This Privacy Policy describes how Saterra AI, Inc. ("Saterra," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our website at saterra.ai, the Saterra Hub platform, our models and software (including KRONOS and CORAL), model access requests, demos, evaluations, documentation, events, communications, recruiting, and related services that link to this Privacy Policy (collectively, the "Platform").

This Privacy Policy is our public baseline privacy notice. It does not replace any separate written agreement, order form, statement of work, evaluation agreement, data processing agreement, data use agreement, business associate agreement, or similar written terms that apply to a customer engagement, pilot, licence, or collaboration. If there is a conflict between this Privacy Policy and a separate written agreement with Saterra, the separate written agreement controls for the data, services, and use cases it covers.

Important Notice About Health and Patient Data

Saterra builds AI models and software for analyzing tissue and spatial biology data. The publicly available Platform, including our website, contact forms, email addresses, demos, evaluation environments, and model download pages, is not intended to receive protected health information, patient-identifiable information, regulated health data, government identifiers, financial account information, or other sensitive personal information, unless Saterra has expressly agreed in a separate written agreement to process that data.

Where a data processing agreement, business associate agreement, data use agreement, institutional approval, consent, authorization, or similar safeguard is required, it must be in place before the applicable data is provided to Saterra. Saterra asks customers and collaborators to de-identify or pseudonymize data before sharing it, and Saterra does not attempt to re-identify individuals.

Saterra is not acting as a business associate under this Privacy Policy alone, and does not agree to receive, create, maintain, or transmit protected health information unless an authorized Saterra representative has signed a business associate agreement or other applicable written agreement.

Our Role

Saterra acts in different roles depending on the context:

• Controller: for our website, events, marketing, business development, model access requests, recruiting, account administration, support, billing, security, and business operations, Saterra decides how personal information is processed and acts as an independent controller (or "business").
• Processor or service provider: when a customer or collaborator provides data for Saterra to analyze, such as tissue images and associated research or clinical metadata, Saterra processes that data only on the customer's documented instructions and under a separate written agreement. The customer remains the controller and is responsible for its own privacy notices, legal basis, consents, and authorizations.
• Customer-controlled environments: where a customer licenses Saterra models or software and runs them in its own environment, data processed there generally stays under the customer's control. Saterra may receive only limited support, configuration, or usage information as described in the applicable agreement.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date above and provide any additional notice required by law.

Personal Information We Collect

"Personal information" means information that identifies, relates to, describes, or can reasonably be linked to an identifiable person. It does not include information that is de-identified or aggregated so that it is no longer protected as personal information under applicable law. Pseudonymized, coded, or tokenized data that remains reasonably linkable to an individual may still be personal information or regulated data, depending on context and applicable law.

Information you provide

• Contact and professional information, such as name, email address, phone number, organization, job title, department, institutional affiliation, and professional background.
• Communications, such as emails, messages, inquiries, meeting notes, event registrations, survey responses, and feedback.
• Model and software access requests, such as your name, organization, email address, and intended use when you request access to our models, including through third-party platforms such as Hugging Face.
• Account information, where we provide access to Saterra Hub or other Platform accounts, such as username, authentication information, role, permissions, and organization affiliation.
• Business and transaction information, such as information needed to negotiate, sign, invoice, and manage agreements, pilots, and licences with your organization. We invoice business customers and do not collect payment card numbers through the Platform.
• Job applicant information, such as your CV or résumé, cover letter, work history, education, references, interview notes, right-to-work information, and, after a conditional offer and where permitted by law, background check results.
• Marketing preferences, such as your choices about receiving communications from us.
• Other information you choose to provide or that we describe when we collect it.

Information collected automatically

• Device and browser information, such as IP address, browser type, operating system, language settings, and approximate location derived from IP address.
• Usage information, such as pages viewed, referring pages, access times, and, for Saterra Hub users, features used and activity logs.
• Security and diagnostic information, such as log files, authentication events, error reports, and information used to detect abuse, fraud, or security incidents.
• Cookie and similar technology data, as described below.

Information from third parties

• Your employer or organization, when it arranges a pilot, evaluation, licence, or Platform access for you.
• Platforms we use to distribute or manage access to our models, such as Hugging Face.
• Event organizers, business partners, investors, advisors, and people who introduce you to us.
• Recruiters, referees, and background check providers, for job applicants.
• Public sources, such as professional websites, publications, conference materials, and professional social media profiles.

Customer Data

Data that customers or collaborators provide for analysis ("Customer Data") is processed only to provide, secure, and support the services they have requested, under the applicable written agreement. Customer Data is retained, returned, or deleted as that agreement provides.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the Platform, remember preferences, authenticate Saterra Hub users, understand website usage, and protect security. You can control cookies through your browser settings, although some features may not work properly if cookies are disabled. We do not use third-party advertising cookies or pixels for cross-context behavioral advertising. Where required by law, we will provide additional cookie choices and will honor legally required opt-out preference signals, such as Global Privacy Control.

How We Use Personal Information

• Communicate with you, including to respond to inquiries, arrange meetings, and send administrative notices.
• Manage business relationships, including to evaluate opportunities and to negotiate, perform, and administer agreements, pilots, evaluations, and licences.
• Review and manage model access, including to grant or decline access requests, enforce licence terms, and protect our intellectual property.
• Provide and operate the Platform, including to create and administer Saterra Hub accounts, authenticate users, deliver requested services, and provide support.
• Improve the Platform, including to understand website usage, diagnose issues, and improve reliability, subject to the Customer Data restrictions below.
• Recruit, including to evaluate applications, conduct interviews, check references, and make hiring decisions.
• Market our business, including to send product updates, research news, and event invitations that may interest you.
• Protect security and prevent misuse, including to detect and prevent fraud, unauthorized access, and violations of our terms or licences.
• Comply with law, including to respond to lawful requests, enforce agreements, and defend claims.
• Complete business transactions, such as financings, mergers, acquisitions, or reorganizations.
• For other purposes with your consent or as described when we collect the information.

