Privacy Notice

Who we are

SamAI (“SamAI”, “we”, “us”) is an AI consulting and business-automation practice operated by Daniel Samarano, based in Evanston, Illinois, United States. We decide why and how the personal information described in this notice is handled, which under the GDPR makes us the data controller.

For anything in this notice, or to exercise any of the rights described below, use the contact form.

The short version

This site is deliberately quiet. Until you choose, it sets no cookies, runs no analytics, and loads nothing from third-party servers.

On your first visit a dialog asks whether we may use analytics cookies: Google Analytics, to see which pages are useful, and Microsoft Clarity, to see how pages are used. Decline and nothing changes: the site works exactly the same. Accept and both measure your visit as described under Cookies and analytics. Customize lets you switch each category on or off. You can change your answer at any time through Cookie settings at the bottom of every page.

Nothing is transmitted until you press Send. At that moment the contact form posts what you typed to Formspree, the service that delivers it to our inbox — described in full under Who else sees it.

The personal information we receive is what you type into the contact form and choose to send, and — only if you accept — the analytics data described below. We use it to reply to you, to scope the work you asked about, and to understand which pages help visitors — nothing else. We do not sell it, and we do not share it for advertising.

What we collect

Information you give us

The contact form asks for:

• Full name and email address — required, so we can reply.
• Company — optional.
• Service of interest — optional.
• Message — optional, and whatever you choose to put in it.

Please do not include sensitive information (health, financial account numbers, government identifiers, or anything similar) in the message field. It is not needed to start a conversation.

If you message us on WhatsApp, or connect on LinkedIn, we receive whatever that channel passes on — typically your name, your phone number or profile, and the content of your message.

Information collected automatically

By this website: nothing, unless you accept analytics. There is no tag manager, no advertising pixel, and no embedded font or script from another company.

If you accept analytics cookies, Google Analytics records: the pages you view and for how long, the page you came from, your browser, device type, screen size and language, and an approximate location (country and city) worked out from your IP address. Google Analytics 4 does not log or store IP addresses. It tells repeat visits apart with a random ID kept in a cookie, not with your name, and we cannot see who you are from it.

If you also switch on the Experience category, Microsoft Clarity records where you click, scroll and move on each page, as anonymised heatmaps and session recordings. Anything you type is masked, and your name is never attached.

Whoever hosts the site keeps standard server logs — typically IP address, time of request, page requested and browser user-agent — for security and to keep the service running. That is a normal part of operating any website and is handled by the hosting provider under its own terms.

Cookies and analytics

Nothing is set unless you accept. On your first visit a dialog offers two equal choices, Accept and Decline, and a Customize button that lets you decide category by category. The site works the same either way. The categories are:

• Necessary — always on. Your cookie choice itself (see below) and, after you send the contact form, your first name for the thank-you page. No cookies, nothing sent anywhere.
• Statistics — Google Analytics 4, which counts visits and which pages are read.
• Experience — Microsoft Clarity, which builds heatmaps and anonymised recordings of how pages are used (where people scroll and click). Text you type is masked and never recorded.

If you switch on Statistics, Google Analytics 4 sets two cookies on this site:

• _ga — a random ID that tells repeat visits apart. Kept for 13 months.
• _ga_<ID> — keeps track of the current visit. Kept for 13 months.

Google signals and advertising personalisation are turned off, so the data is not used for ads and is not linked to your Google account. The measurement data is kept in Google Analytics for 2 months, then deleted.

If you switch on Experience, Microsoft Clarity sets two cookies on this site:

• _clck — a random ID that tells repeat visits apart. Kept for 1 year.
• _clsk — keeps the pages of one visit together. Kept for 1 day.

Clarity recordings are kept by Microsoft for 30 days and the aggregated heatmap data for 13 months. Microsoft processes this data for us under its privacy statement; it is not used for advertising. Clarity only runs once we have connected it; until then switching the category on records your choice and nothing else.

If you decline a category, its script does not load and its cookies are not set. If you accepted earlier and later decline, those cookies are deleted.

Your choice is remembered in your browser's localStorage under the key samai_consent (your answers and the date), so the dialog does not appear on every page. It holds no personal information and is never sent anywhere. We ask again after about 6 months.

Change your mind at any time: use Cookie settings at the bottom of any page, or change your cookie choice now.

Global Privacy Control: if your browser sends a GPC signal, we treat it as a no — the dialog does not appear and nothing loads. You can still opt in through Cookie settings.

One item is written to your browser's sessionStorage: after you submit the contact form, your first name is stored under the key samai_name so the thank-you page can greet you by name. It never leaves your browser, it is not sent to us or anyone else, and your browser deletes it when you close the tab. You can clear it at any time through your browser's site-data settings.

Why we use it, and our legal basis

We use what you send for these purposes only:

• To reply to you and answer what you asked.
• To scope and discuss work, including preparing a proposal.
• To keep a record of enquiries and of the agreements we enter into.
• To understand which pages are useful — only if you accept analytics cookies.
• To meet legal obligations, such as tax and accounting requirements.

Where the GDPR applies, our legal bases are: steps taken at your request before entering a contract and performance of a contract (Article 6(1)(b)) for replying and delivering work; legitimate interests (Article 6(1)(f)) in running and securing a small consulting practice and keeping records of enquiries; and legal obligation (Article 6(1)(c)) where the law requires us to retain records. For analytics, our legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time through Cookie settings.

