Privacy Policy
We collect what we need to run the product. We keep it tenant-isolated. We don't sell it. We delete it on a schedule, and when you ask through our erasure process.
1. Who we are.
Satatam is the product name of the AI customer-service infrastructure operated by Michael Neubauer, a sole proprietor doing business as Customer Service Pro, based in Syracuse, New York, United States. "We," "us," and "our" refer to that operator. This Privacy Policy covers personal information collected from visitors to satatam.co and customerserviceprofessional.com, users of app.satatam.co, and customers using the service.
When a business uses Satatam to talk with its own customers, we process those end users' information on that business's behalf. If you are an end user of such a business, contact that business first about your data; we will help it respond. The service is not directed to children under 13, and we do not knowingly collect their personal information.
Privacy contact: Michael Neubauer, Founder. Reach him through the contact form (preferred — every legal request is tracked) or directly at michael@satatam.co.
2. What we collect.
From website visitors.
- Cookies: the marketing website sets no analytics or tracking cookies and shows no cookie banner. See section 5.
- Form submissions: when you book a demo, request press materials, or send us email through a contact link, we receive the information you provide. The contact form uses Cloudflare Turnstile to check for automated abuse.
- Chat conversations: if you use the chat on our site, your messages are stored as a support conversation, may be copied to our CRM (HubSpot), and are processed by Anthropic, which generates the replies. OpenAI is used to search your knowledge base (vector-store retrieval).
- Page assets: our pages load fonts from Google Fonts and a graphics library from unpkg.com, so those providers receive your IP address and browser details when a page loads.
- Site analytics: Cloudflare adds its Web Analytics script to our marketing pages. It reports page views and page-load performance to Cloudflare so we can see traffic and speed. Cloudflare states that Web Analytics does not use cookies or localStorage and does not track individual visitors.
From customers and their end users.
- Account data: business email, name, role, company, and billing information for the account holder.
- Operational data: messages exchanged through Satatam, knowledge base documents you upload, integration credentials you authorize (e.g., HubSpot OAuth tokens), and configuration settings.
- Telemetry: response latency, resolution outcomes, error logs, and audit trails for security and reliability monitoring.
- Phone receptionist calls: the phone receptionist is in preview. Calls are handled in real time by OpenAI's realtime voice model via Twilio. The assistant is set to open each call by saying that it is an AI assistant and that the call is transcribed so the team gets a summary. Call audio is not recorded. After the call, the business receives a written summary by email, which can include contact details the caller chose to give. If nothing usable was captured, the summary says only that. We keep the summary for up to 30 days and remove the caller quotes behind it within 24 hours. If a caller asks during the call that the summary not be shared, we withhold it when we detect the request. When we cannot tell, the business gets only a one-line note that the call happened, without its details. If we miss the request, the business receives the normal summary. Our AI and telephony providers may keep call data briefly under their own policies.
- Health information: Satatam does not support HIPAA. Do not send protected health information through the service.
3. How we use information.
- To run Satatam on your behalf: route messages, look up knowledge, take actions in connected tools, and produce responses.
- To bill you, support you, and communicate operationally (incident notices, scheduled maintenance, contract changes).
- To detect abuse and protect the platform's integrity (rate limiting, anomaly detection, secret scanning).
- To improve the product in aggregate. We do not train foundation models on your customer messages. Period.
- To follow up with prospective customers: if you voluntarily submit your email through the site (for example, to receive a copy of a configuration you built with the demo), we use it to send what you asked for and to follow up about the product. This is separate from the SMS consent described in Section 6 and does not add you to any marketing sequence.
4. PII handling and redaction.
Card numbers, SSNs and API-key-style secrets are redacted on receipt, before the message goes to the AI model or the conversation record, on web chat, email, SMS, WhatsApp and the playground. The pipeline matches: US social security numbers written in the usual 3-2-4 grouping, payment card numbers, AWS access keys, Stripe live and test keys, GitHub tokens, and generic high-entropy secrets. Matched values are replaced with a typed tag: [SSN-REDACTED], [CARD-REDACTED], or [SECRET-REDACTED]. Exceptions: messages are saved as received while a human operator has taken over a web chat, and for emails held by loop protection. Images are not redacted. Email addresses and phone numbers are not redacted, because they are needed to follow up. Channel providers such as Twilio or your email provider keep their own copy of the original message under their own retention terms. Audit-record details are redacted at write time; the actor field holds the signed-in operator's email.
5. Cookies.
The marketing website (satatam.co and customerserviceprofessional.com) sets no analytics or tracking cookies and shows no cookie banner. The chat widget stores a random pseudonymous visitor ID (up to 30 days), a returning-visitor flag and the current-tab transcript in your browser's localStorage and sessionStorage, and checks for an open conversation on page load. It does not use cookies. The operator app uses a session cookie, plus a short-lived sign-in cookie during single sign-on. We use no third-party advertising, analytics, or tracking cookies anywhere. Our marketing pages do load Cloudflare Web Analytics, which Cloudflare describes as cookieless; see section 2.
