Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Alexander Zakharov (sole proprietor)
Turmweg 31
20148 Hamburg
Germany

Email: hello@sageobot.com
VAT ID: DE455314355 (§ 27a UStG)

“SAGEOBOT” is the product/brand name used by the individual named above; there is no separate company registration (sole proprietorship) and no separate managing director. The provider is reachable exclusively by email; no phone line is offered, which satisfies the fast electronic contact requirement of § 5 DDG. A data protection officer is not required (sole proprietor, no large-scale or systematic processing of special categories of personal data under Art. 9 GDPR).

This Privacy Policy covers the SAGEOBOT website (sageobot.com), the public diagnostic tool, and the authenticated web application (together, the “Service”). SAGEOBOT is a taxonomy-constrained, AI-assisted SEO content platform for business customers (B2B). It explains which personal data SAGEOBOT processes, for what purposes, on what legal basis, to whom it may be disclosed, and how long it is retained.

The Service is directed at business operators within the meaning of § 14 BGB. Should a consumer (§ 13 BGB) exceptionally become a contracting party in an individual case, applicable consumer-protection rules apply in addition, as a safeguard rather than an expectation.

For each processing activity below: purpose, categories of data, legal basis (Art. 6 GDPR), recipients, and retention period.

As part of website analysis (“SiteBrief”), SAGEOBOT automatically collects publicly accessible content from the website the customer submits (for example, service descriptions, customer testimonials, tone-of-voice examples, page overviews). This public content may include personal data of third parties, such as named employees or testimonial authors. SAGEOBOT processes this data on behalf of and under the instructions of the customer for the purpose of content creation. Responsibility for the lawfulness of publishing this content (including any necessary third-party consents) lies with the customer as the controller for its own website.

SAGEOBOT uses various service providers (processors, or in individual cases independent controllers), including for AI processing, payment processing, transactional email, hosting, and SEO data services. The complete, continuously updated list of providers — with purpose, data categories, location, and transfer basis for each — is maintained in the Sub-processor List, which is incorporated by reference into this policy and also forms Annex 2 to the data processing agreement (see “Processing on behalf of customers” below).

Production data is hosted server-side by Hetzner Online GmbH in the Nuremberg data center (Germany). The primary data store (Firestore) resides in the Firestore Europe multi-region (location eur3), replicated across Google data centers in St. Ghislain, Belgium and Eemshaven, Netherlands; data therefore rests within the EU. OpenAI processes data under standard contractual clauses (no EU-US Data Privacy Framework participation); Stripe, Resend, Google, and Microsoft process data under the EU-US Data Privacy Framework; PostHog is EU-hosted with no third-country transfer. These transfer mechanisms and Data Privacy Framework certification statuses were last verified on July 27, 2026.

Telegramis used for internal operational notifications. When a customer is created, the internal operations channel receives a purely internal operational notification containing only the customer’s website domain and plan/tier information — no names and no contact data (for example, no email address). The legal basis is the provider’s legitimate interest in fast internal notification of new customers (Art. 6(1)(f) GDPR). The operator is Telegram FZ-LLC (United Arab Emirates) or Telegram Messenger Inc. (British Virgin Islands), a third country without an EU Commission adequacy decision and without executable standard contractual clauses. To the extent a website domain can, in an individual case, be related to an identifiable person, this discloses a third-country transfer risk within the meaning of Art. 49 GDPR. Separately, each customer site may have its own, customer-configured Telegram channel for client notifications, which processes only that customer’s own data and is subject to the same third-country risk; it is otherwise unaffected by the disclosure above.

Where a customer has SAGEOBOT process personal data of third parties (for example, data from the customer’s own website, customer lists, or testimonials), SAGEOBOT acts as a processor within the meaning of Art. 28 GDPR, and the customer remains the controller for that data. The details of this processing (instructions, technical and organizational measures, sub-processor list, deletion after contract termination) are set out in a separate data processing agreement (DPA) that forms part of the customer contract.

Where GDPR applies, you have the following rights:

• Access (Art. 15 GDPR) to the data we process about you.
• Rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Erasure, the “right to be forgotten” (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR).
• Objection to processing based on legitimate interests (Art. 21 GDPR).

To exercise these rights, an email to hello@sageobot.com is sufficient.

Where processing is based on consent (for example, PostHog product analytics or the marketing email opt-in), you can withdraw it at any time with effect for the future — for analytics cookies via the cookie settings in the app, for marketing emails via the unsubscribe link in every email, or informally by email to hello@sageobot.com. The lawfulness of processing carried out before the withdrawal remains unaffected.

Data subjects have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a data protection supervisory authority, in particular in the member state of their habitual residence, place of work, or place of the alleged infringement. The supervisory authority responsible for the controller is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Ludwig-Erhard-Str. 22, 7. OG, 20459 Hamburg
Phone: 040/428 54-4040
Email: mailbox@datenschutz.hamburg.de
Web: https://datenschutz-hamburg.de

The Service uses an essential authentication cookie as well as other technically necessary storage (language preference, theme, sign-in state). Product analytics cookies (PostHog) are only set after explicit consent via the cookie consent banner. Consent can be withdrawn at any time via the cookie settings without affecting your ability to use SAGEOBOT. For signed-in users, we keep a server-timestamped record of the consent decision (version, acceptance/rejection/withdrawal).

The essential consent cookie, and the PostHog analytics cookie once consent is granted, are scoped to the sageobot.com domain so they are readable and writable from both sageobot.com and app.sageobot.com. This lets your cookie choice and, once you accept analytics, your PostHog identity carry over between the marketing site and the app without a second prompt. On other hosts (for example local development or preview deployments) these cookies stay scoped to that single host only.

The legal basis for storing and accessing information on your device (for example, cookies or local storage) is § 25(1) TDDDG, or § 25(2) No. 2 TDDDG for storage that is strictly necessary; the legal basis for the subsequent data processing is Art. 6(1)(a) GDPR.

The Service is not intended for processing special categories of personal data (Art. 9 GDPR) or data of minors; the Terms of Use prohibit customers from uploading such data, as well as payment card data. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning data subjects or similarly significantly affects them: AI-assisted SEO content creation has no legal or comparably significant effect on third parties (for example, the customer’s own end customers), as it produces marketing content without decision-making character toward those persons.

This Privacy Policy may be updated to reflect product, provider, or legal changes. The “Last updated” date at the top of this page shows the most recent revision.