Privacy Policy

Entity: Saltfish AB, Roslagsgatan 45, 113 54 Stockholm, Sweden (“Saltfish”, “we”, “us”, “our”)

Saltfish provides an avatar-creation studio and an embeddable video widget (the “Service”). This Policy explains how we handle personal data when you visit saltfish.ai, use our Studio as a customer, or interact with a customer’s embedded Saltfish Widget.

1) Roles and scope

Website & Studio. For saltfish.ai and the Saltfish Studio (accounts, billing, support), Saltfish is the data controller.

Embedded widget. When customers deploy the widget on their own sites/apps and their end users view or interact with it, Saltfish acts as a data processor to those customers (the controllers).

Creators vs. Viewers. “Creators” are our customers’ personnel who record or upload content to create avatars and generate outputs in the Studio. “End Users (Viewers)” are individuals who view or interact with the embedded widget on customer properties; they do not create avatars.

Customer analytics dashboards. We produce aggregated/de-identified metrics for each customer’s dashboard (e.g., view and completion rates for that customer’s deployments). These metrics are provided to that customer and are not used to train models or for unrelated product improvement.

Session recordings (optional). The widget supports optional session replay (i.e., logging DOM events to reconstruct user flows) if the customer enables it. This does not involve screen, audio, or video capture. Customers are responsible for masking inputs and avoiding collection of personal or sensitive data in replays.

2) What we collect

A. Website visitors

Device and log information (e.g., IP address, browser/OS, referring URL, timestamps).
Cookie/ID data for basic analytics and A/B testing on our site (no third-party advertising).
Company-level visit data: we use Apollo.io to match the IP address of a visit to the company that operates the network, together with the pages visited and the referring URL. We do not use this to identify individual visitors.

B. Customer admins (Studio users / Creators)

Account details (name, email).
Authentication via password or SSO (if enabled).
Billing/subscription details (handled by a payment processor).
Support communications (typically email or Slack with your team).

C. End users of customer deployments (Viewers)

Customer-directed content path:

Inputs from Creators (e.g., recorded video/audio) to create avatars in the Studio.
Generated outputs (avatar video/audio) that customers embed in the widget; End Users then view these assets.
Event/telemetry about widget interactions by End Users (e.g., load events, completion rates).
Optional session recordings if the customer enables this feature.

Special categories and sensitive data. Our Service is not designed to collect special-category data under GDPR Article 9 (e.g., information revealing racial or ethnic origin, religious beliefs, health) or other sensitive data (e.g., government IDs, precise geolocation). Customers must not submit such data unless it is strictly necessary and supported by a valid legal basis (typically explicit consent) with appropriate safeguards (data minimization, masking/redaction, limited retention). We process any such data only on the customer’s documented instructions.

3) How we use data and legal bases

Provide and secure the Service. Examples: account creation, avatar rendering, delivery, abuse prevention, QA. Legal basis: contract (Art. 6(1)(b)); legitimate interests for security (Art. 6(1)(f)).

Customer support and communications. Examples: respond to admin inquiries, service updates. Legal basis: contract / legitimate interests.

Customer analytics dashboards. Examples: show each customer metrics about their widget deployments (e.g., completion rates). Legal basis: contract / legitimate interests.

Website analytics and A/B tests. Examples: measure usage of saltfish.ai. Legal basis: consent where required (cookies); legitimate interests otherwise.

B2B sales and marketing. Examples: learn which companies show interest in Saltfish so our team can follow up with relevant information. Legal basis: legitimate interests (Art. 6(1)(f)).

Compliance and recordkeeping. Examples: invoices, tax, legal requests. Legal basis: legal obligation.

No model training on customer content. Saltfish does not use customer videos, audio, Outputs, or other customer content to train or improve models or products, and we require our service providers to honor the same restriction.

4) Cookies and similar technologies

Cookies/SDKs are used only for analytics, A/B testing, and company-level visit identification (Apollo.io) on saltfish.ai.
We will implement a consent banner (e.g., Usercentrics) in the EU/UK so visitors can manage non-essential cookies.
We do not run behavioral advertising or sell/share personal information for cross-context advertising.
We honor Global Privacy Control (GPC) signals for our website where applicable (see Section 12).

5) Service providers (sub-processors)

We work with carefully selected service providers that host infrastructure, process payments, generate media on our behalf, or support operations. These providers may handle personal data only to provide services to us and under appropriate contractual terms.

Infrastructure/hosting: cloud services in EU regions.
Payments: third-party payment processor (controller for card data).
Media generation: audio/video generation providers used by Saltfish to deliver requested features.
Support/ops: email and workspace tools for customer communications.

Transparency. We keep an up-to-date list of material service providers available to customers upon request, and we will provide prior notice of material changes as required by our customer agreements. See our subprocessors page.

Note on provider policies. Some providers publish their own retention or training terms. Customers should review those providers’ policies to understand how content is handled by them. Saltfish does not authorize providers to use customer content for their own purposes beyond what is necessary to deliver the requested service.

6) International data transfers

We primarily process data in the EU. Some service providers may process in other jurisdictions (including the United States). Where required, we use appropriate transfer tools such as the EU Standard Contractual Clauses and, if applicable, the UK Addendum or other valid transfer mechanisms.

