Last updated: 25 October 2026 · Version: ab-2026-10-25
This Privacy Policy informs you, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), about the processing of personal data in connection with the use of the “ChatiTec” platform (hereinafter the “Platform” or the “Service”) where the contract for the Service has been concluded with Sat-iTec AB.
ChatiTec is an AI/LLM platform that has been developed specifically for professionals bound by professional secrecy – in particular lawyers and physicians. Sat-iTec AB provides the Service to business customers in Sweden. Technical operation is carried out by the group company Sat-iTec Systemhaus GmbH acting as processor for Sat-iTec AB. All processing takes place primarily on our own infrastructure in a data centre in Augsburg, Germany, i.e. within the EU (own Proxmox infrastructure). The guiding principle of the Service: “Legally Secure & Data-Protection-Compliant AI from Augsburg”.
The controller within the meaning of Art. 4(7) GDPR for the processing of personal data in connection with customer accounts, contracts, billing, support and the website is:
Sat-iTec AB
Simeå 8097, 82167 Vallsta
Sweden
Responsible person: Günther Löb
Telephone: +46 76 111 79 63
E-mail: guenther.loeb@sat-itec.se
Corporate identity number (Org.nr): 559375-4335
VAT registration number: SE559375433501
Note on the allocation of roles: For the content that the customer processes in ChatiTec (e.g. prompts, documents and data relating to clients, patients or other third-party data subjects), the customer (e.g. the law firm or medical practice) is the controller. To that extent, Sat-iTec AB acts as a processor on the basis of the data processing agreement pursuant to Art. 28 GDPR (/legal/avv-ab-en.html). The group company Sat-iTec Systemhaus GmbH, Heisinger Straße 21, 87437 Kempten, Germany, operates the Platform technically and, to that extent, is a sub-processor of Sat-iTec AB. This Privacy Policy concerns the processing for which Sat-iTec AB itself is the controller (e.g. contract administration, Platform accounts, billing, support and technical operation of the Platform website).
You can reach the group data protection officer at:
Stefanie Löb · datenschutz@sat-itec.de
Heisinger Straße 21, 87437 Kempten (Allgäu), Germany
Enquiries may be submitted in Swedish or English.
ChatiTec is designed in such a way that personal data and professional secrets receive special protection. The central protection concept is as follows:
PII_FORCE_FOR_EXTERNAL=true).We process personal data for the purposes listed below on the legal bases indicated in each case.
Payments: You pay for subscriptions and token packages via the payment service provider Stripe (Stripe Payments Europe Ltd., Dublin, Ireland) to Sat-iTec AB’s Stripe account. You enter your payment data (e.g. card number) exclusively with Stripe; we receive only a customer or payment identifier, the amount and the payment status. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and point (c) GDPR (retention obligations under the Swedish Bookkeeping Act (1999:1078)). Stripe is an independent controller for payment processing; the Stripe privacy policy applies additionally.
Sales partners: If your account was created via one of our sales partners, we process the information that the partner transmitted when creating it (company, contact person, e-mail address, selected plan). If you register via a partner’s referral link, we assign your account to that partner; the referral code is read only from the address called up and is not stored in your browser. So that the partner can verify its commission, it sees in the partner portal exclusively the company name, customer number, plan, billing month as well as invoice and commission amounts. The partner never receives the content of your use (chats, documents, images). The legal basis is our legitimate interest in a traceable commission settlement (Art. 6(1)(f) GDPR) and, where applicable, the statutory obligation to provide commission statements to commercial agents under the Swedish Commercial Agency Act (1991:351) (lagen om handelsagentur) (Art. 6(1)(c) GDPR). You may object to this disclosure on grounds relating to your particular situation (Art. 21 GDPR).
Partners themselves: We process contact, tax and billing data of sales partners for the performance of the partner agreement (Art. 6(1)(b) GDPR).
If Memory is switched on (default; can be switched off under “Memory”), ChatiTec stores persistent, professional facts about you or your company (e.g. industry, software used, preferences regarding format and style) so that you do not have to explain them repeatedly. The facts are detected exclusively by a local model in our data centre, stored in encrypted form using a key derived for each customer, and used as context only for matching requests; before any processing by external AI providers they are anonymised like all content (§ 3). Facts from client mode are never passed on to external providers. No automatic detection takes place for law firm accounts. Passwords, banking and health data as well as information about third parties are not stored. You can view all entries at any time, delete them individually or completely, and export them as a file. Company entries are visible to all users of your company; personal entries only to you. Legal basis: Art. 6(1)(b) GDPR (provision of the agreed function) and point (f) GDPR (efficient, cost-saving processing). Storage period: until deleted by you, at the latest upon termination of the contract.
With the ChatiTec add-ins for Outlook, Word, Excel and OneNote and the ChatiTec extension for Chrome, Edge and Firefox, you can have an open e-mail, a document, a spreadsheet range, a notebook page, a web page or selected text summarised, improved, translated or analysed, or have texts, formulas, replies or reminders created from it. Content is only transmitted when you expressly click on an action, and only the selection or the currently open e-mail, the open document, the selected spreadsheet range, the current notebook page or the active browser tab (for web pages additionally the page title and domain, not the full address). Processing takes place as described in § 3 and § 4.3 (anonymisation before external processing; law firm accounts exclusively locally). Results are not stored in the chat history and are not automatically transferred to Memory (§ 4.7). Draft replies and appointments are only sent or saved once you confirm this in Outlook yourself; documents, spreadsheets and notes are only written to after you click “Insert”. The extension does not read browser history, form inputs or pages in the background; login credentials (access tokens) are stored only locally in the memory of the add-in or extension and are deleted when you log out. Legal basis: Art. 6(1)(b) GDPR. If e-mails or web pages contain personal data of third parties, responsibility for the lawfulness of the disclosure to ChatiTec lies with the user or the user’s company; we process such data as a processor in accordance with the data processing agreement.
