Privacy Policy.

How Salsita Software s.r.o. collects, uses, and protects your personal information when you use salsita.ai.

Effective dateApril 16, 2026

On this page· 8 sections

01Information We Collect
02Third-Party Processors
03Your Rights Under GDPR
04How Long We Keep Data
05Legal Basis for Processing
06Compliance with Laws
07Changes to this Privacy Policy
08Contact Us

This policy has been updated to reflect our current stack (PostHog, HubSpot, Vercel, reCAPTCHA) and is pending final review by legal counsel. For data-subject requests or questions, email info@salsita.ai.

Salsita Software s.r.o. ("us", "we", or "our") is a private limited company registered at Štefánikova 18/25, 150 00 Prague 5, Czech Republic, Company ID 272 04 201. We operate salsita.ai (the "Service").

This page describes how we collect, use, and disclose personal information when you use the Service. For residents of the European Economic Area and the United Kingdom, we act as the Data Controller under the EU General Data Protection Regulation (Regulation 2016/679) and the UK GDPR.

We will not use or share your information with anyone except as described in this Privacy Policy.

Information We Collect

We collect personal information in two ways: information you give us directly (for example, through a contact form), and information we receive automatically when you browse the Service.

Information you provide

When you submit a lead form on salsita.ai we ask for: first name, last name, business email, company name, company type, website, phone number, and the message you type. We also record your consent to this policy when you tick the GDPR acknowledgement. Providing this information is voluntary – if you don't, we cannot reply to your enquiry.

Information we collect automatically

When you visit any page, our hosting provider Vercel processes your IP address, browser type and version, referring URL, and request timestamps for operational purposes (routing, DDoS protection, error diagnostics). We do not build advertising profiles from server logs.

If you grant analytics consent, our product-analytics provider PostHog (EU Cloud) records page views, clicks on instrumented elements, and technical metadata about your browser. PostHog session recording is disabled on this site. If you grant marketing consent, HubSpot's tracking script sets cookies that let us attribute a future lead submission back to the pages you browsed.

Cookies

We use a small number of cookies. A granular, up-to-date inventory (name, purpose, category, retention) is maintained in our Cookie Policy. You can change your consent at any time using the "Cookie preferences" link in the footer.

Do Not Track disclosure

Our cookie banner is the primary mechanism for honouring your choice. We do not separately respond to the "Do Not Track" (DNT) browser header because there is no consistent industry standard for its meaning. Setting non-essential categories to off in our banner achieves the equivalent result.

Third-Party Processors

We use the following sub-processors to operate the Service. Each handles a narrow slice of your data and is bound by a data processing agreement or equivalent contractual terms.

Vercel Inc.Website hosting, edge network, and operational logging. Processes IP and request metadata to deliver the site. Privacy notice: vercel.com/legal/privacy-policy.
PostHog, Inc. (EU Cloud).Product analytics – page views, clicks, feature-flag evaluations. EU data residency (Frankfurt). Only loaded after analytics consent. Privacy notice: posthog.com/privacy.
HubSpot, Inc.CRM, form intake, and lead attribution. Receives the fields you submit through our contact forms; sets tracking cookies only after marketing consent. Privacy notice: legal.hubspot.com/privacy-policy.
Google reCAPTCHA.Abuse prevention on forms. Google processes a risk score and minimal technical signals. Privacy notice: policies.google.com/privacy.

We do not sell personal information and we do not use it for automated decision-making that produces legal effects.

Your Rights Under GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding personal data we hold about you. To exercise any of them, email info@salsita.ai with enough detail to verify your identity; we will respond within one month (GDPR Article 12).

Access (Article 15).Confirm whether we process your data, and receive a copy.
Rectification (Article 16).Correct inaccurate or incomplete data.
Erasure (Article 17).Request deletion – the "right to be forgotten" – when the data is no longer necessary for the purpose we collected it.
Restriction (Article 18).Ask us to pause processing while a dispute or correction is under review.
Portability (Article 20).Receive a structured, machine-readable export of the data you have given us.
Objection (Article 21).Object to processing based on legitimate interests, including direct marketing. We will stop unless we can show an overriding legal basis.
Withdraw consent.Where processing is based on consent (analytics and marketing cookies), you can withdraw it at any time via the "Cookie preferences" link in the footer. Withdrawal does not affect processing done before you withdrew.
Lodge a complaint.Contact the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) at uoou.cz, or your local supervisory authority.

How Long We Keep Data

Lead-form submissions.Retained in HubSpot for as long as you are a prospect or active customer, and for up to three years after our last contact with you. You can request earlier deletion under Article 17.
Product analytics (PostHog).Event-level data retained for twelve months, then deleted or aggregated beyond identifiability.
Consent records.Kept for the life of the consent (typically 180 days in the browser cookie + localStorage) so we can demonstrate you gave it, as required by GDPR Article 7(1).
Server logs.Operational logs are retained by Vercel under its standard retention policy (typically 30 days).

Legal Basis for Processing

Contract and pre-contract (GDPR Art. 6(1)(b)).When you submit a contact form, we process the information to respond to your enquiry and, if you become a customer, to deliver the engagement.
Consent (GDPR Art. 6(1)(a)).Analytics and marketing cookies load only if you accept them in the banner.
Legitimate interest (GDPR Art. 6(1)(f)).Operational logs, security monitoring, and abuse prevention (reCAPTCHA) are processed on our legitimate interest in running a reliable, secure Service.
Legal obligation (GDPR Art. 6(1)(c)).We may retain or disclose data where Czech or EU law requires it.

Compliance with Laws

We will disclose your Personal Information where required to do so by law or subpoena or if we believe that such action is necessary to comply with the law and the reasonable requests of law enforcement or to protect the security or integrity of our Service.

Business Transaction

If Salsita s.r.o. is involved in a merger, acquisition or asset sale, your Personal Information may be transferred. We will provide notice before your Personal Information is transferred and becomes subject to a different Privacy Policy.

Security

The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

International transfer

Your information, including Personal Information, may be transferred to – and maintained on – computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside Czech Republic and choose to provide information to us, please note that we transfer the information, including Personal Information, to Czech Republic and process it there.

Where we transfer personal data to processors established outside the European Economic Area (such as HubSpot, Vercel, and PostHog where applicable), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Article 46(2)(c) as the transfer mechanism. Each processor maintains appropriate safeguards in accordance with GDPR Chapter V. Copies of the applicable SCCs are available on request.

Links to other sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over, and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's privacy

Our Service does not address anyone under the age of 15 ("Children").

We do not knowingly collect personally identifiable information from children under 15. If you are a parent or guardian and you are aware that your Children has provided us with Personal Information, please contact us. If we become aware that we have collected Personal Information from a children under age 15 without verification of parental consent, we take steps to remove that information from our servers.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

Questions about this policy or requests under GDPR: email info@salsita.ai or write to Salsita Software s.r.o., Štefánikova 18/25, 150 00 Prague 5, Czech Republic. We aim to respond within five business days and always within the one-month GDPR deadline.

Contact