Privacy Policy
This policy explains what data Saalis collects, why, who processes it, and the rights you have over it. We've kept it plain. If anything is unclear, email privacy@saalis.app.
01Who we are
Saalis is a product of NOVA RIOT TECHNOLOGIES OY (business ID / Y-tunnus 3634669-5), a company registered in Finland at Nahkasuutarintie 11 C 25, 02780 Espoo. In this policy, "Saalis", "we", "us" and "our" refer to that company. We are the data controller for the personal data described here. You can reach us about privacy at privacy@saalis.app.
02What we collect
We collect only what the service needs to work:
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address | To sign you in (passwordless magic-link login) and send service emails | Contract (Art. 6(1)(b)) |
| Photos you upload | Processed to generate your listing text, then discarded, not stored by us | Contract (Art. 6(1)(b)) |
| Listing text generated | Returned to you in the app; not retained on our servers after your session | Contract (Art. 6(1)(b)) |
| Account & plan data | Your plan tier, subscription status, and billing reference from our payments provider | Contract (Art. 6(1)(b)) |
| Basic technical logs | Security, abuse prevention, and keeping the service running | Legitimate interest (Art. 6(1)(f)) |
We do not ask for or intentionally collect special-category data (health, ethnicity, and so on). Please don't upload photos containing such information about identifiable people.
03Your photos: what happens to them
This is the part people ask about most, so we're explicit:
- When you upload a photo, our backend reads it into memory, sends it to our AI provider to produce the listing text, and then discards it.
- Saalis does not store your uploaded photos on disk, in a database, or in cloud storage.
- When you choose to publish (an optional feature), images are likewise held in memory only and streamed directly to the destination marketplace's own image service, never stored by us.
The one thing to understand: to generate the text, the photo is sent to a third-party AI provider. What they do with it is covered next.
04AI processing (Anthropic / Claude)
Saalis uses Anthropic's Claude model (Claude Sonnet 4.6) to read your photo and write the listing text. To do this, the image and the generated text are sent to Anthropic's API.
Under Anthropic's current terms, inputs and outputs sent through the API may be retained by Anthropic for up to 30 days and may be accessed by Anthropic for safety and security purposes (for example, to detect misuse). They are not used to train their models through the API. This retention is Anthropic's, not ours, we hold nothing after your session. You can read Anthropic's terms at anthropic.com/legal.
Anthropic acts as a data processor for this step. Because processing may occur outside the EU/EEA, it relies on the appropriate safeguards (such as Standard Contractual Clauses) that Anthropic provides.
05Sign-in & email
Saalis uses passwordless sign-in: you enter your email and we send you a one-time link. We do not store passwords, there are none. Sign-in links are sent through Postmark (a transactional email provider) and expire quickly. If you opt in to our newsletter, we send that monthly through a separate provider, and every issue has a one-click unsubscribe. We never sell your email address.
06Payments
Paid plans are handled by Paddle (Paddle.com Market Ltd), which acts as our Merchant of Record. Paddle processes your payment, handles EU VAT, and is the seller of record for the transaction. Your card details go to Paddle, not to us, we receive only your plan, subscription status, and a billing reference. Paddle's own privacy terms govern the payment data it holds; see paddle.com/legal/privacy.
07Who else we share with
We share data only with the processors that make the service work, each for the single purpose listed:
- Anthropic, AI listing generation (section 4).
- Postmark, sending sign-in and service emails.
- Paddle, payments, billing, and EU VAT (section 6).
- Our hosting infrastructure, running the app and database.
We do not sell your personal data, and we don't share it for advertising.
08How long we keep things
- Photos: not stored by us at all (see section 3).
- Account & email: kept while your account is active; deleted on request or a reasonable time after you close your account.
- Billing records: kept as long as accounting and tax law require.
- Technical logs: kept for a short period for security, then rotated out.
09Your rights
Under the GDPR you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to processing; and receive it in a portable format. To exercise any of these, email privacy@saalis.app and we'll respond within the legal timeframe. You also have the right to complain to your national data protection authority, in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).
10Cookies
Saalis uses only what it needs to keep you signed in and the service functioning. We do not use advertising or cross-site tracking cookies. If we ever add optional analytics, we'll ask first where the law requires it.
11Children
Saalis is a tool for people selling their own items and is not directed at children. We don't knowingly collect data from anyone under 16.
12Changes to this policy
If we change how we handle data, we'll update this page and its effective date. Material changes will be flagged in the app or by email where appropriate.
13Contact
Privacy questions, requests, or complaints: privacy@saalis.app. General support: support@saalis.app.