Privacy policy

Who is responsible

Sam (sam247.pro) is operated by Idea Garage OÜ, Oja tn 79-2, 13516 Tallinn, Estonia, registered in the Estonian Commercial Register under registry code 17553708. For any question about your data, or to use any of the rights below, write to [email protected] or call +372 58633643.

In short

We use your data only to run Sam for you. We do not sell it, we show no ads, we use no analytics or tracking tools, and we do not train AI models on it.

When you visit the site

Our servers and our network provider, Cloudflare, receive the technical details every web request carries: your IP address, the time, the page requested, your browser and operating system, and the page that sent you. This is needed to deliver the site and keep it secure, and rests on our legitimate interest in running a working service (Art. 6(1)(f) GDPR). These logs are kept only briefly.

Your account

To sign in you give us your email address, and we email you a sign-in link. If you sign in with Google instead, Google shares your name and email address with us. We use this to create your account, keep it secure and contact you about it. Our legal basis is our contract with you (Art. 6(1)(b) GDPR).

Telling Sam about your business

During onboarding you answer questions by voice or text and may give us your website and social media links. Voice answers are sent to our speech-to-text provider, turned into text, and the audio is then deleted; we keep only the text. If you give us a website, our server reads its public pages. We store your answers and what we learn from your website to build your business profile and your agent team. Our legal basis is our contract with you (Art. 6(1)(b) GDPR).

Leads and contacts

Sam stores the leads you add, import or receive, and the leads Sam's agents find for you. A lead can include a person's name, company, job title, email address, phone number, and the notes and messages linked to them.

For this data you, our customer, decide why and how it is used, so you are the controller and we process it on your behalf as your processor. You are responsible for having a legal basis to store and contact these people, and for answering their requests. We help you do that when you ask.

When Sam's agents search for new leads, they use public sources such as business websites, public listings and search services. They look for business contact details, not private life information.

AI processing

Sam uses AI models to understand your answers and your website, to suggest your team and pipeline, and to help find and qualify leads. The text needed for each task is sent to the AI provider, which returns a result and does not use it to train its models. AI does not make decisions with legal or similarly serious effects on anyone; you stay in control of what Sam does.

Cookies and browser storage

We set only strictly necessary cookies: two sign-in cookies (sam_access and sam_refresh) that keep you signed in, a small sam_signed_in flag, and a cookie that remembers whether the side menu is open. We also store your chosen language and whether you have seen the intro in your browser's storage. None of these track you, so no consent banner is needed. Cloudflare may set its own security cookies.

Who processes data for us

Our hosting provider (the server that runs Sam and its database), Cloudflare (network and security), our email provider (sign-in emails), Soniox (speech to text), OpenRouter and the AI model providers it connects us to, such as Google (AI processing), Exa and Google (searching public sources for leads), and Google (sign-in, if you choose it). Each works only on our instructions. Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision. The current list is available on request.

How long we keep things

We keep your account, business profile and leads for as long as your account is open. When you close your account, or ask us to, we delete them within 30 days, except where the law requires us to keep something longer. Server logs are kept only briefly for security and troubleshooting.

Your rights

Under the GDPR you may ask for access to your personal data, its correction, its deletion, restriction of its processing, and a copy to take elsewhere, and you may object to processing based on legitimate interest. Write to [email protected] and we will answer within one month. If you are a lead stored by one of our customers, we will pass your request to that customer and help them answer it.

Complaints

You may complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). If you live in another EU or EEA country, you may instead complain to the authority where you live or work.

Changes

If we change how data is handled, we will update this page and the date at the top before the change takes effect, and ask for your consent where it is required.