Satofy OÜ ("we", "us", "our") is a private limited company registered in the Republic of Estonia, registry code 17533947, registered address Toompihla 4, 75401 Kiili, Harjumaa, Estonia. Contact: info@satofy.com. Satofy OÜ operates the Satofy AI chat service. As a service offered to businesses within the European Economic Area (EEA), we act as a data processor on behalf of our merchant clients (controllers) and as a data controller with respect to our own operational data.
We process personal data in accordance with:
3a. Merchant (business customer) data: name, email address, company name, store URL, billing information (processed via third-party payment provider). Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
3b. End-user (store visitor) data: chat messages, approximate session language, and satisfaction ratings (thumbs up/down). This data is processed on behalf of the merchant. No persistent user profiles are created and no cross-site tracking takes place. The widget stores two items on the visitor's own device, both strictly functional and neither a cookie: a random session identifier in sessionStorage (to keep one conversation continuous, cleared when the tab closes) and a language preference in localStorage (to remember the chosen chat language). Neither is linked to any real-world identity. If a visitor voluntarily submits their email address and a message through the widget's contact form, that email, message and conversation transcript are stored as a "lead" and made available to the merchant so they can respond. Legal basis: Art. 6(1)(f) GDPR — the legitimate interests of the merchant in providing and improving customer support; for the contact form, Art. 6(1)(a)/(b) — the visitor's own request to be contacted.
3c. Operational data: to protect the Service against abuse we process IP addresses for rate-limiting. In our own database these are stored only transiently — a counter that resets within minutes — and are not used to build any profile. Request logs generated by our hosting and edge provider (IP address, request time, user-agent) are held by that provider under its standard log retention. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the security and integrity of the Service.
3d. Cookies & Analytics: We use the following types of cookies and tracking technologies on our website:
sessionStorage/localStorage to maintain chat session continuity and to remember your cookie choice. No persistent first-party cookies are set. No consent required per ePrivacy Directive recital 66._ga and _ga_*. Microsoft Clarity uses cookies including _clck and _clsk. You may decline via the banner, or withdraw consent at any time by clearing this site's stored data in your browser. Legal basis: Art. 6(1)(a) GDPR — consent.Analytics data is anonymised and aggregated. We do not use it to identify individual visitors.
We use the following sub-processors, each bound by GDPR-compliant data processing agreements (DPAs):
No personal data is sold to third parties. No data is transferred to third countries without appropriate safeguards (Standard Contractual Clauses, Art. 46 GDPR).
End-user conversation data is processed on the merchant's behalf, and the merchant (as controller) decides how long it is kept. In practice:
You have the right to: access your data; rectify inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing; and not to be subject to solely automated decision-making with legal effects. To exercise any right, contact info@satofy.com. We will respond within 30 days. You may also lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or your local supervisory authority.
Satofy is a business-to-business software tool, not an online platform that hosts or disseminates public content, so most DSA obligations do not apply to it. To the extent the DSA (Regulation (EU) 2022/2065) does apply, Satofy is a micro-enterprise and relies on the exemptions available to micro and small enterprises. We are not a Very Large Online Platform, we operate no recommender systems, and we display no advertising. Point of contact for any DSA-related communication: info@satofy.com.
Chat responses displayed through Satofy-powered widgets are generated by an artificial-intelligence language model (Google Gemini) — they are not written by a human. Under Article 50 of the EU AI Act (Regulation (EU) 2024/1689), applicable from 2 August 2026, a person interacting with an AI chat system must be informed that they are interacting with an AI unless that is already obvious from the circumstances. The assistant is therefore provided as an AI-powered chat assistant and must be presented to visitors as such. The merchant, as the party that deploys the assistant on its own website, must not configure it to impersonate a specific, named human being or otherwise disguise its artificial nature.
Neither Satofy nor its merchant clients warrants the accuracy, completeness or reliability of AI-generated content. End users should independently verify any information that may affect a purchase or other decision.
Authorised Satofy personnel can access a merchant's own dashboard in order to provide support — for example to complete initial setup, configure product synchronisation, or diagnose a fault. We consider it important that you know this rather than discover it, so it is stated here explicitly.
