Privacy Policy — Satorio.ai

In short: We keep only what we need to answer you, run your account and build your courses. We never see or store your full card number: payments are made on a secure payment page and collected by Nakar Group, which provides our payment services. To build courses we send your content to AI providers, who use it only to return the result. We do not sell your data, do not use it for advertising and do not track you across websites. You can ask to see, correct or delete your data at any time.

1. Who we are

Satorio AI, a company registered in Israel under number 517339883, registered address 4 Paul Gruninger St., Rishon LeZion, Israel ("Satorio", "we", "us"), is responsible for the personal data described in this policy (the "controller").

Privacy contact: support@satorio.ai
Data protection officer: the law does not require us to appoint one; privacy questions go to the contact above.

2. What this policy covers

This policy covers the satorio.ai website, the Satorio app, and the emails and support we provide. It explains what we do as the controller of your data.

When a company uses Satorio, the material it uploads may contain personal data about other people, such as its employees. For that data we act as a processor on the company's behalf and follow its instructions under a data processing agreement. That company's own privacy notice applies to it, and the company is responsible for having a legal basis to share it — especially for sensitive material such as employee performance reviews. Business customers can ask us for our data processing agreement at support@satorio.ai.

3. What we collect

Data	What it includes	Where it comes from
Contact and demo requests	Name, email address, company, subject and your message	You, by email
Account data	Name, email address, company name, your role in the company, your language	You, when you sign up or are invited
Content you create	Topics and instructions you give, files you upload, the courses and media Satorio builds for you	You
Usage and technical data	Which features you use and when, the cost of the AI work done for your account, and technical logs (IP address, browser, device, errors)	Your device, automatically
Billing records	Your top-ups and refunds — amounts, VAT, dates, invoices	Nakar Group, which provides our payment services
Messages with us	Support requests and our replies	You

We do not ask for sensitive data (such as health, religion or biometric data). Please do not upload it unless your course truly needs it and you have a legal basis to share it. If you use a feature that creates an avatar or a voice based on a real person, we process that person's image or voice only with their explicit consent and only to make the content you asked for.

4. Why we use it, and our legal basis

Purpose	Legal basis (GDPR / UK GDPR)
Answer your contact or demo request	Our legitimate interest in answering you, or steps you asked for before a contract
Run your account and build your courses	Performance of our contract with you or your company
Take payments, issue refunds, keep tax and accounting records	Contract; legal obligation
Keep Satorio secure, prevent abuse, fix and improve the service	Our legitimate interest in a safe, working service
Send you news about Satorio	Your consent, or — for existing business customers where the law allows — our legitimate interest. You can opt out at any time.
Meet legal requests and defend legal claims	Legal obligation; legitimate interest

We do not sell your personal data, we do not "share" it for cross-context behavioural advertising, and we do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Payments are handled by Nakar Group

Nakar Group Learning Technologies (company no. 516736337), 4 Paul Gruninger St., Rishon LeZion, Israel, provides payment services to Satorio: it collects your payments and issues the invoice for every payment and the credit invoice for every refund. You enter your card details on the secure payment page of its payment processor.

We never see or store your full card number or its security code.
We give Nakar Group what it needs to bill your company and issue invoices: the account Owner's name and email address, the company name, a tax number if your company has one, and the amounts paid or refunded.
Nakar Group keeps invoices and payment records for as long as tax law requires.

6. AI providers

To plan and build your course, we send your instructions and content to AI service providers. They process it only to return the result to us.

Anthropic Claude, used through Amazon Bedrock (Amazon Web Services) in the EU — plans and writes your course. Amazon Bedrock does not store your content or use it to train models.
fal.ai (United States) — runs the image, video and voice models we use: Google (Gemini, Veo), OpenAI, xAI, Kling and ElevenLabs.

We send only what is needed for the piece being made. We do not use your content to train AI models of our own. fal.ai and each model maker process the data under their own terms, which say how long they keep it and whether they may use it for training.

AI output can be inaccurate. Please check every course before you use it.

8. International transfers

We are based in Israel, and our servers are in the EU (Sweden). The European Commission and the UK have recognised Israel as giving adequate protection to personal data. Some of our providers are in the United States or other countries. When we send personal data from the EU, the UK or Israel to a country without such recognition, we use a recognised safeguard: the provider's certification under the EU-U.S. Data Privacy Framework (and its UK Extension), the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as well as the conditions of Israel's regulations on transferring data abroad. You can ask us for a copy of the relevant safeguard.

9. How long we keep it

Contact and demo requests: up to 24 months after our last exchange, unless you become a customer.
Account data and your content: while your account is open. When you delete content or ask us to close the account, we delete it within 30 days, and it leaves our backups within a further 14 days.
Billing records: as long as tax and accounting law requires (7 years), even after the account closes.
Technical logs: 30 days.

10. How we protect it

We use technical and organisational measures suited to the risk, in line with Israel's Privacy Protection (Data Security) Regulations and the GDPR — including encrypted connections (HTTPS), encryption of stored data, access limited to the people who need it, and sign-in by email code. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities where the law requires.

11. Your rights

Depending on where you live, you can ask us to:

show you the personal data we hold about you and give you a copy;
correct it, or complete it;
delete it;
limit how we use it, or object to our use of it — including, at any time, to direct marketing;
give it to you, or to another service, in a machine-readable format;
withdraw a consent you gave, without affecting what we did before.

Write to support@satorio.ai. We may need to confirm your identity. We answer within one month (EU/UK), 30 days (Israel) or 45 days (US states), and tell you if we need longer. If we refuse, we explain why and how to appeal. We may keep what the law requires, such as billing records. Using your rights costs nothing and will never be held against you. You may also act through an authorised agent.

You do not have to give us personal data. But we need your email address to create an account and to answer you, and billing details to take a payment; without them we cannot provide those services.

Complaints. If you are unhappy with how we handle your data, please complain to us first, by email to support@satorio.ai or through our contact form. We acknowledge every complaint within 30 days, keep you informed and reply without undue delay. You can also complain to a data protection authority: in the EU, the authority where you live or work; in the UK, the Information Commission (ICO); in Israel, the Privacy Protection Authority.

United States. Residents of California and other US states with privacy laws have the rights above (to know, access, correct, delete and port their data, and to opt out of sale, sharing, targeted advertising and profiling). We do none of those last four. We honour Global Privacy Control signals. Because we do not track you across websites, "Do Not Track" signals do not change how the website works, and we do not allow third parties to track you across websites through our site.

12. Cookies and browser storage

The website sets no cookies and uses no analytics or advertising trackers. The app stores a small amount of data in your browser to keep you signed in and remember your choices. Details are in our Cookie Policy.

13. Children

Satorio is a professional tool for businesses and adults. It is not directed to children, and we do not knowingly collect personal data from anyone under 16 (under 13 in the US). If you believe a child has given us personal data, write to us and we will delete it.

14. Emails from us

We send emails about your account and payments because the service needs them. We send news or offers only if you agreed, or — to existing business customers, where the law allows — about similar services. Sending us a contact form is not a request to receive marketing. Every marketing email is clearly marked as advertising, says who sent it, and has an unsubscribe link, which we honour promptly.

15. Changes to this policy

We will update this page when our practices change and show the new date at the top. If a change matters, we will tell you by email or in the app before it takes effect.

16. Contact

Questions about privacy: support@satorio.ai. Other questions: support@satorio.ai. Postal address: 4 Paul Gruninger St., Rishon LeZion, Israel.