01 Who is the controller
The data controller is Adianny Ramírez Armenteros, sole trader (Spanish NIE Y0470333C), based in Madrid, Spain, reachable at hello@saelyx.app. Saelyx is the product's commercial brand. For special-category data (facial biometrics) you can use the same contact, which acts as our data protection point of reference.
02 What data we actually store
Saelyx is an agent with memory. So that it can remember what you ask, we do persist certain data tied to your account (identified by your email). Transparently:
- Account: email, name, plan and, if you pay, your customer identifier at the payment provider.
- Memories. Durable facts you choose for Saelyx to remember (routines, preferences, context). May include personal information.
- Faces. If you enable "remember faces", we store the cropped face image and the derived features to recognize it later. This is special-category biometric data (see section 4).
- Scenes. Frames of objects/places you ask to recognize, with their description.
- Meetings. If you use Meeting Mode (a paid feature), we store the meeting transcript (including the voice and content of participants) for 30 days, and a distilled summary durably. It requires your recording consent (see section 4).
- Learned skills. Patterns of how you work that Saelyx automatically derives from your conversations (profiling) to help you better. They make no automated decisions with legal effect. You can delete them anytime.
- Documents. The files you upload to your knowledge bases and the ones Saelyx generates for you.
- Conversation panel. The feed of your most recent conversation (text), so you can resume it across devices.
- Scheduled reminders, personal dictionary and usage metrics.
- Technical data and logs from the app and website (version, OS, crashes, access) to diagnose and detect abuse. In logs, your email is stored pseudonymised (not in clear text).
03 What is processed on the fly (and the nuance)
Live audio is streamed in real time to the voice engine. The camera and the screen are not: Saelyx reads them on your own device, and what travels is the text it has read. Saelyx does not store them in its own systems.
This is the same for everyone. There is no different privacy deal depending on what you pay. Who hears your voice depends on the device: on Mac and iPhone it is processed by ElevenLabs, which is who hears you and who speaks to you. On Apple Watch, today, no audio leaves: we removed that path on 9 August 2026. The new path is already in place and goes to Amazon (Transcribe), in the EU — when the watch listens again the audio will go to our European infrastructure and not to Google. And what Saelyx reads aloud to you is synthesised by Amazon (Polly), in the EU. When you share your screen or open the camera, the image does not leave your device: Saelyx reads the text in it right there, and only that text travels. In Meeting Mode the image is not streamed either. And the photo you choose to save to visual memory is also stored on our servers.
In other words: the ephemerality of audio/screen in our systems is real, and at the voice engine provider we have configured it ourselves: it does not store the audio, and the transcript is deleted after 30 days. Even so, we do not enable its zero-retention mode, so we do not promise you a universal "zero retention": we tell you exactly what is kept and for how long.
04 Faces, meetings and consents
The remember-faces feature processes biometric data, which the GDPR classifies as special category (Art. 9). Therefore:
- It is off by default and is enabled only with your explicit consent, which you can withdraw at any time from the app.explicit consent, which you can withdraw at any time from the app.
- When you withdraw consent we immediately delete all remembered faces: the image, the derived features and its recognition index. (Deleting a single face does the same for that face.)
- Without that consent, our systems store no face at all, even with the camera active.
- You are responsible for presenting to the camera only faces for which you have a legitimate basis; remember to inform those people where appropriate.
Meeting Mode records and summarises your meetings, which involves processing the voice and content of the other participants. It therefore also requires your explicit recording consent before the first meeting. When you enable it:
- You act as the controller of the participants' data: it is your responsibility to inform them and, where applicable, obtain their permission; Saelyx acts as a processor handling the meeting on your behalf (Art. 14).
- The raw transcript is kept for 30 days; the summary, durably until you delete it or close your account.
We keep a record of your consents (what you consented to, when, and with which version of the text), which you can review in your data export. We carry out a data protection impact assessment (DPIA) for these processing activities given their sensitive nature.