We do not send marketing email. If that ever changes, it will be on the basis of your consent or an existing client relationship, and every message will carry a working unsubscribe link.

Who else sees it

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have no advertising partners and no data brokers.

A small number of service providers necessarily process information on our behalf, acting only on our instructions:

• Website hosting — serves the pages and keeps the security logs described above.
• Email — carries and stores our correspondence.
• Formspree — a form-delivery service based in the United States. When you submit the contact form, what you typed is sent to Formspree, which stores it briefly and forwards it to our inbox. Formspree acts only on our instructions, and its own privacy notice is at formspree.io.
• Google Analytics (Google LLC, and Google Ireland Limited for visitors in the EEA, UK and Switzerland) — only if you accept analytics cookies. Google processes the measurement data on our behalf under its data processing terms, with Google signals and advertising features turned off. Google's own notice is at policies.google.com.
• Microsoft Clarity (Microsoft Corporation) — only if you switch on the Experience category, and only once we have connected it. Microsoft processes the heatmap and recording data on our behalf under its data processing terms; it is not used for advertising. Microsoft’s own notice is at microsoft.com.

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

International transfers

We are based in the United States. If you contact us from the European Economic Area, the United Kingdom, Switzerland or Israel, your information will be transferred to and stored in the United States.

Where such a transfer requires a safeguard, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or on Article 49(1)(b) of the GDPR — a transfer necessary to take steps at your request before entering a contract, which is exactly what a contact-form enquiry is.

If you accept analytics cookies, Google may process the measurement data in the United States and elsewhere. Google LLC is certified under the EU–US Data Privacy Framework, including its UK Extension and the Swiss–US framework, and also offers Standard Contractual Clauses. The same applies to Microsoft Corporation for the Experience category.

How long we keep it

Enquiries that do not lead to work: kept for 24 months from our last exchange, then deleted. This lets us pick up a conversation that resumes later.

Client records: kept for the duration of the engagement and afterwards for as long as tax, accounting and limitation-period rules require — generally seven years.

Analytics (only if you accepted): measurement data is kept in Google Analytics for 2 months and the analytics cookies expire after 13 months; Clarity recordings are kept for 30 days and its aggregated data for 13 months, with its cookies expiring after 1 year and 1 day respectively; your cookie choice stays in your browser for about 6 months.

If you ask us to delete your information sooner, we will, unless we are required to keep it.

How we protect it

The site is served over HTTPS. Accounts holding correspondence are protected with strong, unique credentials and multi-factor authentication. Access is limited to us.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your personal information and is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as required by law.

Your rights — EEA, UK and Switzerland

If the GDPR or UK GDPR applies to you, you have the right to:

• Access the personal information we hold about you, and receive a copy.
• Rectify anything inaccurate or incomplete.
• Erase it (“right to be forgotten”), where no overriding obligation applies.
• Restrict how it is used while a question about it is resolved.
• Portability — receive it in a structured, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent, where processing rests on consent, without affecting what came before.

To exercise any of these, send a request through the contact form. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to your local data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EEA it is the authority for your country.

Your rights — California and other US states

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the right to know what personal information is collected and why, to obtain a copy, to correct it, to delete it, and not to be discriminated against for exercising those rights.

Two disclosures the CCPA specifically requires:

• We have not sold personal information, and will not.
• We do not share personal information for cross-context behavioural advertising. There is therefore no “Do Not Sell or Share My Personal Information” link to offer.

Analytics is used only to measure this site, by Google acting as our service provider; it is not a sale or sharing of personal information. If your browser sends a Global Privacy Control signal, we honour it as described under Cookies and analytics.

We do not use personal information to infer characteristics about you, and we collect no sensitive personal information as that term is defined by the CCPA.

Residents of other US states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah and Texas — have broadly equivalent rights, and we honour them on the same terms. Make a request through the contact form; we will verify it by replying to the address on file before acting.

Your rights — Israel

Under Israel's Protection of Privacy Law, 5741–1981 and its amendments, you may review personal information held about you and request that inaccurate information be corrected or deleted. Requests go through the same contact form.

Where we rely on your consent — analytics cookies — you are told what is collected, why and by whom before you choose, you are free to refuse, and you can withdraw it at any time through Cookie settings, with no effect on how the site works for you.

Children

This is a service for businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, tell us through the contact form and we will delete it.

Links to other sites

This site links out to LinkedIn and to WhatsApp. Following either takes you to a service with its own privacy practices, which we do not control and are not responsible for. Nothing is shared with them unless you click through.

The WhatsApp button opens a chat with a message already typed in; nothing is sent until you send it. If you do, WhatsApp carries the conversation and your phone number becomes visible to us, the same as any message you send from your phone.

Changes to this notice

If this notice changes, the revised version will appear here with a new date at the top. Where a change materially affects how your information is used, we will say so clearly rather than rely on you noticing the date.

Contact

Questions, requests, or a complaint about how your information is handled:

Daniel Samarano — SamAI
Evanston, Illinois, United States
Contact form

If you raise a concern with us and are not satisfied with the outcome, you can escalate to your data protection authority as described above.