What we store, and what we never store.

The short version

• Assay reads pages that companies publish for the public. It stores the sentences it quotes and the addresses of the pages they came from.
• It does not find, store, or infer personal contact details. No emails, no phone numbers, no profiles of people.
• Your account data, your lists, and your runs are stored in a Supabase Postgres database in the United States (us-east-1), scoped to your user id with row-level security.
• Payments are handled by PayPal. We never see or store a card number.
• We do not sell data, and we do not use your runs to train models.

Who is responsible

Machines + Words (Pty) Ltd, registration number 2026/713540/07, Cape Town, South Africa, is the responsible party under the Protection of Personal Information Act (POPIA) and the controller under the GDPR where it applies. Write to hello@assayai.app.

What we store about you

• Account: your email address and a hashed password, held by Supabase Auth. Kept while the account exists.
• Plan: which plan you are on, its status, and the PayPal subscription id. If you paid, the email address PayPal reports as the payer. Kept while the account exists.
• Runs: the run name, the description of who you want, the list of websites, and the result for each: score, verdict, the quoted sentences and their page addresses, the verified flag, and the cost of every paid call. Kept until you delete the run or close the account.
• Billing events: the notifications PayPal sends about your subscription, so a dispute can be settled from a record. Kept for seven years, as tax law requires.

What we store about the companies you read

Up to three public pages per website are fetched through Firecrawl and sent to a language model (Anthropic Claude, through OpenCode Zen) to be scored. The page text is used for the run and for re-audit and is not published. The sentences Assay quotes, and the page addresses, are stored with the run. If a company’s public page names a person, that name may appear inside a quoted sentence; Assay does not extract it into a field and does not index it.

Sub-processors

• Supabase, Inc. — database and authentication, United States.
• Vercel, Inc. — hosting, United States.
• Firecrawl — fetching public web pages, United States.
• Anthropic PBC via OpenCode Zen — the language model that scores companies and proposes quotes. Inputs are not used for training under the terms we operate on.
• PayPal — payments. PayPal’s privacy policy governs what PayPal collects.

Cookies

One session cookie set by Supabase Auth so you stay signed in. No advertising cookies, no third-party analytics cookies. The public run pages set no cookie at all.

Your rights

You can export every run as CSV from inside the product. You can delete any run at once. You can ask for a copy of everything we hold about you, ask us to correct it, or ask us to delete your account, by writing to hello@assayai.app. We answer within 30 days. You may also complain to the Information Regulator of South Africa, or to your own data protection authority.

Transfers

Data is stored in the United States by the providers above under their standard contractual terms. If you need a data processing agreement for your own compliance, ask and we will sign one.

Changes

We will note the date at the top of this page and email account holders about a material change.