What this access is:
What we record. Every support access is written to an internal audit log containing the identity of the staff member, your store, the action performed, and the time. Each individual change (creation, modification or deletion of data) is recorded separately; periods of read-only access are recorded at least once every 15 minutes. Audit records are retained for 24 months. You may request the access log for your own store at any time by writing to info@satofy.com, and we will provide it within 30 days.
Limits of the record. In the interest of accuracy: the log records that data was accessed and what was changed, but it does not capture the previous and new value of every field, nor the specific records viewed during a read-only session. It is an accountability record, not a complete reconstruction of a session.
Legal basis. Art. 6(1)(b) GDPR (performance of our contract with you — the provision of support), and Art. 28 GDPR in respect of end-customer personal data, for which the merchant is the controller and Satofy the processor acting on documented instructions. Support personnel are bound by confidentiality obligations. If you would prefer that we do not access your account for support purposes, tell us at info@satofy.com — we will honour it, while noting that some support requests cannot be resolved without it.
We implement appropriate technical and organisational measures (Art. 32 GDPR), including TLS encryption in transit, database-level encryption at rest, access controls, and periodic security reviews. In the event of a data breach, we will notify affected parties and the relevant supervisory authority within 72 hours in accordance with Art. 33–34 GDPR.
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered merchants at least 30 days before taking effect. Continued use of the service after notification constitutes acceptance of the updated policy.
These Terms of Service ("Terms") constitute a legally binding agreement between you ("Merchant", "you") and Satofy OÜ, a private limited company registered in the Republic of Estonia, registry code 17533947, registered address Toompihla 4, 75401 Kiili, Harjumaa, Estonia ("Service Provider", "we"), governing your access to and use of the Satofy AI chat widget platform ("Service"). By registering, accessing, or using the Service, you agree to these Terms in full. If you do not agree, you must not use the Service.
Satofy provides a software-as-a-service (SaaS) AI-powered chat widget that Merchants may embed on their e-commerce websites. The Service includes product synchronisation, AI-generated chat responses, lead capture, and analytics features as described on the Satofy website and subject to the selected subscription plan.
3.1 Access to the Service requires a paid subscription (or free trial where offered). Prices are listed in EUR. Satofy OÜ is not currently registered for VAT, so no VAT is added and the listed price is the final price payable; no VAT is shown on the invoice or available for deduction. Should Satofy OÜ become VAT-registered, VAT will be added to the listed prices from that date, with prior notice. 3.2 Subscriptions are billed monthly or annually in advance. All subscription fees are non-refundable. Monthly subscriptions are non-refundable once the billing period has commenced. Annual subscriptions are non-refundable for any remaining months following cancellation. No refunds are issued for partial use of the service within a billing period. This does not affect any rights you may have under mandatory consumer protection law in your country of residence. 3.3 You may cancel your subscription at any time from your dashboard. Cancellation takes effect at the end of the current billing period. Access continues until the period ends. 3.4 We reserve the right to adjust pricing with 30 days' written notice. Continued use after the notice period constitutes acceptance.
4.1 You agree not to use the Service to: (a) violate any applicable law or regulation; (b) infringe any third-party intellectual property rights; (c) transmit spam, malware, or harmful content; (d) engage in deceptive, fraudulent, or misleading practices toward end users; (e) attempt to reverse-engineer, scrape, or disrupt the Service; (f) resell or sub-license the Service without prior written consent.
4.2 Fair Use Policy: Subscriptions labelled "Unlimited" or "Enterprise" are subject to a Fair Use Policy. Satofy reserves the right to temporarily suspend or renegotiate the terms of any account if usage significantly exceeds reasonable commercial norms or imposes an undue technical burden on our infrastructure.
5.1 You are solely responsible for the accuracy and legality of the product data, knowledge base content, and any other information you sync or upload to the Service.
5.2 You are solely responsible for obtaining any necessary consents from your end users for the deployment of the Satofy widget on your website, including compliance with the ePrivacy Directive, GDPR, and any other applicable law in your jurisdiction. Satofy is not responsible for your compliance obligations as a data controller.
5.3 You must maintain the confidentiality of your account credentials and immediately notify us of any unauthorised access.