6. SMS messaging and consent.
When a partner brand deploys Satatam with SMS enabled, end customers may receive text messages from the partner's dedicated Twilio number. SMS is used for transactional purposes only: order updates, scheduling confirmations, refund acknowledgments, support follow-ups, and ticket-resolution notifications. We do not send marketing or promotional SMS.
Satatam's own messaging. Satatam (Michael Neubauer, a sole proprietor doing business as Customer Service Pro, based in Syracuse, New York) also sends its own text messages. If you contact Satatam directly — for example, through the live chat on our website — and you provide your mobile number and check the SMS-consent box, Satatam may text you to follow up on your specific support or sales request: answering your question, sending an update on an open request, confirming a scheduled call, or checking in when a question was left unresolved. These messages are transactional and conversational; we send no marketing or promotional SMS. We collect your number directly from you at the moment you request follow-up — we never buy mobile numbers, sell or rent your number, or share it for third-party marketing. Service providers process your number as described in Section 7. We never text anyone who did not contact us first. The consent, STOP/HELP, frequency, carrier-disclosure, and phone-number-handling terms in the rest of this section apply to these messages in full. The full opt-in record — the exact disclosure shown beside the checkbox, where it appears, and every opt-out keyword — is published at SMS Consent & Opt-In.
Consent. End customers must opt in through the partner brand's signup, support form, or account portal before any SMS is sent. Consent is logged with a timestamp and source. No SMS is sent to a phone number that has not affirmatively opted in.
STOP and HELP. Reply STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT at any time to opt out. Our system signature-verifies the inbound message and immediately flips the corresponding CRM contact's cs_pro_sms_opt_out flag to true; no further SMS will be sent to that number. Reply HELP to receive help information.
Frequency. Message frequency varies by partner brand and customer-thread activity.
Carrier disclosures. Msg & data rates may apply. Message and data charges from your wireless carrier are your responsibility. We are not liable for delays, undelivered messages, or carrier-side throttling.
Phone number handling. Phone numbers are stored under partner-tenant isolation (see Security Overview) and used only within the conversation thread that originated the contact. Phone numbers are never sold, never shared with third-party marketers, and never reused across partner tenants.
7. Third-party processors.
To deliver the service, we share data with the following processors. Each is used under the data-processing terms published in its own standard customer agreement. We have not executed separate negotiated Data Processing Agreements with these providers. Our AI model providers may retain API inputs for a limited period under their own terms.
- Anthropic — AI model inference and prompt caching. Conversation content is sent here to generate replies.
- OpenAI — tenant-isolated vector stores for knowledge-base retrieval. Your knowledge-base content is indexed here, and a search query derived from each customer message (after PII redaction) is sent here to retrieve passages. Chat replies are generated by Anthropic. Phone receptionist (in preview): calls are handled by OpenAI's realtime voice model via Twilio and are transcribed; call audio is not recorded.
- Fly.io — application compute. Tenants share one application; isolation is logical, enforced in the data layer.
- Supabase — managed Postgres database for tenant data, with at-rest encryption. Customer data tables are protected by row-level security keyed to the signed-in tenant on a non-owner connection; sign-in, billing, provisioning, retention and some channel and handoff bookkeeping run on a separate privileged connection and are scoped to the tenant in application code.
- Upstash (Redis) — rate-limit counters, session locks, and delivery idempotency keys. Holds rate-limit counters, session locks and idempotency keys. Keys can contain IP addresses, email addresses and session identifiers. It holds no conversation content.
- Sentry — application error monitoring. Integrated in our code but not currently enabled in production, so no data is sent to it today. We will update this list before turning it on.
- Stripe — billing for your Satatam subscription.
- Twilio — Satatam's own SMS and phone numbers, and managed receptionist numbers.
- Zoho Mail: our own business mailbox (contact form messages and rights requests).
- HubSpot — our own CRM for website visitors and leads.
- Your connected accounts — when you connect your own Twilio, Stripe, HubSpot, Slack, Gmail, Google Calendar, Google Sheets, Calendly, or Zendesk accounts, they are invoked only with the credentials you authorize, only on your behalf. This also covers any additional helpdesk/CRM integration you connect through the operator dashboard (Front, Gorgias, Salesforce, Kustomer, Jira Service Management, ServiceNow, Help Scout, Intercom, Freshdesk, Zoho, Pipedrive) — each is invoked only with the credentials you provide for that connection.
- Cloudflare — edge/CDN, Workers, marketing website delivery, contact-form intake, Turnstile bot checks, Web Analytics for the marketing site, and inbound email routing: support emails sent to a Satatam inbound address are received and parsed by a Cloudflare Worker.
- Resend — transactional email: sign-in links, billing notices, contact-form and configurator intake, and AI email replies for tenants who have not connected their own Gmail.
- Google Fonts and unpkg.com — web fonts and a graphics library loaded by our marketing pages; they receive visitor IP addresses on page load.
Full processor list with subprocessors available on request. We will give you 30 days' notice before adding a new subprocessor.
Google user data.
A business using Satatam can connect its own Google account (Gmail and Google Calendar) from the operator app under Settings → Providers. This section describes exactly what we do with data from Google APIs.
