Legal

Privacy policy

What data is collected, on what basis, where it is processed, and the rights you hold.

Entity: SAITS GmbH
Seat: Baarerstrasse 79 · 6300 Zug
Contact: business@saits.ai

What we do with data

01
What is collected
Contact details you send us, the content of your enquiry, and standard technical data from the website. Only with your consent, additionally data for audience and advertising measurement (see “Analytics and advertising” below). Our web server logs every request with a shortened IP address (IPv4 without its last block, IPv6 only its first 48 bits), time, page without parameters, referrer and browser identifier; the logs are deleted after 14 days. The purpose is operational security and an aggregate analysis of usage, the legal basis our legitimate interest (Art. 6(1)(f) GDPR).
02
On what basis, and where
Processing rests on your enquiry or a contract, and runs in European regions under GDPR and the Swiss DSG. The exception is the analytics and advertising services below: they run only with your consent, and their providers may transfer data to the USA.
03
Retention and sub-processors
Data is kept only as long as the enquiry or the contract requires, and every sub-processor is named in the contract before any data reaches it.
04
Your rights
Access, correction, deletion, restriction, data portability and objection under GDPR and Swiss data protection. You can withdraw consent at any time with effect for the future, via “Cookie settings” in the footer. You also have the right to lodge a complaint with a data protection supervisory authority, in Switzerland the FDPIC. Write to business@saits.ai.

Processing

The four functions of this website

This website has four places where you actively send us data. For each one, this page sets out what we use the data for, which data that is, and who receives it.

Tony — the chat on this website

Purpose: Answering your questions about automation and assessing whether a process you describe can be automated.
Data: The text you type into the chat, the chosen language and a randomly generated session id. The session id sits in your browser's sessionStorage and ends with the session. We do not ask for contact details in the chat; whatever you volunteer is processed along with it.
Recipients: SAITS Cockpit as the operating platform (hosted in Europe) and Anthropic as the provider of the language model that produces the answer. If you start a potential analysis from the chat, the transcript is additionally filed as a note in the Twenty CRM.
Retention: The transcript is processed for the duration of the session and stored permanently only if you use it to raise an enquiry or a potential analysis.

Contact form

Purpose: Handling and answering your enquiry.
Data: Name, company, e-mail address, your message and your consent. The form contains a hidden field for spam protection that humans do not fill in.
Recipients: The enquiry is sent as an e-mail to business@saits.ai, created as a lead in the Twenty CRM and triggers an internal notification in our Mattermost channel. We operate all three systems in Europe or Switzerland.
Retention: As long as handling your enquiry and any follow-up correspondence require.

Ordering an offer

Purpose: Concluding and performing the contract, invoicing and scheduling the appointments.
Data: Company name, street, postcode, town, country, optionally the VAT number, the contact's name, e-mail address, optionally a phone number, the chosen offer and your acceptance of the terms.
Recipients: SAITS Cockpit as the operating platform, bexio for issuing and sending the invoice, and an e-mail service for the access and invoice mails. Once payment arrives, appointment booking is unlocked in your cockpit room.
Retention: Contract and invoice data is kept for the statutory retention periods.

Booking a call with Cal.com

Purpose: Arranging a call when you choose “Book a call”.
Data: Name, e-mail address, the chosen time and whatever you choose to add in the booking form. On the “Book a call” page (/en/appointment) and after you confirm an enquiry, the Cal.com calendar is part of the page and loads with it. Elsewhere, on large screens the website loads the booking window only when you reach for a booking button (pointer over it, keyboard focus) or click it; on a phone it preloads it as soon as a booking button is visible, so it is ready the moment you tap. Loading it gives Cal.com your IP address and technical details of your browser, and sets technically necessary cookies (among them “__cf_bm” of its provider Cloudflare against bots, 30 minutes; in the calendar also session cookies for the booking form); nothing is booked by that.
Recipients: Cal.com, Inc. as the scheduling service that processes the booking and sends the confirmation, and SAITS to prepare the call.
Retention: As long as preparing, holding and following up the call requires.

