Your details, and only what we need.

Who we are

Sarsa Formation OÜ, a private limited company registered in Estonia under registry code 17290516, Lõõtsa tn 1a, 11415 Tallinn, Estonia. We decide how the personal data in this notice is used: we are its controller. Write to sana@muoto.xyz about anything here. We have not appointed a data protection officer; the same address reaches the people responsible.

This notice covers our own records: our customers, people who write to us, people we write to about our service, and visitors to this website. It does not cover the documents a customer gives us for a diagnosis. For those the customer is the controller, we act only on their instructions, and the terms (§10) apply.

What we collect, why, and on what basis

• When you buy. Your name, work email, company name, billing address, the line you write about your AI feature, and the payment record. Our payment provider gives us the amount, the date, and the card brand and last four digits, never the full card number. We use these to make and carry out our agreement with you (Article 6(1)(b) GDPR) and to keep the accounting records Estonian law requires (Article 6(1)(c)).
• When you write to us. Your name, email address and what you write. We use them to answer you. Where your message is about an engagement, we keep it with that engagement’s records (Article 6(1)(b)); otherwise our basis is our legitimate interest in answering you (Article 6(1)(f)).
• When we write to you first. If you work at a company whose product fits what we offer, we may have found your name, role and work email address in public sources, such as your company’s website, a talk or post you published, or a public professional profile, and written to you once about it. We use them only to write to you and to record your answer. Our basis is our legitimate interest in offering a service to a business that may need it (Article 6(1)(f)). You can object at any time, and we will not write again.
• If you open the link in our mail. The link carries a short code for your company, such as /for/yourcompany. When it is opened we record that it was, when, the country and network the request came from, and the browser’s own description of itself; whether the page stayed open for ten seconds while someone scrolled or moved; and whether the booking button was pressed. If you then book, the payment carries the same code. We do not record your IP address and set no cookies. We use this to know whether our mail was of use to you, and it is kept and deleted with the rest of what we hold about you (Article 6(1)(f)).
• When you visit this website. Our hosting provider processes your IP address and the details of your request to deliver the page and protect it from abuse (Article 6(1)(f)). Unless you came through a link in our mail, as above, we record nothing about your visit. This website sets no cookies and loads nothing from any other company: its fonts are served from this website itself.
• To protect our rights. Where we need to establish, exercise or defend a legal claim, we use the records above for that (Article 6(1)(f)).

Who else sees it

• Stripe, our payment provider. For some purposes, such as preventing fraud and meeting its own legal duties, Stripe acts as a separate controller under its own privacy notice.
• Resend, our email provider, which carries and stores our mail.
• Cloudflare, which hosts this website.
• Our accountant, and public authorities where the law requires it.

We do not sell personal data, and we do not use it for advertising.

Outside the EEA

Stripe, Resend and Cloudflare are companies based in the United States, and your data may be processed there. Where it is, the transfer relies on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for companies certified under it, or on the standard contractual clauses in that company’s data-processing terms. Write to us for details or a copy.

How long we keep it

• Agreements, invoices and payment records: seven years from the end of the financial year they belong to, as Estonian accounting law requires.
• Correspondence about an engagement: with that engagement’s records, for three years after the engagement ends.
• Other correspondence: twelve months after the last message.
• If we wrote to you first: until you tell us no, or twelve months after our message if you do not reply, whichever comes first. After a no we keep only your email address and the date, so that we never write to you again.
• Hosting records: as long as our hosting provider keeps them under its own terms.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to object to how we use it, and to receive the data you gave us in a form you can take elsewhere. You can always object to our writing to you about our service, and we then stop. Write to sana@muoto.xyz; we answer within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee), or to the data protection authority where you live or work.

Do you have to give us anything?

To buy, yes: without your name, email and billing details we cannot make the agreement or invoice it. Nothing else is required. We make no decision about you by automated means alone.