Privacy Policy

What we collect

Account information. Name, work email address, role, and organization when you or your admin creates an account.

Billing information. Billing contact name, email, and address for your organization. We do not collect or store bank account numbers or payment card details; payments are processed by our payment provider (Intuit QuickBooks Payments), which handles that information under its own terms.

Customer Data. Purchase requests, purchase orders, invoices, packing slips, vendor records, and related documents your team submits or connects. These may include business contact details of your vendors.

Website information. If you sign up for updates or early access on our marketing website, we collect your email address (managed through Loops, our marketing email platform). Our marketing website uses Google Analytics, which collects usage information such as pages visited, approximate location, device and browser type, through cookies. You can control cookies in your browser settings.

Service usage information. Within the platform itself, we collect information about how your team uses the Service, such as features used and actions taken, through our product analytics provider, PostHog. We use this to understand and improve the product.

Technical and error information. When something goes wrong we record diagnostic information through our error monitoring provider, Sentry: the error itself, the page or background job it occurred in, and identifiers for the account and organization involved. These records are configured to exclude names, email addresses, amounts, and document contents.

Support and communications. Messages you send us, including support requests.

How we use it

To provide, secure, and support the Service; to set up and bill your organization; to send service communications; to send product updates and marketing emails you can unsubscribe from at any time; to understand usage in aggregate and improve the Service. We may use aggregated, de-identified data that does not identify any person or organization.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Automated document processing

The Service extracts information from documents you submit, such as invoices and packing slips, using automated processing that includes a third-party AI provider, Google (Gemini API). Documents are processed to provide the Service, are not used by the provider to train its models, and are handled under our agreement with that provider.

We keep diagnostic records of this processing with Langfuse, our AI observability provider, so that we can investigate extraction errors. Those records include part of the extracted output, which can contain vendor names, line item descriptions, and amounts taken from the document.

Who we share it with

We share information only with service providers that help us run Sanyya, under contracts limiting their use of it:

• Supabase, database, authentication, and document storage

• Render, application hosting, background processing, and queue infrastructure

• Google, document extraction (Gemini API, described above), marketing website analytics (Google Analytics), and business email (Google Workspace)

• Langfuse, diagnostic records of automated document extraction (described above)

• Sentry, error monitoring and application diagnostics

• PostHog, product usage analytics

• Resend, delivery of service emails such as approval notifications and team invitations

• Loops, delivery of marketing emails to people who sign up on our website

• Intuit (QuickBooks), invoicing and payments

• Integration partners you connect at your direction, such as your card program, messaging tools, accounting systems, or AI assistants you authorize; data flows to those services only when your organization connects them

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred information.

Security and retention

We protect information with measures including encryption in transit and at rest, access controls, and audit logging. No system is perfectly secure, and we encourage strong passwords and prompt reporting of any suspected unauthorized access to support@sanyya.ai.

We keep account information for as long as the account is active. After an organization's subscription ends, Customer Data remains available for export for 60 days, after which we may delete it, except copies in routine backups or as required by law. Website and marketing data is kept until you unsubscribe or ask us to delete it.

Your choices and rights

You can unsubscribe from marketing emails using the link in any message. You can request access to, correction of, or deletion of your personal information by emailing support@sanyya.ai; we will respond within a reasonable time and honor requests as required by applicable law, including California law. If your information lives inside an organization's Customer Data, we may direct your request to that organization, since it controls that data.

Our website does not respond to browser Do Not Track signals, though you can limit cookies through your browser and through Google Analytics' opt-out tools.

Children

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect personal information from children.

Changes and contact

If we make material changes to this policy, we will post the updated version with a new effective date and notify account holders by email or in-Service notice.

Questions: support@sanyya.ai. Legal notices: legal@sanyya.ai.