Privacy policy

Controller: Gerald Walter, Wundersberg 16, A-4631 Krenglbach, Austria, e-mail: datenschutz@seonai.eu (hereinafter “we”). This privacy policy applies to the website www.seonai.eu including the online shop, and to the software services we operate (in particular the AI assistant “SUSI” at susi.seonai.eu).

Version: 27 July 2026

1. Principles

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Our systems are operated in data centres within the European Union. We do not sell data, we do not operate advertising networks, and we do not use our customers’ content to train AI models.

2. Visiting the website

When our websites are accessed, we process the technically necessary connection data (IP address, date and time, resource requested, browser identifier). This data is stored in server logs and serves to provide, stabilise and secure operations, including the defence against attacks (legal basis: Art 6(1)(f) GDPR — legitimate interest in secure operation). The logs are deleted automatically after a short time, unless they are required to trace a security incident.

To deliver the websites we use a European content delivery network (registered office and processing in the EU) as a processor. To protect against automated access we use a challenge procedure operated by ourselves; no data is transmitted to third parties in this process.

3. Cookies

We use strictly necessary cookies only: session and login cookies for signing in to the services, and cart and session cookies in the online shop (legal basis: Art 6(1)(b) GDPR). We do not use tracking, analytics or advertising cookies. A consent request is therefore not required.

4. Customer account and orders in the online shop

When you place an order, we process the contract and invoicing data you provide (company, name, address, e-mail address, VAT identification number, services ordered) in order to perform the contract (Art 6(1)(b) GDPR) and to comply with legal obligations, in particular retention obligations under tax and levy law (Art 6(1)(c) GDPR).

The VAT identification number provided is verified via the confirmation procedure of the European Commission (VIES); the number is transmitted to the European Commission’s interface for this purpose. Payments are processed by Mollie B.V. (Netherlands/EU); Mollie receives the data required for the payment and is (jointly) responsible under data protection law for processing the payment. We retain invoicing and accounting data for the duration of the statutory periods (as a rule seven years, § 132 BAO — Austrian Federal Fiscal Code).

5. Use of the AI services

In order to provide the services, we process the content you enter or upload (conversations, documents, images) together with the associated account and usage data (legal basis: Art 6(1)(b) GDPR). Your content is stored in your account so that you can call it up again, and is used solely to provide the service — not to train AI models.

To generate the AI responses, your inputs are transmitted to AI model providers acting as processors. By default we use exclusively providers established in the EU with processing via EU endpoints (language models and image generation). Agreements or settings are in place with these providers under which your inputs and outputs are not used to train models.

Where model selection is enabled in the service, you may additionally choose models from providers established or processing in the USA; the models available in each case are labelled within the service. In that case your inputs are transmitted to the provider you have selected; the transfer to the USA takes place on the basis of the adequacy decision on the EU-US Data Privacy Framework or of standard contractual clauses (Art 45, 46 GDPR). You make this selection yourself per request or conversation; without your selection, the EU providers remain in use.

For cost management purposes we log technical usage values per request (model, volume, cost). Your usage level is displayed to you within the service as a percentage.

6. E-mail communication

We use your e-mail address to deliver access credentials, for contract-related notices (e.g. payment requests, notices of changes) and to answer your enquiries (Art 6(1)(b) GDPR). Dispatch takes place via our own mail infrastructure. We do not send promotional newsletters.

7. Storage period and deletion

Your content and account data are stored for the duration of the contract. After the end of the last billing period, your access remains in a read mode for three months; after that, the account and its content are permanently deleted. You can arrange immediate permanent deletion yourself at any time. Excluded from deletion is data subject to statutory retention obligations (in particular invoicing and accounting data, § 132 BAO); this data is deleted once the periods have expired.

8. Recipients and processors

We use the following categories of service provider to perform our services: a data centre/infrastructure provider (EU), a content delivery network (EU), AI model providers for language and image models (EU; US providers only where you select such a model, point 5), and Mollie B.V. (Netherlands) for payment processing in the online shop. Contracts in accordance with Art 28 GDPR are in place with all processors. We provide information on the specific recipients of your data on request within the framework of Art 15 GDPR.

9. Transfers to third countries

Personal data is transferred to countries outside the EU/EEA only if you actively select a model from a US provider within the service (see point 5), or within training practice environments that are expressly labelled as such. The basis for this is the adequacy decision on the EU-US Data Privacy Framework or standard contractual clauses.

10. Data security

Transmission is encrypted (TLS). Access to the services is password-protected; two-factor authentication is available. We carry out regular data backups and operate technical and organisational measures for access control and attack detection.

11. Your rights

You have the right of access (Art 15 GDPR), to rectification (Art 16), to erasure (Art 17), to restriction of processing (Art 18), to data portability (Art 20) and to object to processing based on legitimate interests (Art 21). Please contact datenschutz@seonai.eu. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at) or another competent supervisory authority.

12. No automated decision-making

No automated decision-making with legal effect within the meaning of Art 22 GDPR takes place. The outputs of the AI services are machine-generated content that does not make decisions about you.

13. White-label instances

Where we operate the service as a separate instance for a company (under that company’s brand and domain), that company is the controller under data protection law for its users’ data; we process this data as a processor on the basis of an agreement pursuant to Art 28 GDPR. For users of such instances, that company’s privacy policy applies.

14. Changes

We adapt this privacy policy when the services or the legal situation change. The version published on the website at the relevant time applies.