7) Data retention

Account and admin data: kept for the life of the account and 90 days after closure, then deleted or archived as required by law.
Avatar inputs/recordings and generated media: retained while the customer’s project/account is active and deleted on request or 90 days after termination.
Session recordings (optional): default retention 30 days when enabled by the customer (customers may request a different period).
Logs/telemetry: retained for approximately 90 days.
Backups: deletions propagate as backups naturally rotate (typically within about 35 days).

We may keep minimal records as needed for legal, tax, or security purposes.

8) Security

We employ technical and organizational measures including TLS in transit, encryption at rest, role-based access/least privilege, secrets management, audit logging, and vulnerability management. We maintain an incident response plan and will notify affected customers without undue delay and in any event within 72 hours after confirmation of a personal-data breach.

9) Your rights

Depending on your location, you may have rights to access, rectify, delete, port, restrict, or object to certain processing, and to withdraw consent where we rely on consent.

Website/Studio users: contact support@saltfish.ai(subject: “Privacy Request”).
End Users (Viewers) of a customer deployment: please contact the customer (site/app owner) directly; we will assist them as their processor.

We verify requests via your account email or other reasonable steps. We respond within 30 days in the EEA/UK and 45 days in the U.S. (with permitted extensions). You may appeal a denied request by replying to our decision email. You may also lodge a complaint with your local data protection authority in the EEA/UK.

10) Children

The Service is intended for business users and is not directed to children. We do not knowingly collect data from anyone under 13 (or under 16 in the EEA/UK without appropriate consent). If you believe a child has provided data, contact us and we will delete it.

11) Avatars, likeness, and voice

The Service processes video/audio to create avatar outputs at our customers’ direction. We do not create or store biometric identifiers intended to uniquely identify a person (such as face-geometry templates or voiceprints).

Prohibited uses. The Service may not be used for biometric identification, liveness detection, or identity recognition of individuals, and may not be used to impersonate real people without proper authorization. These restrictions apply to all customer deployments and content.

12) Do Not Sell/Share and Global Privacy Control

We do not sell personal information and do not share it for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals on our website where applicable, which allow users to signal opt-out/consent preferences via their browser or extensions.

13) Law enforcement and legal requests

We review requests for legal validity, seek to narrow scope, and notify relevant customers or users before disclosure unless legally prohibited or there is a clear risk of harm or emergency.

14) Changes to this Policy

We may update this Policy. For material changes, we will provide advance notice (e.g., 14–30 days) via the Service or email where feasible. We will post the Effective Date and provide prior versions upon request.

15) Saltfish Video Chrome extension

The Saltfish Video extension records a product demo in your browser so Saltfish Studio can turn it into a video.

When it collects data. Only while you are recording, and only on the tab you are recording. It collects nothing when you are not recording.

Choosing a page. To let you choose a page to record, the extension reads the titles and addresses of your open tabs and shows them to you, in the extension and in Saltfish Studio. That list is not saved.

What it collects while recording:

a screenshot of the page each time you click, with where you clicked and a description of the element you clicked
the page’s address and title, and a short excerpt of the page’s text
text you type into fields on the page, except password fields and fields the page marks as a payment card or a one-time code
a video of the recorded tab, so scrolling, dragging and typing can play as clips, unless you turn that off in the extension’s settings
your voice, once you have allowed the microphone, on every recording until you turn “Record my voice” off

How it is used. The recording is sent to your Saltfish Studio account and used only to make your video. This includes transcribing your voice, writing the narration and generating the voice-over, done by our AI service providers acting on our behalf. It is stored and protected like the rest of your Studio content under this policy.

On your device. The extension keeps three things in your browser: your Saltfish Studio sign-in session, your settings, and the screenshots of a recording until Saltfish Studio has received them. The session is removed when you sign out.

What we never do. We do not sell recordings, use them for advertising, or use them for anything other than making your videos.

Chrome Web Store. The extension’s use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Deleting. Discarding a recording in the extension deletes it. To delete recordings or your account, contact support@saltfish.ai.

16) Saltfish in Claude

The Saltfish connector lets Claude, Anthropic’s AI assistant, make videos and interactive demos in your Saltfish account when you ask it to.

Signing in. You connect with your own Saltfish login. Sign-in runs through WorkOS, our authentication provider, which passes Claude an access token tied to your email address. Claude never receives your password, and the connector reaches only what your Saltfish account can.

What Saltfish receives. Only what each request needs: what you asked for, the brand kit, project or demo it concerns, and any link or text you share, such as a web page address or the text of a document. To record a demo, a cloud browser run for us by Steel opens the site you name; if you log in to it in the live view, that login is saved for your next recording until you ask us to forget it.

How it is used. Only to do what you asked: write a storyboard, make a video, record or edit a demo, or answer a question about your demos. What Claude makes is stored and protected like the rest of your content under this policy, and requests are logged with your email so we can support you.

Your conversation. Your chat with Claude is governed by your agreement with Anthropic. Saltfish never sees the conversation itself, only the requests Claude sends to the connector.

Disconnecting. Remove Saltfish in Claude’s connector settings to end Claude’s access. To delete what it made, contact support@saltfish.ai.

17) Contact

Questions or requests: support@saltfish.ai

If you are an End User (Viewer) of a customer deployment, please contact that customer (the site/app owner) first; we’ll assist them as needed.