What is SaSame's privacy policy?

SaSame SRL ("the Company") is committed to protecting your personal information. This policy explains how it collects, uses, and protects personal information.

• Legal name: SaSame SRL
• Address: Romania, EU (the Company's only registered office — see "International data transfer" below)
• Contact: consulting@srl-sasame.com

• Your name, email address, company name (via the contact form, or the public MCP's engage_sasame tool)
• IP address, browser information (automatically collected during website access)
• Optional analytics data: page views, pages visited, referring page, and approximate device/browser type, collected via Google Analytics only after explicit consent (see "Cookies and analytics" below)
• Traffic-measurement beacon data: timestamp, page path, user-agent string, referring page, and a salted SHA-256 hash of the visitor's IP address truncated to 16 characters (the raw IP is never stored). Used to measure aggregate human/AI-crawler traffic; the hash cannot be reversed to an IP.
• Factory account data (for a paid plan or Assisted Review): the account and billing details necessary to operate the selected plan, handled by subprocessors (for example Stripe for payment).

• Responding to inquiries submitted via the contact form or the public MCP
• Operating the SaSame MCP Factory service selected (Free Listing, a paid Factory plan, or Assisted Review)
• Measuring website traffic and distinguishing AI-agent/crawler visits from human visits (consent-based Google Analytics and the cookieless traffic-measurement beacon)
• Improving service quality
• Fulfilling legal obligations

• Consent: when submitting the contact form or the engage_sasame tool
• Contract performance: operating the Factory plan or Assisted Review purchased
• Consent: optional Google Analytics measurement, disabled until explicitly accepted
• Legitimate interest: cookieless AI-crawler/traffic measurement, service quality improvement, website operation, abuse prevention
• Legal obligation: tax and accounting requirements

Google Analytics is fail-closed: its scripts are not requested and its cookies are not set unless "Accept analytics" is explicitly selected. Analytics settings can be reopened and declined at any time.

Inquiry information is retained for up to 2 years after response completion. Factory account and billing information is retained for the life of the account plus 5 years after closure (legal/accounting obligations). Google Analytics data is retained per Google Analytics' own account-level retention settings. Traffic-measurement beacon events (hashed, no cookies, no raw IP) are retained as part of SaSame's aggregate traffic and AI-crawler observation records. After the applicable period, personal information is securely deleted.

Based on GDPR, you have:

• Right of access: request disclosure of held personal information
• Right of rectification: request correction of inaccurate information
• Right of erasure: request deletion of personal information
• Right of restriction: request processing restrictions
• Data portability: request data transfer
• Right to object: object to processing

To exercise these rights, contact consulting@srl-sasame.com.

Google Analytics (gtag.js) is optional. Its script is not requested, and no Google Analytics cookies are set, until "Accept analytics" is explicitly selected. Advertising storage, advertising personalization, and Google Signals remain disabled even after acceptance, and settings can be reopened and declined at any time. A separate first-party, cookieless, server-side traffic-measurement beacon (see "Information collected") never stores a raw IP address. Neither measurement path is used for advertising or to build cross-site profiles.

SaSame SRL is registered in Romania (EU) and has no other offices. Some third-party processors used are headquartered outside the EU/EEA — for example Vercel (hosting), Google (analytics), and Stripe (payments) — and may process data in the US or elsewhere. Where this occurs, the processor's Standard Contractual Clauses (SCC) or equivalent safeguards apply.

Appropriate technical and organizational measures are implemented to protect personal information from unauthorized access, loss, and destruction.

SaSame operates a free, no-key public Model Context Protocol (MCP) server — a station of the SaSame MCP Factory — that AI assistants and agents may connect to:

• The connector receives only the arguments passed to a tool (for example, a server URL to audit or a research query). It does not request conversation history.
• Readiness tools (audit_mcp, verify_mcp_ready) fetch the third-party URL supplied; that URL is logged for abuse-prevention only and is never sold or shared.
• No personal data is required to use the no-key tools. The engage_sasame tool stores only the contact details explicitly submitted, solely to reply.
• Connector request data is processed on SaSame infrastructure in the EU. Delisting or deletion: consulting@srl-sasame.com.

A readiness certificate is a measured fact — not a security audit, endorsement, or a claim that a server is "safe." Grades are SaSame's own heuristic, not an MCP-project standard.

For questions about this policy or data protection inquiries, contact consulting@srl-sasame.com.