Privacy Policy

1. Introduction

This Privacy Policy explains how Saticoy ("Saticoy," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the website located at saticoy.ai (the "Site"), our brand knowledge platform, and our related professional and managed services (together, the "Services").

Saticoy provides a platform that transforms scattered business content — documents, product information, and messaging — into a structured knowledge layer, and offers services that create and distribute content aligned to that layer. This Policy describes how we handle personal information in the course of providing those Services.

By using the Site or the Services, you acknowledge that you have read and understood this Policy.

2. Who We Are and Our Role

We act in two distinct capacities:

• As a controller. When we decide why and how personal information is processed — for example, information about website visitors, prospects, marketing contacts, account administrators, and job applicants — we are the controller (or "business," under US law).
• As a processor. When our customers upload, connect, or otherwise submit content to the platform ("Customer Content"), and that content happens to contain personal information, we process it on the customer's instructions as a processor (or "service provider"). In that case, the customer's own privacy notice governs, and our handling is defined by our customer agreement and Data Processing Addendum. If you believe your personal information is held in a Saticoy customer's workspace, please contact that organization directly; we will assist them in responding to you.

3. Information We Collect

3.1 Information You Provide

• Contact and account information — name, business email address, phone number, employer, job title, and account credentials.
• Customer and billing information — billing contact, billing address, tax identifiers, purchase history, and the last four digits of a payment card. Full payment card details are collected and stored by our payment processor, not by us.
• Communications — the content of demo requests, sales inquiries, support tickets, survey responses, and correspondence with our team.
• Customer Content — documents, product data, messaging frameworks, brand assets, and other materials you upload or connect to the platform, together with any personal information they may contain.
• Recruiting information — where you apply for a role with us, your CV, work history, and related materials.

3.2 Information Collected Automatically

• Device and connection data — IP address, browser type and version, operating system, device identifiers, language, and approximate location derived from IP address.
• Usage data — pages viewed, referring URLs, features used, queries run, session duration, timestamps, and error logs.
• Cookies and similar technologies — see Section 9.

3.3 Information From Third Parties

• Business contact and enrichment data from lead generation, data enrichment, and marketing intelligence providers.
• Authentication data from single sign-on and identity providers, where you choose to use them.
• Publicly available information — including content published on your website and in public sources, which we may analyze to assess how your brand is represented in generative search results.
• Integration data from third-party services you connect to your workspace, limited to the scope you authorize.

We do not intentionally collect special categories of personal data (such as health, biometric, or political data) and ask that you not submit such data to the Services except where expressly agreed in writing.

4. How We Use Information

We use personal information to:

• provide, operate, maintain, and secure the Services;
• create and administer accounts, and authenticate users;
• process orders, invoices, and payments;
• structure, analyze, and enrich Customer Content to produce the knowledge layer and related outputs;
• deliver managed and white-glove services, including content creation and distribution requested by a customer;
• provide customer support and respond to inquiries;
• monitor, troubleshoot, and improve performance, reliability, and product functionality;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• send service and transactional communications;
• send marketing communications, subject to your preferences and applicable law;
• comply with legal obligations and enforce our agreements; and
• evaluate candidates for employment.

5. Artificial Intelligence and Machine Learning

Because our Services involve AI systems, we want to be specific about how information is used:

• Outputs. AI-generated outputs may be inaccurate, incomplete, or inconsistent. Outputs are not a substitute for professional judgment and should be reviewed before publication or reliance. See our Terms & Conditions.
• Automated decision-making. We do not use personal information to make decisions producing legal or similarly significant effects about individuals without human involvement.

6. Legal Bases for Processing (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Providing the Services under a contract — performance of a contract (Art. 6(1)(b)).
• Billing, tax, and accounting records — legal obligation (Art. 6(1)(c)).
• Security, fraud prevention, product improvement, B2B marketing — legitimate interests (Art. 6(1)(f)).
• Non-essential cookies and certain marketing communications — consent (Art. 6(1)(a)).
• Establishing or defending legal claims — legitimate interests / legal obligation.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to that processing as described in Section 12.

7. How We Share Information

We do not sell personal information in the conventional sense. We disclose personal information to:

• Customers — where you are a user within a customer workspace, your administrator may access your account and activity data.
• Service providers — companies that help us run the Site and Services, including Brevo (newsletter delivery), Google (website analytics) and UserWay (accessibility menu). They may only use information to provide their services to us.
• Professional advisors — lawyers, auditors, accountants, and insurers.
• Corporate transactions — a buyer or successor in a merger, acquisition, financing, or asset sale, subject to this Policy.
• Legal and safety — regulators, courts, or law enforcement where required by law or necessary to protect rights, safety, or property.