05 Legal bases
| Processing | Legal basis (GDPR) |
|---|---|
| Account, access and service delivery | Performance of a contract (Art. 6(1)(b)) |
| Memory, documents, panel, skills | Performance of a contract (core product function) |
| Face recognition (biometrics) | Explicit consent (Art. 9(2)(a)) |
| Meeting recording and summary | Recording consent; you act as controller towards participants (Art. 6, 14) |
| Learned skills (profiling) | Legitimate interest (Art. 6(1)(f)); disclosed, and they can be listed and deleted at any time, all of them or one by one. There is no way to stop them being derived again. |
| Billing | Legal obligation (Art. 6(1)(c)) |
| Logs and security / anti-abuse | Legitimate interest (Art. 6(1)(f)) |
06 Sub-processors (who is involved)
To operate Saelyx we rely on the following providers, each under a data processing agreement (DPA):
| Provider | For what | Note |
|---|---|---|
| Calendar: reading your events, if you connect your Google account. | Calendar only if you connect the account, and read-only. Servers outside the EEA, under the safeguards in section 07. | |
| Amazon Web Services (incl. Bedrock) | Infrastructure (databases, storage, authentication), memory-extraction and vision models, synthesising the voice Saelyx reads aloud with, transcribing Apple Watch voice once it returns and the images you save to visual memory | Storage and databases in the Ireland region. Reasoning goes through an EU inference profile that spreads across European regions by load —Ireland, Frankfurt, Paris, Milan, Stockholm and Spain—. |
| Stripe | Payment processing | Only if you subscribe to a paid plan. |
| Twilio / SendGrid | Transactional email delivery (reminders, sign-in links) | Only your email address and the reminder content. |
| ElevenLabs | Real-time voice: the conversation audio in both directions | It receives both your microphone and the voice Saelyx answers with: it is who hears you and who speaks to you. Servers in the US, under SCCs. Their service does not store the audio: it is processed in real time and discarded. The transcript is kept for at most 30 days and is then deleted automatically. Applies to Mac and iPhone. |
| Microsoft (Graph) | Reading your calendar when you connect your account | Only if you connect the account, and only the permissions you grant when connecting it. |
| Tavily and Brave Search | Web search when you ask for it | They receive the query being searched, not your identity or the rest of the conversation. |
| Apple (APNs) | Push notifications to your devices | For the reminders you schedule. |
We do not sell your data to anyone.
07 International transfers
Saelyx infrastructure is hosted in the European Union (AWS, Ireland region). Everything goes through it. Some providers (Google, Stripe, Apple, ElevenLabs, Microsoft, Tavily and Brave Search) may process data outside the EEA. In those cases, transfers rely on the mechanisms the GDPR provides —Standard Contractual Clauses (SCC) and/or the EU–US Data Privacy Framework where the provider is certified— together with the corresponding DPA.
08 How long we keep data
- Account, memories, faces, scenes, skills, documents: while your account is active. Deleted when you delete the account (cascade deletion).
- Meetings: the raw transcript is kept for 30 days; the summary, while your account is active.
- Conversation panel: up to 90 days from last update (renewed with use).
- Summarised sessions: 90 days. Linked devices: 180 days.
- Application logs: 90 days. Access/authentication logs: 30 days. Email in logs is pseudonymised.
- Billing: 5 years (Spanish legal obligation).
- Audio and screen: not stored in our systems (see section 3).
09 Your rights and how to exercise them
You have the right to access, rectify, erase, object, restrict processing and data portability. The practical way:
- Export all your data (access + portability): from the app, the export option. It produces a file with all your data categories, including the consent record and —while it exists (30 days)— a link to the raw transcript of your meetings.
- Delete your account (erasure): from the app. It is irreversible and cascades through your data across our databases, files and associated indexes.
- Withdraw biometric consent: turn off "remember faces" in the app (deletes your faces immediately).
- Withdraw meeting consent: turn it off in Settings; we stop accepting new recordings.
- Delete learned skills or any specific memory, face or meeting: from the app, without deleting the whole account.
You can also write to hello@saelyx.app (we reply within 72 hours) and lodge a complaint with the Spanish DPA, the AEPD.
11 Minors
Saelyx is not directed at children under 18. If you believe a minor has created an account, write to us and we will delete it.
12 Changes
If we change this policy we will notify you by email before applying it, and we will review the document whenever the processing changes. Previous versions are archived and you can read them: version 4 (5 August 2026) and version 3 (3 – 5 August 2026) and version 2 (2 July – 3 August 2026). There is no English version 1 — the English site did not exist yet; the Spanish version 1 (24 May – 2 July 2026) was withdrawn because it was inaccurate, as explained on that page.
This policy is written in Spanish first and translated into English. Both say the same thing — but if you ever find a difference between them, the Spanish text is the original, and we would rather know: write to hello@saelyx.app and we will fix it.