This page describes what the website does technically. It does not replace legal review of an individual case.

Analytics and advertising

Services that run only with your consent

On your first visit a dialog asks whether you agree to analytics and to the measurement of our advertising. Until then the website loads none of these services. The dialog names the services currently in place; a service not listed there does not run. We store your choice in your browser (localStorage, entry “saits-consent-v1”) until you change it.

OpenAI Ads pixel

Provider: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, and OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, USA.
Purpose: Measuring whether visits and enquiries result from our ads on OpenAI (conversion measurement), and improving the delivery of those ads.
Data: A click ID if you arrive via an ad, a random browser ID, pages visited and events on the website (for example that a landing page was viewed, the booking calendar was opened or a step taken in it, an appointment was booked, or a potential analysis was started or sent, with a random ID of the booking or the analysis, without the name, time, answers or content of the appointment), time, referrer, browser and device information, and your IP address. So that OpenAI can attribute an enquiry or booking to the ad, we also transmit your e-mail address (from the potential analysis, the contact form, the confirmation or the appointment booking) and an internal customer ID (the ID of your potential analysis), both only hashed (SHA-256, pseudonymised): the hash is computed in your browser, the address itself does not leave it towards OpenAI, and it is kept only for the duration of the page view. If automatic matching (“Advanced Matching”) is switched on at OpenAI, additionally hashed (pseudonymised) contact details such as the e-mail address, phone number or name you enter into a form. Stored are the cookies “__obref”, “__oppref” and “__oaiq_consent” and the localStorage entries “oaiq_consent” and “saits-oai-sent” (which bookings have already been reported, so none counts twice; deleted when you withdraw consent).
Legal basis: Your consent in the consent dialog: Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) TDDDG; under the Swiss DSG, likewise your consent. Without consent the service is not loaded.
Storage period: Browser ID (“__obref”) one year, click ID (“__oppref”) and consent status 30 days. On withdrawal the service deletes the click and browser IDs and sends nothing further. How long OpenAI keeps the data it receives is determined by OpenAI.
Transfer to the USA: The data goes to OpenAI servers in the USA. To our knowledge, OpenAI is not certified under the EU-U.S. or Swiss-U.S. Data Privacy Framework. The transfer therefore rests on your explicit consent (Art. 49(1)(a) GDPR, Art. 17(1)(a) DSG). The USA does not offer a level of data protection equivalent to Europe’s; US authorities may be able to access the data without you having effective legal remedies.
Provider privacy and opt-out: OpenAI privacy policy

PostHog (run by us)

Provider: SAITS itself. PostHog is open-source software that we run on our own server in Frankfurt am Main (Germany); the browser reaches it at our address ph.saits.ai. The server is provided by Hostinger International Ltd., 61 Lordou Vyronos, Lumiel Building, 4th floor, 6023 Larnaca, Cyprus, as a processor. PostHog Inc. receives no data.
Purpose: Understanding how the website is used: which pages are viewed and which buttons are used, and where visitors abandon a booking or the potential analysis, so we can improve content and flows. Session recordings show the course of a visit (page layout, clicks, scrolling) so we can spot usability problems.
Data: Pages viewed and time spent, clicks on buttons (label and target), events on the website (booking calendar opened, a step in it, appointment booked with a random booking ID, potential analysis started and sent with a random run ID, landing page viewed, a product film started with the film's name and whether it runs audible), referrer, browser, device and screen details, the IP address (for the transfer only; it is not stored) and a random ID. In session recordings every input in form fields is masked. Your browser stores a cookie and a localStorage entry “ph_…_posthog” with the random ID. If your browser sends “Do Not Track”, we record nothing.
Legal basis: Your consent in the consent dialog: Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) TDDDG; under the Swiss DSG, likewise your consent. Without consent the service is not loaded.
Storage period: The ID in your browser one year; withdrawing deletes it at once, after which nothing is sent. We keep events for at most 14 months and session recordings for 30 days.
Transfer to the USA: None. The data stays on our server in Germany.
Provider privacy and opt-out: PostHog: open-source software