In the Performer plan, AgentiTec can execute commands via SSH on your servers on your instruction. Each command is shown to you for confirmation beforehand, unless you have expressly approved a target permanently; commands that delete data, stop services or change access rights are always confirmed individually. Without the Connector, ChatiTec connects only to publicly accessible servers; for this purpose, ChatiTec generates a separate SSH key for each user. Optionally stored passwords and the private key are stored in encrypted form and are never transmitted to AI models. With the ChatiTec Connector (a program on your PC), the approved commands run via your PC, its network and VPN; access credentials remain on your PC. The following are processed: target (server, user, port), command, output and exit code; the output is transmitted to the AI model in order to process your task. Queries and jobs are deleted after 30 days, log entries after 90 days. Legal basis: Art. 6(1)(b) GDPR; if the servers contain data of third parties, we process such data as a processor. AgentiTec is not available for law firm accounts.
Sat-iTec AB engages the following recipients. Only exclusively anonymised content (see § 3) is transmitted to external AI providers, and only insofar as you use functions that rely on these providers:
| Recipient | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Sat-iTec Systemhaus GmbH, Heisinger Straße 21, 87437 Kempten (group company) | Technical operation, hosting, maintenance and support of the Platform (processor for Sat-iTec AB; sub-processor for customer content) | Germany (EU) | Data processing agreement (Art. 28 GDPR); no transfer to a third country |
| Stripe (Stripe Payments Europe Ltd.) | Payment processing via Sat-iTec AB’s Stripe account (independent controller) | Ireland (EU) | Within the EU; Stripe’s own safeguards for any onward transfer to third countries |
| OpenAI | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
| Anthropic | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
| Google (Gemini) | AI/LLM inference | USA | SCC (Art. 46 GDPR) and/or EU-US Data Privacy Framework |
Owing to third-country concerns (China), the provider “DeepSeek” is deactivated by default and is not used without express, separate activation.
Further categories of recipients may include: IT service providers for hosting and maintenance (within the EU), payment service providers and banks (only for paid plans), accounting consultants and auditors, as well as authorities (e.g. the Swedish Tax Agency, Skatteverket) within the scope of statutory obligations.
A complete and up-to-date list of the sub-processors engaged can be found in “Annex 2 – List of Sub-processors” to the Data Processing Agreement (/legal/avv-anlage2-subprozessoren-ab-en.html).
When external AI providers are used, anonymised content is transferred to the USA (a third country within the meaning of the GDPR). Appropriate safeguards pursuant to Chapter V GDPR are in place for these transfers:
The upstream anonymisation (§ 3) ensures that no identifying personal data in plain text reach the third country. When purely local models are used, no transfer to a third country takes place. Technical operation by Sat-iTec Systemhaus GmbH takes place in Germany and does not constitute a transfer to a third country.
A copy of the relevant safeguards may be requested using the contact details given in § 1 and § 2.
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods:
The Platform is accessible exclusively via a TLS-encrypted connection (certificates via Let's Encrypt). You can recognise an active encryption by the address bar of your browser (https://).
We use only technically necessary cookies or comparable technologies (e.g. session/authentication tokens, JWT) that are required for operation and secure login. Such storage of and access to information in your terminal equipment is permitted without consent under Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482) (lagen om elektronisk kommunikation), as it is necessary to provide the service you have expressly requested; any related processing of personal data is based on Art. 6(1)(b)/(f) GDPR. We do not use non-essential cookies or analytics, tracking or marketing tools; a cookie banner is therefore not required.
When the Platform is accessed, technical information is automatically collected and stored in server log files, in particular:
Processing takes place on the basis of Art. 6(1)(f) GDPR in order to ensure trouble-free and secure operation. The storage period is 14 days, unless a security incident requires longer storage.
A decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) does not take place within the Platform. The AI serves as a support tool; the professional assessment and decision always remain with the professional using it.
The language models (LLMs) used generate outputs on a statistical basis. Results may be incomplete, outdated or incorrect (“hallucinations”). Outputs must be checked on your own responsibility and do not replace professional, legal or medical advice.
Subject to the statutory requirements, you have the following rights:
Note: Where data are processed on behalf of a customer acting as controller (e.g. a law firm or medical practice), please address data subject requests to that controller; Sat-iTec AB assists the controller in fulfilling these rights.
To exercise your rights, please contact Sat-iTec AB (§ 1) or the data protection officer (§ 2).
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
The competent (lead) supervisory authority for Sat-iTec AB is:
Integritetsskyddsmyndigheten (IMY – Swedish Authority for Privacy Protection)
Box 8114, 104 20 Stockholm, Sweden
www.imy.se
The provision of certain data is necessary for the conclusion of the contract and the use of the Platform (e.g. e-mail address for setting up the account). Without these data, the Service cannot be provided, or can be provided only to a limited extent. A statutory obligation to provide data exists only where required by law (e.g. bookkeeping and tax-law obligations).
We reserve the right to amend this Privacy Policy in order to adapt it to changes in the legal situation or changes to the Service. The version available at the time of use applies in each case.
This Privacy Policy is available in Swedish and English. The Swedish version is legally binding; the English version is a translation (Swedish version: /legal/datenschutzerklaerung-ab-sv.html). In the event of any discrepancy, the Swedish version shall prevail.
Last updated: 25 October 2026 · Version ab-2026-10-25