Privacy policy

Controller: Gerald Walter, Wundersberg 16, A-4631 Krenglbach, Austria, e-mail: datenschutz@seonai.eu (hereinafter “we”). This privacy policy applies to the website www.seonai.eu including the online shop, and to the software services we operate (in particular the AI assistant “SUSI” at susi.seonai.eu).

Version: 24 September 2026

1. Principles

We process personal data exclusively in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG). Our systems are operated in data centres within the European Union. We do not sell data, we do not operate advertising networks, and we do not use our customers’ content to train AI models.

2. Visiting the website

When our websites are accessed, we process the technically necessary connection data (IP address, date and time, resource requested, browser identifier). This data is stored in server logs and serves to provide, stabilise and secure operations, including the defence against attacks (legal basis: Art 6(1)(f) GDPR — legitimate interest in secure operation). The logs are deleted automatically after a short time, unless they are required to trace a security incident.

To deliver the websites we use a European content delivery network (registered office and processing in the EU) as a processor. To protect against automated access we use a challenge procedure operated by ourselves; no data is transmitted to third parties in this process.

3. Cookies

We use strictly necessary cookies only: session and login cookies for signing in to the services, and cart and session cookies in the online shop (legal basis: Art 6(1)(b) GDPR). We do not use tracking, analytics or advertising cookies. A consent request is therefore not required.

4. Customer account and orders in the online shop

When you place an order, we process the contract and invoicing data you provide (company, name, address, e-mail address, VAT identification number, services ordered) in order to perform the contract (Art 6(1)(b) GDPR) and to comply with legal obligations, in particular retention obligations under tax and levy law (Art 6(1)(c) GDPR).

The VAT identification number provided is verified via the confirmation procedure of the European Commission (VIES); the number is transmitted to the European Commission’s interface for this purpose. Payments are processed by Mollie B.V. (Netherlands/EU); Mollie receives the data required for the payment and is (jointly) responsible under data protection law for processing the payment. We retain invoicing and accounting data for the duration of the statutory periods (as a rule seven years, § 132 BAO — Austrian Federal Fiscal Code).

5. Use of the AI services

In order to provide the services, we process the content you enter or upload (conversations, documents, images) together with the associated account and usage data (legal basis: Art 6(1)(b) GDPR). Your content is stored in your account so that you can call it up again, and is used solely to provide the service — not to train AI models.

To generate the AI responses, your inputs — including the matching excerpts from attachments and knowledge libraries — are transmitted to an AI model provider established in the EU acting as processor. The same applies to dictation, read-aloud and transcription. Transmission takes place via stateless interfaces and an EU endpoint; the provider does not store your inputs and outputs (zero data retention). Your conversation history is kept by us, not by the provider. Knowledge libraries and the search index remain on our servers.

When recordings are transcribed, the audio track is extracted from the file in your browser; only the audio track is uploaded — the video track of a video recording does not leave your device.

For web search, we transmit the search terms formed by the AI model from your input to a European search service. The request is issued from our server — without your IP address, without user identifier and without conversation history. If the European search index returns no results, the search service may, according to its own information, additionally fall back on a search source in the United States; in that case, too, only the search terms are transmitted.

If image generation is enabled for your organisation, we transmit image descriptions and, where applicable, images uploaded for editing to a provider established in the United States. Zero data retention has been agreed there: requests are deleted no later than one hour after completion; we take generated images over into your account immediately.

At your organisation’s express request, AI models from providers established in the United States may additionally be enabled. They are used only if you expressly select such a model in the service; in that case the inputs of that conversation, including the matching excerpts from attachments and knowledge libraries, are transmitted to the selected provider. Without your selection, the EU provider remains in use.

None of the AI providers used employs your inputs or outputs to train models.

For cost management purposes we log technical usage values per request (model, volume, cost). Your usage level is displayed to you within the service as a percentage.

6. E-mail communication

We use your e-mail address to deliver access credentials, for contract-related notices (e.g. payment requests, notices of changes) and to answer your enquiries (Art 6(1)(b) GDPR). Dispatch takes place via our own mail infrastructure and a dispatch service provider in Austria. We do not send promotional newsletters.

7. Storage period and deletion

Your content and account data are stored for the duration of the contract. After the end of the last billing period, your access remains in a read mode for three months; after that, the account and its content are permanently deleted. You can arrange immediate permanent deletion yourself at any time. Excluded from deletion is data subject to statutory retention obligations (in particular invoicing and accounting data, § 132 BAO); this data is deleted once the periods have expired.

8. Recipients and processors

We use the following categories of service provider to perform our services: a data centre/infrastructure provider (EU), a content delivery network (EU), AI model providers for language and image models (language models EU; image generation and additionally enabled models USA, point 5), a search service (EU, point 5), an e-mail dispatch service provider (Austria), and Mollie B.V. (Netherlands) for payment processing in the online shop. Contracts in accordance with Art 28 GDPR are in place with all processors. We provide information on the specific recipients of your data on request within the framework of Art 15 GDPR.

9. Transfers to third countries

Personal data is transferred to countries outside the EU/EEA only in the following cases: for image generation, where it is enabled for your organisation (USA); if you select an enabled model from a US provider within the service; if the search service falls back on a US search source for lack of European results (search terms only); within training practice environments that are expressly labelled as such; and, in individual cases, by sub-processors of our service providers. The basis is the adequacy decision on the EU-US Data Privacy Framework, to the extent that the recipient is certified under it, and otherwise standard contractual clauses (Art 45, 46 GDPR).

On the US CLOUD Act: this US law requires providers subject to US jurisdiction to disclose data in their possession or under their control — regardless of where that data is stored. What matters is therefore not the location of the server but who legally and factually controls the data. Our server provider and our default AI provider are established in the EU; your conversation history and your knowledge libraries are held by us alone. The AI provider in turn uses sub-processors, including companies established in the United States. The CLOUD Act becomes directly relevant for image generation and for models from US providers (point 5). We explain what the CLOUD Act requires, how often it is applied and how European courts assess it on a separate page: The US CLOUD Act – what it means and whom it affects.

10. Data security

Transmission is encrypted (TLS). Access to the services is password-protected; two-factor authentication is available. We carry out regular data backups and operate technical and organisational measures for access control and attack detection.

11. Your rights

You have the right of access (Art 15 GDPR), to rectification (Art 16), to erasure (Art 17), to restriction of processing (Art 18), to data portability (Art 20) and to object to processing based on legitimate interests (Art 21). Please contact datenschutz@seonai.eu. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at) or another competent supervisory authority.

12. No automated decision-making

No automated decision-making with legal effect within the meaning of Art 22 GDPR takes place. The outputs of the AI services are machine-generated content that does not make decisions about you.

13. White-label instances

Where we operate the service as a separate instance for a company (under that company’s brand and domain), that company is the controller under data protection law for its users’ data; we process this data as a processor on the basis of an agreement pursuant to Art 28 GDPR. For users of such instances, that company’s privacy policy applies.

14. Changes

We adapt this privacy policy when the services or the legal situation change. The version published on the website at the relevant time applies.