- What we access. Gmail: permission to send email only (
gmail.send). We cannot read, search or delete anything in the mailbox. Google Calendar: free/busy times (calendar.freebusy), and permission to create and delete events (calendar.events), which we use only for appointments booked through Satatam. Your Google account's email address (openid,email), so the operator app can show which account is connected. - How we use it. We send the follow-up emails the business has turned on, from the business's own Gmail address. We check free/busy times so the assistant offers only open slots. We add the appointment a customer books to the calendar the business chooses, and delete that event if the booking is cancelled. The open times offered, and the details of a booked appointment, appear in that customer's conversation, which is processed like any other conversation as described above.
- What we store. The OAuth refresh token, encrypted at rest. The connected account's email address. The IDs of calendar events Satatam created, so they can be cancelled. We do not store your mailbox contents or the details of your other calendar events.
- Sharing. We do not sell Google user data or use it for advertising. We do not transfer it to anyone except as needed to provide these features, to comply with law, or as part of a merger or acquisition with notice to you. Our staff do not read it unless you ask us to for support, it is needed for security or abuse investigation, or the law requires it.
- No AI training. We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
- Disconnecting. Click Disconnect under Settings → Providers to delete the stored token immediately. You can also remove Satatam's access at any time from your Google Account's third-party access page (myaccount.google.com/permissions).
Satatam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Data retention.
Conversation history is retained for the window your plan includes, then permanently deleted: 30 days on trial, 180 on Starter, 365 on Growth, three years on Scale, seven years on Enterprise. Your current window is shown in the operator app under Settings → Account. Conversation transcripts are deleted automatically when they pass your plan’s retention window, along with associated mirrored transcript copies in Satatam's systems that are subject to the same retention window. Copies in third-party CRM or helpdesk systems and channel-provider copies follow those providers' retention and must be deleted there. This transcript window does not erase audit, consent, account or other records retained as described below and in Section 9. The contact records saved for the people who talk to your assistant (names, phone numbers and email addresses) are not on that window: we keep them until a verified erasure request anonymizes them, and closing an account does not by itself remove them. Individual deletion requests are honored through our erasure process; see Your rights. Upgrading lengthens the window. If you move to a plan with a shorter window, we keep the longer one until you ask us to shorten it. Knowledge base documents are retained until you delete them in the operator app; deleting a document removes it from your active knowledge base and from our AI provider’s index. Audit logs are retained for at least your plan's audit window (12 months on Starter, 2 years on Growth, 7 years on Scale and Enterprise) for security investigations. Audit-record detail payloads are redacted at write time using supported email, phone, payment-card, US Social Security number and secret patterns. The separate actor field retains the signed-in operator's email. Pattern-based redaction does not remove every possible personal identifier. The records are then written append-only and hash-chained, so altering or removing a record from the middle of the chain fails verification. On termination (which we start on request), conversations and call data are available for export for 90 days and then deleted. Account, billing, audit and some derived records, and the customer contact records described above, are retained as described. You can export your conversations, customer records and account data in JSON/CSV (knowledge-base documents are listed by metadata; you keep the source files).
9. Your rights.
- Access: request a copy of personal data we hold about you.
- Correction: ask us to fix inaccurate information.
- Deletion: on a verified request we erase the person’s conversations and associated records from Satatam’s systems. Copies in your CRM or helpdesk, and copies held by messaging and email providers, follow those providers’ retention and must be deleted there; audit and consent records are retained.
- Portability: receive your data in a machine-readable format.
- Objection / restriction: ask us to limit how we process your data.
- Withdrawal of consent: for processing based on consent, withdraw at any time without affecting the legality of prior processing.
Send rights requests through our contact form. We respond within 30 days.
Where GDPR or similar laws apply, we rely on contract performance (to provide the service), legitimate interests (to secure the service and answer enquiries), and consent (for SMS).
Your California privacy rights (CCPA/CPRA).
If you are a California resident, you may request to access the personal information we hold about you, request its deletion, or opt out of the "sale" or "sharing" of personal information. Satatam does not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use personal information for cross-context behavioral advertising. To exercise any of these rights, email michael@satatam.co. Verified deletion requests are honored through our data-subject erasure process, and we will not discriminate against you for exercising these rights.
10. Security.
Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider's storage encryption; integration credentials are additionally encrypted by us. Tenant isolation is structural: each tenant's knowledge base, configuration, and messages are namespaced, customer data tables are protected by row-level security, and some system work runs on a privileged connection that is scoped to the tenant in application code. Detailed security posture is in our Security Overview.
11. International transfers.
Our application servers (Fly.io, Ashburn, VA) and primary database (Supabase, AWS us-east-1) are in the United States. Some subprocessors, such as Cloudflare's edge network and our AI model providers, may process data in other locations under their own terms. We do not offer EU data residency or any other regional pinning, on any plan. We do not currently offer a Data Processing Agreement or Standard Contractual Clauses.
12. Changes to this policy.
Material changes are emailed to account holders 30 days before they take effect. The last-updated date is shown at the top of this page.
13. Contact.
Questions about this policy or how we handle your data: reach us through the contact form.