What is SaSame's privacy policy?

SaSame SRL ("the Company") is committed to protecting your personal information. This policy explains how it collects, uses, and protects personal information.

• Legal name: SaSame SRL
• Address: Romania, EU (the Company's only registered office — see "International data transfer" below)
• Contact: [email protected]

• Your name, email address, company name (via the contact form, or the public MCP's engage_sasame tool)
• IP address, browser information (automatically collected during website access)
• Optional analytics data: page views, pages visited, referring page, and approximate device/browser type, collected via Google Analytics only after explicit consent (see "Cookies and analytics" below)
• Traffic-measurement beacon data: timestamp, page path, user-agent string, referring page, and a salted SHA-256 hash of the visitor's IP address truncated to 16 characters (the raw IP is never stored). Used to measure aggregate human/AI-crawler traffic; the hash cannot be reversed to an IP.
• First-party GEC funnel events: funnel stage, page path, coarse acquisition channel, bounded CTA/source labels, device class, coarse language and campaign-medium categories, country code supplied by the edge when available (otherwise unknown), bounded section/scroll diagnostics and failure categories, and a SHA-256 hash of a random per-session browser identifier. The raw session identifier, task text, wallet address, and raw IP address are not stored in this funnel ledger. These records are used only for aggregate conversion measurement and are never treated as evidence of payment, revenue, settlement, or participant independence.
• Factory account data (for a paid plan or Assisted Review): the account and billing details necessary to operate the selected plan, handled by subprocessors (for example Stripe for payment).

• Responding to inquiries submitted via the contact form or the public MCP
• Operating the SaSame MCP Factory service selected (Free Listing, a paid Factory plan, or Assisted Review)
• Measuring website traffic and distinguishing AI-agent/crawler visits from human visits (consent-based Google Analytics and first-party cookieless traffic/funnel measurement)
• Improving service quality
• Fulfilling legal obligations

• Consent: when submitting the contact form or the engage_sasame tool
• Contract performance: operating the Factory plan or Assisted Review purchased
• Consent: optional Google Analytics measurement, disabled until explicitly accepted
• Legitimate interest: cookieless first-party AI-crawler/traffic and GEC funnel measurement, service quality improvement, website operation, abuse prevention
• Legal obligation: tax and accounting requirements

Google Analytics is fail-closed: its scripts are not requested and its cookies are not set unless "Accept analytics" is explicitly selected. Analytics settings can be reopened and declined at any time.

Inquiry information is retained for up to 2 years after response completion. Factory account and billing information is retained for the life of the account plus 5 years after closure (legal/accounting obligations). Google Analytics data is retained per Google Analytics' own account-level retention settings. Traffic-measurement beacon and GEC funnel events (hashed/pseudonymous, no raw IP or wallet address in the funnel ledger) are retained as part of SaSame's aggregate traffic and conversion observation records. After the applicable period, personal information is securely deleted.

Based on GDPR, you have:

• Right of access: request disclosure of held personal information
• Right of rectification: request correction of inaccurate information
• Right of erasure: request deletion of personal information
• Right of restriction: request processing restrictions
• Data portability: request data transfer
• Right to object: object to processing

To exercise these rights, contact [email protected].

Google Analytics (gtag.js) is optional. Its script is not requested, and no Google Analytics cookies are set, until "Accept analytics" is explicitly selected. Advertising storage, advertising personalization, and Google Signals remain disabled even after acceptance, and settings can be reopened and declined at any time. Separate first-party, cookieless, server-side traffic and GEC funnel measurement (see "Information collected") never stores a raw IP address in the funnel ledger and hashes the random per-session identifier before persistence. These measurement paths are not used for advertising or to build cross-site profiles.

SaSame SRL is registered in Romania (EU) and has no other offices. Some third-party processors used are headquartered outside the EU/EEA — for example Vercel (hosting), Google (analytics), and Stripe (payments) — and may process data in the US or elsewhere. Where this occurs, the processor's Standard Contractual Clauses (SCC) or equivalent safeguards apply.

Appropriate technical and organizational measures are implemented to protect personal information from unauthorized access, loss, and destruction.

SaSame operates a free, no-key public Model Context Protocol (MCP) server — a station of the SaSame MCP Factory — that AI assistants and agents may connect to:

• The connector receives only the arguments passed to a tool (for example, a server URL to audit or a research query). It does not request conversation history.
• Readiness tools (audit_mcp, verify_mcp_ready) fetch the third-party URL supplied; that URL is logged for abuse-prevention only and is never sold or shared.
• No personal data is required to use the no-key tools. The engage_sasame tool stores only the contact details explicitly submitted, solely to reply.
• Connector request data is processed on SaSame infrastructure in the EU. Delisting or deletion: [email protected].

A readiness certificate is a measured fact — not a security audit, endorsement, or a claim that a server is "safe." Grades are SaSame's own heuristic, not an MCP-project standard.

For questions about this policy or data protection inquiries, contact [email protected].