What we collect, what we do with it, what you can demand
This policy covers the sainillar.com website and the Lazao platform. It is written to be read in full, and the list of companies involved is published separately, with what each of them sees.
This site does not track you
sainillar.com is a static site. It sets no cookies, uses no analytics, no advertising pixel, and calls no third-party service: the fonts are hosted with the site, and no request leaves for another domain while you are here.
No consent banner is shown for the simplest of reasons: there is nothing to consent to. The server delivering these pages keeps technical logs, as any web server does, with the IP address truncated and a short retention period, solely to detect attacks.
If you write to us
What we receive
Your email address, your name if you give it, and the content of your message. Nothing else: we never enrich a record with information found elsewhere.
Why we process it
To answer you. The legal basis is our legitimate interest in handling enquiries addressed to us, and your consent when you write to us unprompted.
For how long
Three years after the last exchange for a commercial or press contact, the statutory period for anything accounting-related, and until closure for a security report.
Who has access
The people in the company concerned with the subject, and our email provider, which hosts the mail technically. We do not sell, rent or trade any of this data.
Your rights
You may request access to the data we hold about you, its correction, its erasure, a restriction on its processing, and its portability. You may object to processing based on our legitimate interest, and withdraw any consent you gave at any time, in Lazao's Settings or by writing to us. On Lazao, you can download all your data as one file and delete your account yourself, from Settings. For anything else, write to our general address: we answer within thirty days, and we tell you what we do with your request even when we cannot grant it.
If our answer does not satisfy you, you may refer the matter to the data protection authority competent in your country of residence.
On Lazao
What we collect. Your sign-in identifier (a phone number or an email address), encrypted in the database, your first name and your date of birth; your profile if you fill it in (situation, occupation, instructions); your conversations, as you write them and as the model answers, the photos you send, the images and documents made for you; the memory, if you turn it on; your payment references (amount, currency, date, status, the identifier returned by the provider), never a card number or a wallet PIN; your consent choices, dated; technical data linked to your account (volumes, costs, durations), without the content of your exchanges, and your IP address in hashed form; and, if you accept it, for a sample of requests, a broad topic counted with no link to your account (see Anonymous statistics).
Why. To recognise you at sign-in, give you back your conversations, have a model answer, collect and refund payments, keep the books, and detect the abuses described in the usage policy. We do not sell, rent or transfer any personal data. No advertising is targeted at you as a person: on the free plan, an ad depends on the topic of the current request, your country and the interface language. The only information that leaves the company is the anonymous statistics described below. On what basis. The account, conversations and payments rest on the contract; processing the sensitive information you share with the chat (health, religion, opinions) and its passage through providers outside your country rest on your explicit consent, given at sign-up; memory, anonymous statistics and news from Lazao rest on your consent, optional, unticked by default and revocable in Settings; bookkeeping rests on our legal obligations.
Who it passes through. The text of a conversation is sent to the provider of the model that answers, with your first name and the profile you filled in, but without any address or number; every call requires a host that does not retain the data or train on it. These providers are located notably in the United States and China: this transfer rests on your consent and on contractual clauses. When a question needs recent facts, the rephrased question alone is sent to a search engine. Payment providers see a transaction, not a conversation. The complete, dated list is on the Subprocessors page.
How long. Your conversations stay until you delete them or close your account, or after twenty-four months without any activity: we warn you a month before, by email, WhatsApp or notification depending on what we have, and coming back to Lazao is enough to keep them; the account itself stays open; closing the account erases the history, memory, images, documents, notifications and account data; what remains (telemetry, accounting records) is no longer linked to anyone. Accounting records tied to payments are kept for the legal retention period, separately, without the content of your exchanges. Technical data linked to the account and sign-in logs are erased after thirteen months, notifications after twelve months, the web search cache after thirty days; server logs keep only a truncated IP address. Internal analysis exports are destroyed after thirty days. Backups, encrypted, are kept for thirty days.
What we do not do. We train no model and pass your conversations to no one for that purpose. We do not read conversations to police accounts: usage signals trigger a review, as the usage policy explains. We set no advertising tracker in the apps.
Anonymous statistics
On Lazao, we count what requests are about, without keeping what they say. These counters help us understand needs and improve the service. Aggregated under k-anonymity, they may also be published, shared or sold to organisations that study those needs. Nothing that leaves allows anyone to find a person or a conversation.
What is counted
If you have accepted it, a sample of your requests, currently one in ten, is given a broad topic (for example “jobs” or “farming”) and a generic label of three to five words, with no proper name and no number. To assign it, the text of the request is sent without any identifier to the provider of one of our models, under the same conditions as a conversation. We then keep one counter per day, topic, interface language and country: not the text, not your identifier, nothing that links the counter to your account.
What is never counted
Requests about health, religion, politics or sexuality: they are set aside before any counting, topic and label included. Requests from accounts that have not agreed to contribute, and those of every account under eighteen. The content of the model's answers.
The threshold of ten
A cell appears, internally as well as externally, only if it holds at least ten requests over the period. Below that, it is suppressed, including when it would serve as a comparison with the previous period. Statistics cover at least seven days, go no finer than the country, and count requests, not people.
Who may receive them
Companies, public bodies, non-governmental organisations, researchers and media, as reports or tables. Every licence forbids raw resale and any attempt to identify a person. No recipient has access to our database or to row-level data.
How to opt in or withdraw
Contributing is offered at sign-up, unticked, and stays off until you accept it. In Lazao's settings, under Privacy, the switch “Help Lazao with anonymous statistics” withdraws it at any time: none of your requests is counted any more, starting with the next one. What has already been counted cannot be linked to you, and therefore cannot be withdrawn.
On what basis
Your consent, given at sign-up or in Settings and recorded with its date. You may withdraw it at any time with the switch described above, without giving a reason and with no effect on the service.
Minors
Lazao is open from thirteen. From thirteen to seventeen, the user declares at sign-up that they have the consent of a parent or guardian; we record this declaration and its date. Whatever the declared consent, the account runs in teen mode: no memory, no statistics, no ads or marketing reminders, and answers suited to the user's age.
A parent or guardian can ask for their child's account to be erased at any time by writing to [email protected]. An account opened by a child under thirteen is refused and its data erased at once. On their eighteenth birthday, the account switches to adult mode and the person chooses their optional consents themselves.
Transfers and hosting
The site and the company's services are hosted in Europe. When data leaves the European Union it does so under the European Commission's standard contractual clauses, or towards a country recognised as offering adequate protection.
The Lazao platform involves payment providers and AI model providers established outside the Union. The detail of those transfers, what is sent to them and what is not, is on the Subprocessors page.
Data controller: SAINILLAR - FZCO.