. When your feedback is accepted, your IP address is removed from that log within two days; for attempts we block, it is kept for 30 days.

Third-Party Services

We use the following third-party services to provide our platform:

• Gadget: Hosting, database and file storage for the platform
• Commercial AI providers (OpenAI and Anthropic): For audio transcription, PII redaction, translation, sentiment analysis, summaries and answering the organisation's questions about its feedback
• Cloudflare Turnstile: For bot protection and spam prevention. It receives your IP address
• Resend: For delivering alert emails to the organisation, which can include the redacted transcript

The organisation can also choose to send its redacted feedback to its own systems and to AI assistants it connects to SaySo. Some of these services process data outside the United Kingdom, including in the United States. They process data in accordance with their respective privacy policies.

Data Retention

• Audio files: Permanently deleted as soon as they have been processed, or after the period configured by the organisation. Audio that could not be processed is deleted after 30 days
• Text transcripts: Retained with PII redacted to provide feedback insights to organisations
• IP addresses: Removed within two days where your feedback was accepted; kept for 30 days for blocked attempts

Children

Touchpoints are placed in public venues, some of which welcome families, so a child may choose to leave feedback. We do not ask for anyone's age, and the same redaction applies to everything that is said. If you are a parent or guardian and would like feedback left by your child to be removed, please contact us.

Your Rights

Giving feedback is always your choice. You can:

• Choose not to provide feedback
• Stop recording at any time before submission
• Ask us to find and delete feedback you have given
• Contact us with any privacy concerns

Because feedback is anonymous, we usually cannot tell which submission is yours. If you tell us the venue, the date and the approximate time, we will do our best to find it. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, and access controls that keep each organisation's feedback separate.

Changes to This Policy

We may update this privacy policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised.

Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at: [email protected]