8. International Transfers

We are based in the United States and use service providers located in the United States, the European Economic Area, and other jurisdictions. Where we transfer personal information out of the EEA, UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented by transfer risk assessments and technical measures where required. You may request a copy of the relevant safeguards by contacting us.

9. Cookies, Browser Storage and Analytics

This section explains exactly what the Site stores in your browser and what our analytics tools collect.

9.1 Cookie notice

• When you first visit, we show a short notice explaining that the Site uses cookies. When you choose “Ok, got it!” we save a small note in your browser’s local storage (named saticoy-cookie-ack-v1) so the notice doesn’t appear again.
• This note only records that you saw the notice. It contains no name, email or identifier, it is never sent to our servers, and it stays on your device until you clear your browser data.

9.2 Newsletter pop-up

• If you close the newsletter pop-up or subscribe, we save a similar note in local storage (named saticoy-subscribe-popup-v1) so the pop-up isn’t shown again. It contains no personal information and is never sent to us.

9.3 Google Analytics

• We use Google Analytics (provided by Google LLC) to understand how visitors use the Site, such as which pages are viewed, how visitors arrive, and roughly how long they stay.
• Google Analytics sets cookies (for example, _ga and _ga_<ID>) that use a random identifier to tell visits apart. Google receives your IP address, browser and device details, approximate location, referring page, and the pages you view. We do not send Google your name or email address.
• Google Analytics cookies typically last up to 2 years. You can block or delete them in your browser settings, or install Google’s opt-out browser add-on at tools.google.com/dlpage/gaoptout. Google’s own practices are described at policies.google.com/privacy.

9.4 Accessibility widget

• We offer an accessibility menu provided by UserWay. If you open it and change settings (such as text size or contrast), UserWay may store those preferences in your browser so they persist across pages. UserWay’s practices are described in its own privacy policy.

9.5 Your choices

• Strictly necessary storage (such as the notes above) cannot be disabled from the Site, but you can clear it at any time through your browser settings.
• We honor Global Privacy Control (GPC) signals as valid opt-out requests where applicable law requires it.

10. Newsletter Signup

If you subscribe to our newsletter through the Site, here is what happens:

• What we collect — only the email address you type in. We don’t ask for your name or other details in the signup form.
• Why — to send you occasional updates about Saticoy, our product and related insights. We rely on your consent, which you give by submitting the form.
• Who handles it — your email address is stored with Brevo (Sendinblue SAS, based in France), the email service we use to manage our mailing list and send newsletters. Brevo may record whether newsletters are delivered, opened or clicked so we can understand what’s useful.
• How long we keep it — until you unsubscribe, or after 24 months without any engagement, whichever comes first.
• How to stop — every newsletter includes an unsubscribe link. You can also reach us through our Contact page and we will remove you.

We never sell your email address or share it with other companies for their own marketing.

11. Retention

We retain personal information for as long as needed for the purposes described in this Policy, and then delete or de-identify it. In general:

• Account and Customer Content — for the term of the customer agreement plus 30 days, unless a longer period is agreed or required.
• Billing and tax records — 7 years, or as required by law.
• Marketing and newsletter contacts — until you unsubscribe or after 24 months of inactivity.
• Security and system logs — 12 months.

Backups are overwritten on a rolling cycle and may persist briefly after deletion from live systems.

12. Your Rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information;
• delete your information;
• restrict or object to processing, including direct marketing;
• receive your information in a portable format;
• withdraw consent at any time, without affecting prior processing; and
• not be discriminated against for exercising these rights.

To exercise any of these rights, contact us through our Contact page. We will verify your request using information already associated with your account and respond within the period required by applicable law — generally one month under the GDPR and 45 days under US state laws, with extensions where permitted. You may use an authorized agent where the law allows; we may require proof of authority.

13. Additional Disclosures for US Residents

Residents of California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have the rights described in Section 12, and additionally the right to opt out of the sale or sharing of personal information and of targeted advertising, and the right to appeal a denied request. To opt out, reach us through our Contact page. To appeal a decision, reply to our response or send us a message through our Contact page beginning with "Appeal."

The categories of personal information we collect, the sources, the purposes, and the categories of recipients are described in Sections 3, 4, and 7. We retain each category as described in Section 11. We do not knowingly collect or process sensitive personal information for the purpose of inferring characteristics.

14. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, logging, vendor due diligence, and periodic review of our security posture. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by law.

15. Children

The Services are intended for business use and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

16. Third-Party Sites

The Site may link to third-party websites and services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy notices.

17. Changes to This Policy

We may update this Policy from time to time. We will post the revised version with a new "Last Updated" date and, where changes are material, provide additional notice by email or through the Services before the change takes effect.