What leaves STYD
STYD Cloud uses AI models from OpenAI to understand questions and write answers. This page says what is sent to OpenAI for each feature, what is never sent, which other services receive data, and how long STYD keeps things. The Privacy Policy is the full reference: if this page and the Privacy Policy ever differ, the Privacy Policy applies.
What is sent to OpenAI
A question about a PostgreSQL or MySQL database.
The question, the earlier part of the same conversation, the table and column names and types, descriptions and business terms, stored sample values, and the result rows needed to write and check the answer. Rows and sample values come from your own data, so they can include personal data such as names, email addresses or phone numbers.
The question, the earlier part of the same conversation, the table and column names and types, descriptions and business terms, stored sample values, and the result rows needed to write and check the answer. Rows and sample values come from your own data, so they can include personal data such as names, email addresses or phone numbers.
The AI Guide analysis of a database.
Table and column names and types and a few example values, with long numbers partly masked, to draft descriptions. Afterwards, the database name, the table and column names, short descriptions, size and activity bands (never exact numbers or row contents) and how tables connect, to write the database summary. Columns that look like personal data or secrets are sent without any value.
Table and column names and types and a few example values, with long numbers partly masked, to draft descriptions. Afterwards, the database name, the table and column names, short descriptions, size and activity bands (never exact numbers or row contents) and how tables connect, to write the database summary. Columns that look like personal data or secrets are sent without any value.
A question about Odoo.
Answers are computed and written by STYD's own code from your Odoo records, and those records are not sent to OpenAI to compute the answer. There are two exceptions. When STYD adds general knowledge to an Odoo answer, or answers a general question in a conversation that contains Odoo answers, OpenAI receives the text of those answers and some of their rows (next item). On a follow-up question, OpenAI can receive the names and Odoo ids from the previous answer, that is the customer, vendor or product it was about or, after a ranked list such as “the top customers”, up to 20 of them from that list, so that the follow-up can be matched to one of them. The question itself may also be sent when STYD's own rules do not cover it, or when it is in a language other than English or French. For those languages, the wording of the answer is sent to be translated, with numbers, dates, codes and the record names STYD recognises replaced by placeholders.
Answers are computed and written by STYD's own code from your Odoo records, and those records are not sent to OpenAI to compute the answer. There are two exceptions. When STYD adds general knowledge to an Odoo answer, or answers a general question in a conversation that contains Odoo answers, OpenAI receives the text of those answers and some of their rows (next item). On a follow-up question, OpenAI can receive the names and Odoo ids from the previous answer, that is the customer, vendor or product it was about or, after a ranked list such as “the top customers”, up to 20 of them from that list, so that the follow-up can be matched to one of them. The question itself may also be sent when STYD's own rules do not cover it, or when it is in a language other than English or French. For those languages, the wording of the answer is sent to be translated, with numbers, dates, codes and the record names STYD recognises replaced by placeholders.
A general question, advice or a draft.
To decide where to look, STYD may send the question, the recent messages of the conversation and a short description of your workspace: its name and time zone, your business terms, the data source's name and kind with its main table names and one sentence each, and the names, description starts and topics of your ready documents. That description holds no row values. To write a general answer, or the “General knowledge” part after an answer, STYD sends the question, the same description, the last three exchanges of the conversation (with at most 10 rows of each answer's first table) and the answer the part follows, with up to 20 of its result rows for a database or Odoo answer. In Claude, ChatGPT or another AI app, STYD writes no general answer or part.
To decide where to look, STYD may send the question, the recent messages of the conversation and a short description of your workspace: its name and time zone, your business terms, the data source's name and kind with its main table names and one sentence each, and the names, description starts and topics of your ready documents. That description holds no row values. To write a general answer, or the “General knowledge” part after an answer, STYD sends the question, the same description, the last three exchanges of the conversation (with at most 10 rows of each answer's first table) and the answer the part follows, with up to 20 of its result rows for a database or Odoo answer. In Claude, ChatGPT or another AI app, STYD writes no general answer or part.
Uploaded documents and spreadsheets.
The text of each passage, to turn it into a search vector. The beginning of each text document, or a summary of each spreadsheet, to write its description. For each spreadsheet table, its column headers and up to 20 rows, to check how it was read. When you ask a question: the question, the names of your files and the start of their descriptions, then the passages needed for the answer (at most 8) or the spreadsheet rows needed for it. Scanned pages are read on STYD's own server: OpenAI receives only the recognised text, never the page images.
The text of each passage, to turn it into a search vector. The beginning of each text document, or a summary of each spreadsheet, to write its description. For each spreadsheet table, its column headers and up to 20 rows, to check how it was read. When you ask a question: the question, the names of your files and the start of their descriptions, then the passages needed for the answer (at most 8) or the spreadsheet rows needed for it. Scanned pages are read on STYD's own server: OpenAI receives only the recognised text, never the page images.
