The short version
Sarasto Hub processes two kinds of data: the account information you give us when you sign up, and the customer data that flows through the channels and ad accounts you connect. The second kind is yours. We hold it to run the product for you, we do not sell it, and we do not use it to train shared AI models.
Who we are
Sarasto Hub is a product of Sarasto. [Registered entity name, company number and registered address to be inserted before launch.] For any question about this policy or about data we hold, write to [email protected].
What we collect
Account data. Your name, email address, hashed password, and the workspace you belong to. If you sign in with Google, we receive your name, email address and profile picture from Google — not your Google password.
Connection data. When you connect a channel or an ad account, we store the access tokens that connection issues, along with the account identifiers, page names and profile details the platform returns. Tokens are scoped to the permissions the feature needs.
Customer conversation data. Messages, comments, attachments, sender profile details and delivery metadata from the channels you connect. This is what the inbox is.
Knowledge base content. Documents and text you upload so the AI can answer from them, and the vector embeddings computed from that content.
Advertising data. Campaign definitions, the compiled plans, spend and performance metrics read back from each network, and an audit record of every action that could affect spend.
Operational data. Logs and job records needed to run and debug the service.
What we do not collect
- Payment card numbers. If and when Sarasto Hub charges for a plan, payments will be handled by a payment processor and card details will never reach our servers.
- Your social platform passwords. Every connection is an OAuth authorisation you grant and can revoke.
- Tracking of your browsing across other websites. We do not run third-party advertising or cross-site tracking pixels on this site.
How AI processing works
When the AI drafts a reply, two things are sent to third-party model providers: the message being answered, and the passages retrieved from your own knowledge base. Your conversation database, your contact list and your other customers’ messages are not sent.
Content is not used to train shared or public models. Retrieval and generation happen per request; nothing about your workspace is retained by us for model training.
Who we share data with
We use a small number of sub-processors, each for one job. We do not sell personal data to anyone, and we do not share it for advertising purposes.
- Cloud hosting and database. Runs the application and stores your workspace data.
- Cloudinary. Media storage and delivery. Uploads go from your browser directly to Cloudinary and do not pass through our servers.
- Hugging Face. Computes the embeddings used to search your knowledge base.
- OpenRouter. Routes AI generation requests to the language model that writes the draft reply.
- Meta, Google and Microsoft. The platform APIs for the channels and ad accounts you choose to connect. Data flows to them because you asked us to send it — a reply you send, or a campaign you publish.
We will also disclose data where we are legally required to, and we will tell you when we are permitted to do so.
How long we keep it
Workspace data is retained while your workspace is active. When you delete a workspace, its data is deleted from our production systems, and from backups as those backups age out on their ordinary cycle. You can disconnect any channel or ad account at any time, which revokes the token and stops further collection from it.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. Write to [email protected] and we will act on the request.
Where Sarasto Hub processes data on your behalf — the messages your own customers send you — you are the controller and we are the processor. If one of your customers asks you to delete their data, you can do that in the product, and we will help where you need us to.
Security
Data is encrypted in transit. Passwords and refresh tokens are stored hashed, never in plain text. Access to workspace data is checked against workspace membership on every request that touches it. Sarasto Hub does not currently hold third-party security certifications such as SOC 2 or ISO 27001, and we do not claim otherwise anywhere on this site.
No system is perfectly secure. If you find a vulnerability, please report it to [email protected] rather than disclosing it publicly, and we will work with you on it.
Cookies
We use browser storage to keep you signed in and to remember your workspace and theme preference. These are necessary for the product to function. We do not use advertising or cross-site tracking cookies.
International transfers
Our sub-processors operate internationally, so data may be processed outside the country you are in. Where required, transfers rely on the appropriate legal safeguards.
Changes
If we change this policy in a way that materially affects how your data is handled, we will tell you before the change takes effect. The date at the top of this page always reflects the current version.