Privacy and cookie policy

This policy explains which personal data SatoriML AB handles when you visit www.satoriml.com, book a call, sign up for the newsletter or register for a course, and it lists every cookie the site sets. The short version is that we collect little, keep it in the EU where we can, and never sell it to anyone.

Who is responsible for your data

The controller, meaning the company that decides why and how your personal data is handled, is the Swedish company behind both satoriml.se and satoriml.com:

• SatoriML AB (trading as satori.)
• Company registration number 559458-9029
• Högosta 43, 782 92 Dala-Järna, Sweden
• Email: connect@satoriml.se
• Phone: +46 79-102 49 68

SatoriML AB is established in Sweden, so the EU General Data Protection Regulation (GDPR) applies to everything described here, wherever in the world you happen to be reading from.

What we collect and why

Each activity on the site collects a different, small set of data, and each one rests on its own legal basis under Article 6 of the GDPR, which is why the list below is split by activity.

Booking a call

Calls are booked through a Microsoft Outlook booking page, where you enter your name, email address and optionally a short note. Microsoft handles that data for us inside our Microsoft 365 tenant, and we use it to hold the call and follow up afterwards. The legal basis is steps taken at your request before a contract, Article 6(1)(b).

Emailing or phoning us

When you write to connect@satoriml.se or call us, we keep your name, contact details, company and the content of the conversation for as long as the conversation is live. The legal basis is our legitimate interest in answering business enquiries, Article 6(1)(f), or the contract itself once you become a client.

Newsletter

Signing up for posts from our blog stores the following details in our database:

• Your email address and language choice
• The page you signed up from and the consent text you saw
• The time you signed up, confirmed and, if you do, unsubscribed

Nothing is sent until you click the confirmation link in the first email, which is called double opt-in, and every email carries an unsubscribe link that stops all future sends with one click. The legal basis is your consent, Article 6(1)(a), which you can withdraw at any time through that link or by writing to connect@satoriml.se. Email addresses are stored with Supabase in its EU (Stockholm) region, while the emails themselves are delivered by Resend, which handles your address and the email content at each send.

Course registration

Registering for the open Claude course collects your name, email address, company, chosen track and session date, together with the consent text you saw. Confirming your seat then adds the billing details you type in:

• Invoice recipient and postal address
• Company or VAT number, if you choose to give one
• Billing email address and your purchase order reference

SatoriML AB uses these details to hold your seat, send practical information about the session and invoice the course fee. The legal basis is the contract you enter by booking, Article 6(1)(b), and invoices are then kept for the period Swedish accounting law requires, Article 6(1)(c).

Visiting the site

Every page request passes through our hosting provider, and the site measures traffic in two separate ways:

• Server logs at Vercel, our hosting provider, which briefly handles your IP address and browser type to deliver and secure the pages.
• Vercel Web Analytics, which counts page views without cookies. Vercel identifies a visit by a hash of the incoming request, discards it after 24 hours and shows us only aggregated numbers, never individual visitors.
• First-party visit statistics, only if you accept analytics in the cookie banner: the page you opened, the referring page, your browser and device type, and a random identifier, stored in our own Supabase database.

Server logs and cookie-free statistics rest on our legitimate interest in running a secure site that we can improve, Article 6(1)(f), while the first-party visit statistics rest on your consent, Article 6(1)(a).

Fonts

The typeface on this site, JetBrains Mono, is loaded from Google Fonts, which means your browser sends your IP address to Google when a page loads. SatoriML AB receives none of that data, and we rely on our legitimate interest in a readable site, Article 6(1)(f), until the fonts are served from our own host.

How we use AI tools with your data

SatoriML AB uses Claude for Work, a service from Anthropic Ireland, Limited, for client administration, business analysis and drafting emails. Anthropic acts as our processor, meaning it handles data only on our instructions and under a data processing addendum that incorporates the EU standard contractual clauses.

The categories that may pass through Claude are professional contact details:

• Name, job title and company
• Work email address and work phone number
• Company registration number and business notes from our conversations

Special category data, such as health information or political opinions, never goes into our AI tools. The legal basis is our legitimate interest in running client administration efficiently, Article 6(1)(f), after a balancing test that weighed the business-to-business context and the fact that only professional details are involved.

Anthropic states that data is stored in the United States, so these transfers are covered by the standard contractual clauses, with encryption in transit and at rest. By default Anthropic does not use inputs or outputs from its commercial products to train its models, and a conversation we delete is removed from its back-end storage within 30 days. You may object to this processing at any time, and we stop unless we can show compelling legitimate grounds.

Who else handles your data

SatoriML AB never sells personal data, and the only companies that handle it on our behalf are these processors:

• Vercel Inc.: hosting, server logs and cookie-free visit statistics
• Supabase: the database for newsletter, course and consent records, EU (Stockholm) region
• Resend: delivery of newsletter and course emails
• Microsoft: Microsoft 365 email, calendar and the booking page
• Anthropic Ireland, Limited: Claude for Work, as described above
• Google: delivery of the website fonts

Some of these companies are based in the United States. Whenever personal data leaves the EU or EEA, the transfer rests on a European Commission adequacy decision or on the standard contractual clauses in the provider's data processing terms, and you can ask us for a copy of the relevant safeguard.

How long we keep it

• Newsletter: until you unsubscribe, after which the address and the unsubscribe date are kept only to show that you opted out
• Course registrations: until the session and its invoicing are complete
• Invoices and accounting records: for the period Swedish accounting law requires
• Business emails and call notes: while the conversation or client relationship is live, and no longer than needed afterwards
• Cookie consent records: for as long as we need to show what you agreed to
• First-party visit statistics: for as long as they are useful for comparing traffic over time

Your rights under the GDPR

You have the right to:

• Get a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict how we handle your data
• Object to processing based on legitimate interest
• Receive your data in a portable format
• Withdraw consent at any time, without affecting what happened before

Requests sent to connect@satoriml.se get an answer within one month, as Article 12 of the GDPR requires, and nothing on this site makes decisions about you by automated means alone. Complaints can go to the Swedish Authority for Privacy Protection (IMY), our lead supervisory authority, or to the data protection authority in the EU country where you live or work.

Cookies and similar technologies

Cookies are small text files a website stores in your browser, and localStorage is a similar store the browser keeps for each site. On your first visit a banner asks what you accept, and nothing optional runs until you have answered.

Vercel Web Analytics sets no cookies at all, and the marketing category in the banner has no tools behind it today. Google Analytics and advertising pixels are not installed on this site, and if we ever add them they will load only after you accept the matching category.

Changing your mind takes one click: press Cookie settings at the bottom of any page and the banner opens again, so you can switch analytics or marketing off in the same place you switched them on. Deleting the cookie-consent cookie for satoriml.com, or blocking cookies entirely, works too, because the site runs without any optional category.

Changes to this policy

SatoriML AB updates this page before, or on the day, the site starts collecting anything new, for example if we switch on the chat assistant or add analytics, and the date below always shows the latest version.

Write one line to connect@satoriml.se with the words "copy of my data" and the email address you used with us, and within one month you will have a list of everything we hold about you.