Search vectors.
OpenAI also turns some text into search vectors: questions, descriptions you write, and the question and answer of an answer you rate with a thumbs-up.
OpenAI also turns some text into search vectors: questions, descriptions you write, and the question and answer of an answer you rate with a thumbs-up.
A safety check on the question.
Before it writes a general answer or part, STYD sends the text of the question, and nothing else, to OpenAI's moderation service. No data goes with it. A flagged question gets a short refusal. Not in AI apps, where no general answer is written.
Before it writes a general answer or part, STYD sends the text of the question, and nothing else, to OpenAI's moderation service. No data goes with it. A flagged question gets a short refusal. Not in AI apps, where no general answer is written.
What is never sent
Secret values
Passwords, tokens, keys, and card or bank numbers are shown as [hidden] and are never sent to the AI model.
Passwords, tokens, keys, and card or bank numbers are shown as [hidden] and are never sent to the AI model.
Your connection details
Database passwords, Odoo tokens and Odoo API keys are stored encrypted and are used only to connect. STYD does not put them in what it sends to OpenAI.
Database passwords, Odoo tokens and Odoo API keys are stored encrypted and are used only to connect. STYD does not put them in what it sends to OpenAI.
The rest of your database
STYD sends the layout of the database and the rows a question needs, not a copy of the database.
STYD sends the layout of the database and the rows a question needs, not a copy of the database.
Original files and page images
The original file is deleted once it is processed, and scanned pages and photos are read on STYD's server. A photo's location, date and camera are never stored, shown or sent.
The original file is deleted once it is processed, and scanned pages and photos are read on STYD's server. A photo's location, date and camera are never stored, shown or sent.
How STYD calls OpenAI
STYD trains no AI model on your data. It asks OpenAI not to store chat and answer requests, wherever OpenAI offers that option. Some calls, such as turning text into search vectors, have no such option, so they follow OpenAI's own terms. How OpenAI handles data is described in OpenAI's privacy policy.
Result rows and sample values come from your data. If a question needs names, emails or phone numbers, they can be part of what is sent. Hide a table from a member in the AI Guide if it should not be used for their questions.
Other services that receive data
Stripe
Payments. STYD sends your workspace number, the plan, the billing cycle and the number of prompts bought. You enter your email address, name, billing address and card on Stripe's own page. Card details are held by Stripe only.
Payments. STYD sends your workspace number, the plan, the billing cycle and the number of prompts bought. You enter your email address, name, billing address and card on Stripe's own page. Card details are held by Stripe only.
Resend
Email delivery: sign-in links, invitations, payment receipts, and the messages you send us through the support and application forms.
Email delivery: sign-in links, invitations, payment receipts, and the messages you send us through the support and application forms.
Umami
Visit statistics, run on STYD's own server. No cookies and no IP address stored. It counts page addresses (with record numbers hidden), the referring site, the country, region and city, and the device type, on public pages and inside the app.
Visit statistics, run on STYD's own server. No cookies and no IP address stored. It counts page addresses (with record numbers hidden), the referring site, the country, region and city, and the device type, on public pages and inside the app.
Hosting and backups
The server is hosted by Contabo in Singapore. A daily encrypted copy of the backups is stored on Google Drive, which holds only the encrypted files.
The server is hosted by Contabo in Singapore. A daily encrypted copy of the backups is stored on Google Drive, which holds only the encrypted files.
Google
Only if you sign in with Google: it confirms who you are and gives STYD your name, email address and profile picture.
Only if you sign in with Google: it confirms who you are and gives STYD your name, email address and profile picture.
The AI app you connect
An app such as Claude receives the answers it asks for on your behalf, with up to 50 rows of data each. They pass through that app's provider under its own terms.
An app such as Claude receives the answers it asks for on your behalf, with up to 50 rows of data each. They pass through that app's provider under its own terms.
How long STYD keeps it, and how to delete it
Conversations, answers, result rows, analysis results and feedback are kept until you ask for deletion.
Conversations cannot be deleted from the app today. Ask by email and STYD deletes a workspace or an account within 30 days.
Owners and admins can delete an uploaded document at any time in Settings → Documents. Original files are deleted once processing has finished, or within 24 hours if processing stops.
Routing traces (the sources planned and used, the moderation result, models, timings and costs; never the question or the answer) are kept 90 days.
Archiving a connection erases its password, token or API key. Its past answers stay until the workspace is deleted.
Technical logs are rotated daily and kept up to 30 days (application) or 14 days (web server).
Backups are kept 7 days on STYD's server and 90 days encrypted off-site. Deleted data can remain in them until they expire.
What was already sent to the services above is handled under their own policies.
If nothing may leave
If your data must not be processed by an outside AI provider, STYD can install a private assistant on your own server as a custom project. See Private AI and Private AI on Your Own Server. STYD does not provide a compliance certification, and meeting your own obligations remains your responsibility.