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Purpose: Understanding which pages get read and how visitors use the website, in order to improve content and structure.
Data: Pages visited, time on page and interactions, referrer, browser and device information, approximate location derived from the IP address, and a random ID in the cookies “_ga” and “_ga_<ID>”. According to Google, Google Analytics 4 does not store IP addresses. We use Google Consent Mode v2: without your consent all Google signals are set to “denied”, Google Analytics then sets no cookies and no ID, but the Google script may send signals without an ID (for example that a page was viewed).
Legal basis: Your consent in the consent dialog: Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) TDDDG; under the Swiss DSG, likewise your consent. Without consent the service is not loaded.
Storage period: Cookies up to two years. Google deletes event data after the period set in our account, at most 14 months.
Transfer to the USA: Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; Google additionally bases transfers on the European Commission’s standard contractual clauses.
Provider privacy and opt-out: Google privacy policy · Browser add-on to opt out of Google Analytics · Google Data Privacy Framework

Google Ads conversion tracking

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Purpose: Measuring whether visits and enquiries result from our ads on Google, and targeting those ads better. Put in place once we run campaigns on Google Ads.
Data: A click ID (gclid) if you arrive via a Google ad, conversion events such as a sent enquiry, pages visited, time, browser and device information and your IP address; the cookies “_gcl_au” and “_gcl_aw”. If you are signed in to Google, Google may link the measurement to your Google account.
Legal basis: Your consent in the consent dialog: Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) TDDDG; under the Swiss DSG, likewise your consent. Without consent the service is not loaded.
Storage period: Cookies 90 days. How long Google keeps the data it receives is determined by Google.
Transfer to the USA: Google LLC is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; Google additionally bases transfers on the European Commission’s standard contractual clauses.
Provider privacy and opt-out: Google privacy policy · Manage personalised ads at Google

Meta Pixel

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, and Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA. For the collection on this website and the transmission to Meta we are joint controllers with Meta Platforms Ireland (Art. 26 GDPR, Meta’s Controller Addendum); Meta alone is responsible for any further processing.
Purpose: Measuring whether visits and enquiries result from our ads on Facebook and Instagram, and targeting those ads better. Put in place once we run campaigns on Meta.
Data: Pages visited and events such as a sent enquiry, time, referrer, browser and device information, your IP address, and IDs in the cookies “_fbp” and “_fbc”. If you are signed in to Facebook or Instagram, Meta may link the measurement to your account.
Legal basis: Your consent in the consent dialog: Art. 6(1)(a) GDPR and, for storing and reading information on your device, § 25(1) TDDDG; under the Swiss DSG, likewise your consent. Without consent the service is not loaded.
Storage period: Cookies 90 days. How long Meta keeps the data it receives is determined by Meta.
Transfer to the USA: Meta Platforms, Inc. is certified under the EU-U.S. and the Swiss-U.S. Data Privacy Framework; Meta additionally bases transfers on the European Commission’s standard contractual clauses.
Provider privacy and opt-out: Meta privacy policy · Controller Addendum · Ad preferences at Meta

You can withdraw or give your consent again at any time, via “Cookie settings” in the footer of every page or with the button here. Withdrawal applies to the future; processing lawfully carried out until then is not affected.

Questions about privacy?

Write to business@saits.ai and we will answer in writing.

Write an e-mail Book a call

SAITS GmbH · Baarerstrasse 79 · 6300 Zug · Schweiz
business@saits.ai · +49 7071 7541558 · WhatsApp: +41 78 616 11 14

What is collected

On what basis, and where

Retention and sub-processors

Your rights