Legal and trust
Subprocessors
Service providers authorized to process customer personal data for YouSaid, and the public sources YouSaid reads on a customer's instruction.
Last updated 2026-09-23
YouSaid will post material changes here before the new subprocessor begins processing customer personal data, subject to urgent security or continuity needs.
| Provider | Purpose | Processing location |
|---|---|---|
| Cloudflare, Inc. | Compute, databases, file and media storage (including Proof recordings, images, and captions), adaptive video delivery of approved Proof recordings and clips (Cloudflare Stream, where enabled), queues, caching, search indexing, custom hostnames for hosted proof pages, live audio and video sessions in Rooms (RealtimeKit, with transcription and optional recording), email delivery, bot protection, and network security | Cloudflare global network and storage locations |
| SansaAI (Sansa) | The AI gateway for every YouSaid model call: classification, summaries, drafts, case studies, translations, mention classification, search embeddings, and, where enabled, transcription of recordings and structured labelling decisions (feedback category, urgency, sentiment and risk, survey comment tone, mention labels, community messages flagged for a moderator, likely duplicate testimonials). Text is redacted of common personal identifiers before it is sent; audio for transcription is not. | Runs on Cloudflare's network. SansaAI selects the underlying model provider for each request under its routing policy. Where enabled, labelling decisions are answered by TypeSafe's Jev model, which SansaAI reaches through OpenRouter. |
| Stripe, Inc. and Link | Managed Payments merchant of record, billing, fraud controls, and transaction support | United States and applicable transaction regions |
| Tremendous, Inc. | E-gift card delivery for participation rewards a company has approved: recipient name and email, reward amount and currency, and our issuance reference. Used only where YouSaid delivers the e-gift; otherwise the company delivers it. | United States |
Data sources
When a company turns on Brand Monitor or connects a review source, YouSaid reads public content or the company's own reviews from these services through their official interfaces. They are sources, not subprocessors: YouSaid sends them only what is needed to fetch content, listed below. What YouSaid keeps from them is described in the Privacy Policy.
| Source | Used for | What YouSaid sends |
|---|---|---|
| YouTube Data API (Google LLC) | Brand Monitor search and removal checks for videos that mention a product | Search terms the company sets and video identifiers |
| Reddit Data API (Reddit, Inc.) | Brand Monitor search and removal checks for posts and comments | Search terms and, optionally, a subreddit |
| Hacker News Search API (Algolia) and Hacker News API | Brand Monitor search and removal checks for stories and comments | Search terms and item identifiers |
| Trustpilot Business API (Trustpilot A/S) | Importing and syncing reviews of the Trustpilot business unit the company sets | The business unit id and an API key |
| G2 API (G2.com, Inc.) | Importing and syncing the company's own G2 reviews with the company's G2 token | The company's G2 product id and token |
| RSS and Atom feeds | Brand Monitor reading feeds the company adds | The feed address |
Integrations a customer connects, such as Slack, Discord, Microsoft Teams, GitHub, Linear, Sentry, or PostHog, receive data on that customer's instruction and are governed by the customer's own agreement with them.
Change notices and objections
Customers may request change notices at privacy@yousaid.dev. A customer may object on reasonable data protection grounds during the notice period. The parties will work in good faith on a practical alternative.