Privacy Policy Terms of Service

Privacy Policy

Last updated: April 2026  |  Applies to: satofy.vercel.app and all related services

1. Controller Identity

Satofy ("we", "us", "our") is an AI-powered e-commerce chat service operated by an individual entrepreneur registered in the Republic of Estonia. Contact: saatohq@gmail.com. As a service offered to businesses within the European Economic Area (EEA), we act as a data processor on behalf of our merchant clients (controllers) and as a data controller with respect to our own operational data.

2. Legal Basis & Applicable Law

We process personal data in accordance with:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
• Directive 2002/58/EC — ePrivacy Directive (Cookie Law)
• Regulation (EU) 2022/2065 — Digital Services Act (DSA)
• Estonian Personal Data Protection Act (isikuandmete kaitse seadus)
• Estonian Information Society Services Act (infoühiskonna teenuse seadus)

3. Data We Collect

3a. Merchant (business customer) data: name, email address, company name, store URL, billing information (processed via third-party payment provider). Legal basis: Art. 6(1)(b) GDPR — performance of a contract.

3b. End-user (store visitor) data: chat messages, approximate session language, inferred intent. This data is processed on behalf of the merchant. No persistent user profiles are created. Legal basis: Art. 6(1)(f) GDPR — legitimate interests of the merchant in providing customer support.

3c. Operational data: server logs (IP address, request time, user-agent), necessary for security and service integrity. Retained for 30 days. Legal basis: Art. 6(1)(f) GDPR.

3d. Cookies: We use strictly necessary session cookies only. No tracking, advertising, or analytics cookies are set without explicit consent. No cookie consent is required for strictly necessary cookies per ePrivacy Directive recital 66.

4. Data Processors & Sub-Processors

We use the following sub-processors, each bound by GDPR-compliant data processing agreements (DPAs):

• Supabase Inc. — database and authentication (EU region servers available; SCCs in place)
• Google LLC / DeepMind — Gemini AI API for generating chat responses (data processed per Google Cloud DPA)
• Vercel Inc. — hosting and edge delivery (EU-region; SCCs in place)

No personal data is sold to third parties. No data is transferred to third countries without appropriate safeguards (Standard Contractual Clauses, Art. 46 GDPR).

5. Retention Periods

• Merchant account data: retained for the duration of the contract + 3 years for tax/legal compliance
• Chat conversation logs: retained up to 90 days unless the merchant configures a shorter period
• Server/access logs: 30 days
• Billing records: 7 years (Estonian Accounting Act — raamatupidamise seadus)

6. Your Rights (GDPR Art. 15–22)

You have the right to: access your data; rectify inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing; and not to be subject to solely automated decision-making with legal effects. To exercise any right, contact saatohq@gmail.com. We will respond within 30 days. You may also lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local supervisory authority.

7. Digital Services Act (DSA) Compliance

Satofy is classified as a micro-enterprise under the DSA (Regulation (EU) 2022/2065) and qualifies for exemptions applicable to platforms with fewer than 45 million monthly active users in the EU. We do not operate recommender systems or display advertising. We maintain a single point of contact for DSA-related communications: saatohq@gmail.com.

8. AI-Generated Content Disclosure

Chat responses displayed through Satofy-powered widgets are generated by an artificial intelligence language model. Satofy and its merchant clients are not responsible for any inaccuracies, omissions, or errors in AI-generated content. End users should independently verify any information that may affect purchasing or other decisions.

9. Security

We implement appropriate technical and organisational measures (Art. 32 GDPR), including TLS encryption in transit, database-level encryption at rest, access controls, and periodic security reviews. In the event of a data breach, we will notify affected parties and the relevant supervisory authority within 72 hours in accordance with Art. 33–34 GDPR.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered merchants. Continued use of the service after notification constitutes acceptance of the updated policy.

Terms of Service

Last updated: April 2026  |  Effective upon registration or first use

1. Parties & Acceptance

These Terms of Service ("Terms") constitute a legally binding agreement between you ("Merchant", "you") and Satofy ("Service Provider", "we"), governing your access to and use of the Satofy AI chat widget platform ("Service"). By registering, accessing, or using the Service, you agree to these Terms in full. If you do not agree, you must not use the Service.

2. Service Description

Satofy provides a software-as-a-service (SaaS) AI-powered chat widget that Merchants may embed on their e-commerce websites. The Service includes product synchronisation, AI-generated chat responses, lead capture, and analytics features as described on the Satofy website and subject to the selected subscription plan.

3. Subscription, Payment & Cancellation

3.1 Access to the Service requires a paid subscription. Prices are listed in EUR excluding VAT (where applicable under Estonian/EU VAT rules). 3.2 Subscriptions are billed monthly or annually in advance. Annual subscriptions are non-refundable except as required by mandatory consumer protection law. 3.3 You may cancel your subscription at any time from your dashboard. Cancellation takes effect at the end of the current billing period. 3.4 We reserve the right to adjust pricing with 30 days' written notice. Continued use after the notice period constitutes acceptance.

4. Acceptable Use

4.1 You agree not to use the Service to: (a) violate any applicable law or regulation; (b) infringe any third-party intellectual property rights; (c) transmit spam, malware, or harmful content; (d) engage in deceptive, fraudulent, or misleading practices toward end users; (e) attempt to reverse-engineer, scrape, or disrupt the Service; (f) resell or sub-license the Service without prior written consent.

