Privacy and cookie policy

This policy explains which personal data SatoriML AB handles when you visit www.satoriml.com or arrange a call with us, what will apply once newsletter and course sign-up open, and which cookies the site sets. The short version is that we collect little, keep it in the EU where we can, and never sell it to anyone.

Who is responsible for your data

The controller, meaning the company that decides why and how your personal data is handled, is the Swedish company behind both satoriml.se and satoriml.com:

• SatoriML AB (trading as satori.)
• Company registration number 559458-9029
• VAT number SE559458902901
• Högosta 43, 782 92 Dala-Järna, Sweden
• Email: connect@satoriml.se
• Phone: +46 79 102 49 68

SatoriML AB is established in Sweden, so the EU General Data Protection Regulation (GDPR) applies to everything described here, wherever in the world you happen to be reading from.

What we collect and why

Each activity on the site collects a different, small set of data, and each one rests on its own legal basis under Article 6 of the GDPR, which is why the list below is split by activity.

Arranging a call

Calls are arranged by email to connect@satoriml.se or by phone on +46 79 102 49 68. We keep your name, email address, the times you suggest and any note you send in our Microsoft 365 mailbox and calendar, and we use them to hold the call and follow up afterwards. The legal basis is steps taken at your request before a contract, Article 6(1)(b).

Emailing or phoning us

When you write to connect@satoriml.se or call us, we keep your name, contact details, company and the content of the conversation for as long as the conversation is live. The legal basis is our legitimate interest in answering business enquiries, Article 6(1)(f), or the contract itself once you become a client.

Newsletter (sign-up not open yet)

Online newsletter sign-up is not open on this site yet, so the site stores no newsletter data today. Once it opens, signing up for posts from our blog will store the following details in our database:

• Your email address and language choice
• The page you signed up from and the consent text you saw
• The time you signed up, confirmed and, if you do, unsubscribed

Nothing will be sent until you click the confirmation link in the first email, which is called double opt-in, and every email will carry an unsubscribe link that stops all future sends with one click. The legal basis will be your consent, Article 6(1)(a), which you can withdraw at any time through that link or by writing to connect@satoriml.se. Email addresses will be stored with Supabase in its EU (Stockholm) region, while the emails themselves will be delivered by Resend, which handles your address and the email content at each send.

Course registration (online sign-up not open yet)

Course seats are reserved on a short call or by email today, so the details you send are handled as described under Arranging a call, and invoices are kept for the period Swedish accounting law requires. Once online registration for the open Claude course opens, it will collect your name, email address, company, chosen track and session date, together with the consent text you saw. Confirming your seat will then add the billing details you type in:

• Invoice recipient and postal address
• Company or VAT number, if you choose to give one
• Billing email address and your purchase order reference

SatoriML AB will use these details to hold your seat, send practical information about the session and invoice the course fee. The legal basis will be the contract you enter by booking, Article 6(1)(b), and invoices are then kept for the period Swedish accounting law requires, Article 6(1)(c).

Visiting the site

Every page request passes through our hosting provider, and a visit produces data in two separate ways:

• Server logs at Vercel, our hosting provider, which briefly handles your IP address and browser type to deliver and secure the pages.
• First-party visit statistics, only if you accept analytics in the cookie banner: the page you opened, the referring page, your browser and device type, and a random identifier, stored in our own Supabase database.

Server logs rest on our legitimate interest in running a secure site, Article 6(1)(f), while the first-party visit statistics rest on your consent, Article 6(1)(a). The typeface is served with the rest of the site from Vercel, so opening a page sends no request to Google or to any other font service.

How we use AI tools with your data

SatoriML AB uses Claude for Work, a service from Anthropic Ireland, Limited, for client administration, business analysis and drafting emails. Anthropic acts as our processor, meaning it handles data only on our instructions and under a data processing addendum that incorporates the EU standard contractual clauses.

The categories that may pass through Claude are professional contact details:

• Name, job title and company
• Work email address and work phone number
• Company registration number and business notes from our conversations

Special category data, such as health information or political opinions, never goes into our AI tools. The legal basis is our legitimate interest in running client administration efficiently, Article 6(1)(f), after a balancing test that weighed the business-to-business context and the fact that only professional details are involved.

Anthropic states that data from commercial products such as Claude Enterprise and the API is stored in the United States, so these transfers are covered by the standard contractual clauses, with encryption in transit and at rest. By default Anthropic does not use inputs or outputs from its commercial products to train its models, and a conversation we delete is removed from its back-end storage within 30 days. You may object to this processing at any time, and we stop unless we can show compelling legitimate grounds.

Who else handles your data

SatoriML AB never sells personal data, and the only companies that handle it on our behalf are these processors:

• Vercel Inc.: hosting and server logs
• Supabase: the database for consent records and first-party visit statistics, EU (Stockholm) region, plus newsletter and course records once online sign-up opens
• Resend: delivery of newsletter and course emails, once online sign-up opens
• Microsoft: Microsoft 365 email and calendar
• Anthropic Ireland, Limited: Claude for Work, as described above

Some of these companies are based in the United States. Whenever personal data leaves the EU or EEA, the transfer rests on a European Commission adequacy decision or on the standard contractual clauses in the provider's data processing terms, and you can ask us for a copy of the relevant safeguard.

How long we keep it

• Newsletter, once sign-up opens: until you unsubscribe, after which the address and the unsubscribe date are kept only to show that you opted out
• Course registrations: until the session and its invoicing are complete
• Invoices and accounting records: for the period Swedish accounting law requires
• Business emails and call notes: while the conversation or client relationship is live, and no longer than needed afterwards
• Cookie consent records: for as long as we need to show what you agreed to
• First-party visit statistics: for as long as they are useful for comparing traffic over time

Your rights under the GDPR

You have the right to:

• Get a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict how we handle your data
• Object to processing based on legitimate interest
• Receive your data in a portable format
• Withdraw consent at any time, without affecting what happened before

Requests sent to connect@satoriml.se get an answer within one month, as Article 12 of the GDPR requires, and nothing on this site makes decisions about you by automated means alone. Complaints can go to the Swedish Authority for Privacy Protection (IMY), our lead supervisory authority, or to the data protection authority in the EU country where you live or work.

Cookies and similar technologies

Cookies are small text files a website stores in your browser, and localStorage is a similar store the browser keeps for each site. On your first visit a banner asks what you accept, and nothing optional runs until you have answered.

The marketing category in the banner has no tools behind it today. Google Analytics and advertising pixels are not installed on this site, and if we ever add them they will load only after you accept the matching category.

Changing your mind takes one click: press Cookie settings at the bottom of any page and the banner opens again, so you can switch analytics or marketing off in the same place you switched them on. Deleting the cookie-consent cookie for satoriml.com, or blocking cookies entirely, works too, because the site runs without any optional category.

Changes to this policy

SatoriML AB updates this page before, or on the day, the site starts collecting anything new, for example if we switch on the chat assistant, open newsletter or course sign-up or add analytics, and the date below always shows the latest version.

Write one line to connect@satoriml.se with the words "copy of my data" and the email address you used with us, and within one month you will have a list of everything we hold about you.