Artificial Intelligence and Customer Data

Saterra's products are AI models and software. When customers use them, the data they submit is processed to generate outputs, operate the requested features, monitor reliability, and prevent misuse.

Saterra does not use Customer Data to train, fine-tune, or improve its models unless the customer has expressly permitted it in a written agreement. Saterra does not disclose Customer Data to third-party AI providers except as authorized under the applicable written agreement and required data protection terms.

We may use aggregated, de-identified, and other non-personal information, such as platform usage statistics, for analytics, security, research, development, and business purposes, provided it does not identify you, your organization, or any individual.

How We Disclose Personal Information

• Service providers that help us operate our business, under contracts that require them to protect personal information, including cloud infrastructure (Amazon Web Services), email and productivity tools (Google Workspace), website hosting (Cloudflare), engineering contractors, payroll and employer-of-record providers, and recruiting and background check providers.
• Customer organizations, where your Saterra Hub access or engagement is provided through your organization, to administer access and support.
• Model distribution platforms, such as Hugging Face, when you request access to our models through them.
• Business partners and collaborators, where relevant to a relationship you requested or to an introduction you asked us to make.
• Professional advisors, such as lawyers, accountants, auditors, and insurers.
• Business transaction participants, in connection with a financing, merger, acquisition, or sale of assets, subject to confidentiality protections.
• Law enforcement, regulators, and courts, where required by law or to protect rights, safety, security, or property.
• Others with your consent or at your direction.

Personal Information Summary

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Your Choices

• Marketing: you can opt out of marketing emails at any time using the unsubscribe link or by contacting us. You may still receive administrative or transactional messages.
• Cookies: you can remove or reject cookies through your browser settings.
• Do Not Track: there is no uniform standard for responding to Do Not Track signals, and we do not currently respond to them, but we will honor legally required opt-out preference signals where applicable.

Your Privacy Rights

Depending on where you live, you may have the right to:

• access or know what personal information we hold about you, and receive a portable copy;
• correct inaccurate personal information;
• delete personal information;
• object to or restrict certain processing, including direct marketing;
• opt out of targeted advertising, sale, sharing, or profiling where applicable (we do not engage in these);
• withdraw consent where processing is based on consent; and
• appeal our decision on your request.

To exercise these rights, email contact@saterra.ai. We will verify your identity before acting on a request and respond within the time required by applicable law (generally one month in the EEA and UK, and 45 days under U.S. state laws, which may be extended where permitted). Authorized agents may submit requests where permitted by law, with proof of authorization. To appeal, reply to our response or email us with "Appeal" in the subject line. We will not discriminate against you for exercising your rights.

If your personal information is part of Customer Data, we will refer your request to the relevant customer and assist them as required by our agreement.

Notice to Residents of the European Economic Area, United Kingdom, and Switzerland

Controller

The controller of the personal information described in this Privacy Policy (other than Customer Data) is Saterra AI, Inc., Attn: Privacy Officer, New York, New York, contact@saterra.ai.

Legal bases

• Contract: where processing is necessary to perform a contract with you or to take steps at your request before entering into one (for example, recruiting).
• Legitimate interests: such as responding to inquiries, managing business relationships, business-to-business marketing, controlling access to our models, and securing the Platform, where these interests are not overridden by your rights.
• Consent: where we ask for it or where the law requires it, such as for non-essential cookies.
• Legal obligation: where processing is necessary to comply with law, such as right-to-work checks or tax records.

Your rights

You may have the right to access, correct, delete, port, restrict, or object to the processing of your personal information, and to withdraw consent. You also have the right to lodge a complaint with a supervisory authority in your country (in the UK, the Information Commissioner's Office).

International transfers

Saterra is based in the United States. Personal information we collect is stored and processed in the United States, including with Amazon Web Services in the US East (N. Virginia) region, and some Saterra personnel are located in the United Kingdom. Saterra is not certified under the EU–U.S. Data Privacy Framework. Where we transfer personal information from the EEA, the UK, or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You can request more information about these safeguards by contacting us.

Data protection officer and representative

Saterra has assessed whether it is required to appoint a data protection officer or an EU or UK representative and has determined that it is not currently required to do so. Our Privacy Officer can be contacted using the details above.

Automated decisions

We do not use the personal information described in this Privacy Policy to make decisions about you based solely on automated processing that produce legal or similarly significant effects.

California Notice at Collection

This section applies to California residents where California privacy law applies to Saterra. In the past 12 months, we have collected the following categories of personal information, from the sources, for the purposes, and disclosed to the recipients described above: identifiers; customer records information; commercial information; internet or other electronic network activity information; approximate geolocation; and professional or employment-related information, including applicant information. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes that require a right to limit. Retention is described in the summary table above.

Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and at rest, multi-factor authentication, access limited to personnel who need it, logging, vendor review, and staff training. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as required by law.

Children

The Platform is intended for professionals and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will delete it.

Third-Party Sites and Services

The Platform may link to third-party websites and services, such as Hugging Face, GitHub, LinkedIn, and journal publishers. Their own privacy policies govern how they collect and use personal information.

Contact Us

Saterra AI, Inc.
Attn: Privacy Officer
New York, New York
Email: contact@saterra.ai