4.2 Fair Use Policy: Subscriptions labelled as "Unlimited" or "Enterprise" are subject to a Fair Use Policy. Unlimited data storage and AI generation are permitted exclusively for normal, high-volume e-commerce operations. Satofy reserves the right to temporarily suspend, limit, or renegotiate the terms of any account if its usage significantly exceeds reasonable commercial norms, imposes an undue technical burden on our infrastructure, or is determined by us to be abusive (e.g., automated DDoS generation, bot-net integrations, or reselling APIs).

5. Merchant Responsibilities

5.1 You are solely responsible for the accuracy and legality of the product data, knowledge base content, and any other information you sync or upload to the Service. 5.2 You are responsible for obtaining any necessary consents from your end users for the deployment of the Satofy widget on your website, including compliance with ePrivacy Directive requirements in your jurisdiction. 5.3 You must maintain the confidentiality of your account credentials and immediately notify us of any unauthorised access.

6. Limitation of Liability

IMPORTANT — PLEASE READ CAREFULLY. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW:

• THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
• SATOFY SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITIES, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SERVICE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
• SATOFY'S TOTAL CUMULATIVE LIABILITY TO YOU FOR ANY CLAIMS ARISING UNDER OR RELATED TO THESE TERMS SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES PAID BY YOU TO SATOFY IN THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE CLAIM; OR (B) ONE HUNDRED EUROS (€100).
• SATOFY IS NOT RESPONSIBLE FOR THE ACCURACY, COMPLETENESS, OR RELIABILITY OF AI-GENERATED CHAT RESPONSES. END USERS INTERACT WITH AI-GENERATED CONTENT AT THEIR OWN RISK. THE MERCHANT BEARS FULL RESPONSIBILITY FOR ENSURING THE ACCURACY OF INFORMATION PRESENTED TO THEIR CUSTOMERS.
• SATOFY IS NOT LIABLE FOR ANY THIRD-PARTY SERVICES, INCLUDING PAYMENT PROCESSORS, AI API PROVIDERS, OR HOSTING PROVIDERS, AND THEIR RESPECTIVE DOWNTIME, DATA BREACHES, OR FAILURES.

Nothing in these Terms shall limit or exclude liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be limited or excluded under applicable mandatory law (including Estonian Law of Obligations Act — võlaõigusseadus).

7. Intellectual Property

7.1 Satofy and its licensors retain all intellectual property rights in the Service, including software, designs, trademarks, and documentation. These Terms do not grant you any ownership rights. 7.2 You grant Satofy a limited, non-exclusive licence to process, store, and transmit your content solely for the purpose of providing the Service. 7.3 Aggregated, anonymised usage statistics may be used by Satofy for service improvement without restriction.

8. Data Processing Agreement (DPA)

To the extent that Satofy processes personal data of your end users on your behalf, Satofy acts as a data processor and you act as the data controller under GDPR. These Terms incorporate a Data Processing Agreement. By accepting these Terms, you agree to the Satofy DPA, which is available upon request at saatohq@gmail.com. You warrant that you have a lawful basis for instructing Satofy to process such data.

9. Suspension & Termination

9.1 We may suspend or terminate your access to the Service immediately, without liability, if: (a) you breach any provision of these Terms; (b) payment fails and is not remedied within 7 days of notice; (c) we are required to do so by law or order of a competent authority. 9.2 Upon termination, your right to use the Service ceases immediately. We will retain your data for 30 days following termination, after which it will be permanently deleted, unless required to be retained by law.

10. Uptime & Service Levels

Satofy targets a monthly uptime of 99.5% but does not guarantee any specific service level unless a separate SLA is agreed in writing (available on Enterprise plans). Scheduled maintenance will be communicated with at least 24 hours' notice where practicable.

11. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of the Republic of Estonia, without regard to conflict of law principles. Any disputes shall be submitted to the exclusive jurisdiction of the Harju County Court (Harju Maakohus), Tallinn, Estonia, subject to your right to bring consumer protection claims in your country of residence if you are a consumer within the EU. For business-to-business disputes, the parties agree to attempt resolution through good-faith negotiation for a period of 30 days before commencing legal proceedings.

12. Consumer Rights (EU)

If you are a consumer within the European Union, you may have additional rights under EU consumer protection legislation, including Directive 2011/83/EU (Consumer Rights Directive) and applicable national law. The 14-day withdrawal right under Art. 9 of Directive 2011/83/EU does not apply once digital content delivery has commenced with your consent and acknowledgment that the right is thereby waived, per Art. 16(m).

13. Changes to Terms

We may modify these Terms at any time. We will provide at least 30 days' notice of material changes via email or in-app notification. Continued use of the Service after the effective date of the revised Terms constitutes acceptance. If you do not agree to the revised Terms, you may terminate your subscription before the effective date.

14. Miscellaneous

14.1 Severability: If any provision is found unenforceable, the remaining provisions remain in full force. 14.2 Waiver: Failure to enforce any provision does not constitute a waiver of future enforcement. 14.3 Entire Agreement: These Terms, together with the Privacy Policy and any applicable Order Form or DPA, constitute the entire agreement between the parties and supersede all prior negotiations. 14.4 Language: The authoritative version of these Terms is in English. Translations are provided for convenience only.

Contact: saatohq@gmail.com  |  Satofy, Estonia, EU  |  © 2026 Satofy. All rights reserved.