5.4 You are responsible for reviewing AI-generated responses served by the widget and ensuring they accurately represent your business. Satofy is not liable for any loss arising from inaccurate AI outputs displayed to your customers.
5.5 AI transparency. The widget is an AI system. As the deployer on your website, you must keep it evident to your visitors that they are interacting with an AI assistant (EU AI Act Art. 50), and you must not rename or configure the assistant so as to impersonate a specific, named human being. You are responsible for any additional AI-transparency, consumer-information or sector-specific obligations that apply to your own business.
5.6 Indemnification. You agree to indemnify, defend and hold harmless Satofy OÜ, its owners and personnel from and against any third-party claim, demand, proceeding, loss, liability or expense (including reasonable legal costs) arising out of or relating to: (a) the products, content, product data or knowledge-base material you sync or upload; (b) your breach of these Terms, the Privacy Policy or the DPA, or of any applicable law; (c) your failure to obtain any end-user consent required for the widget, or to meet your AI-transparency, cookie or consumer-information obligations; or (d) any claim brought by your own end customers in connection with your use of the Service. This obligation survives termination.
Nothing in these Terms shall limit or exclude liability for death or personal injury caused by negligence, fraud, or any other liability that cannot be limited or excluded under applicable mandatory law (including Estonian Law of Obligations Act — võlaõigusseadus).
7.1 Satofy and its licensors retain all intellectual property rights in the Service, including software, designs, trademarks, and documentation. These Terms do not grant you any ownership rights. 7.2 You grant Satofy a limited, non-exclusive licence to process, store, and transmit your content solely for the purpose of providing the Service. 7.3 Aggregated, anonymised usage statistics may be used by Satofy for service improvement without restriction.
To the extent that Satofy processes personal data of your end users on your behalf, Satofy acts as a data processor and you act as the data controller under GDPR. By accepting these Terms, you agree to the Satofy DPA. A full copy of the DPA is available upon request at info@satofy.com. You warrant that you have a lawful basis for instructing Satofy to process such data.
8.1 Support access. You acknowledge that authorised Satofy personnel can access your dashboard to provide support, including data relating to your end customers, and that every such access is recorded in an audit log you may request at any time. The nature, limits and retention of this access are set out in Privacy Policy §9.
9.1 We may suspend or terminate your access to the Service immediately, without liability, if: (a) you breach any provision of these Terms; (b) payment fails and is not remedied within 7 days of notice; (c) we are required to do so by law or order of a competent authority. 9.2 Upon termination, your right to use the Service ceases immediately. We will retain your data for 30 days following termination, after which it will be permanently deleted, unless required to be retained by law.
Satofy targets a monthly uptime of 99.5% but does not guarantee any specific service level unless a separate SLA is agreed in writing (available on Enterprise plans). Scheduled maintenance will be communicated with at least 24 hours' notice where practicable.
These Terms are governed by and construed in accordance with the laws of the Republic of Estonia, without regard to conflict of law principles. Any disputes shall be submitted to the exclusive jurisdiction of the Harju County Court (Harju Maakohus), Tallinn, Estonia, subject to your right to bring consumer protection claims in your country of residence if you are a consumer within the EU. For business-to-business disputes, the parties agree to attempt resolution through good-faith negotiation for a period of 30 days before commencing legal proceedings.
If you are a consumer within the European Union, you may have additional rights under EU consumer protection legislation, including Directive 2011/83/EU. The 14-day withdrawal right does not apply once digital content delivery has commenced with your consent and acknowledgment that the right is thereby waived, per Art. 16(m).
We may modify these Terms at any time. We will provide at least 30 days' notice of material changes via email or in-app notification. Continued use of the Service after the effective date constitutes acceptance. If you do not agree to the revised Terms, you may terminate your subscription before the effective date.
14.1 Severability: If any provision is found unenforceable, the remaining provisions remain in full force. 14.2 Waiver: Failure to enforce any provision does not constitute a waiver. 14.3 Entire Agreement: These Terms, together with the Privacy Policy and any applicable DPA, constitute the entire agreement between the parties. 14.4 Language: The authoritative version of these Terms is in English.