Privacy Policy
Sammii Pty Ltd · ABN 15 698 506 697
Version 1.0 · Effective 1 September 2026 · Last updated 1 September 2026
1. About this policy
Sammii Pty Ltd (ABN 15 698 506 697) ("Sammii", "we", "us", "our") builds and operates Sammi, a conversational commerce platform licensed to businesses that sell products and services online.
This policy explains how we collect, hold, use, disclose and protect personal information in connection with:
the website at sammii.com and any related marketing, documentation and support pages;
the Sammi platform — the conversational experience deployed on a licensed business's website or app, and the associated operator console; and
our dealings with prospective and current business customers, partners and suppliers.
In this policy, a business that licenses Sammi and deploys it on its own digital properties is called a "Merchant". A person who interacts with the Sammi experience on a Merchant's website is called an "End User".
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), including the Notifiable Data Breaches scheme, and we comply with other privacy laws where they apply to our activities.
2. The two roles we play
This is the most important section of this policy, because our obligations — and yours — depend on which role we are in.
2.1 Where we decide (we are the controlling entity)
We determine how personal information is handled when it relates to:
visitors to sammii.com;
prospective customers, Merchant staff, partners and suppliers we deal with directly; and
Merchant personnel who log in to the Sammi operator console.
For this information, this policy governs, and you can exercise the rights described in section 11 directly with us.
2.2 Where the Merchant decides (we act on their instructions)
When an End User interacts with Sammi on a Merchant's website, the Merchant decides what information is collected, for what purpose, and for how long it is kept. We handle that information as a service provider, under a written agreement, and only on the Merchant's documented instructions and as permitted by that agreement.
In practical terms:
The Merchant's own privacy policy and cookie or consent notice is the primary notice for End Users.
The Merchant is responsible for ensuring its notices, consent management platform and tag settings lawfully permit Sammi to operate on its site.
If you are an End User and you want to access, correct or delete information collected through Sammi, contact the Merchant first. We will support the Merchant in responding. If you contact us directly, we will refer you to the Merchant and let you know we have done so, unless we are permitted or required to deal with the request ourselves.
We describe our handling practices in this policy so that End Users and Merchants can see exactly what Sammi does. Doing so does not change who is accountable under section 2.2.
3. What information we collect
3.1 Business contact and account information
Name, job title, business email address, business phone number and employer.
Correspondence with us, including enquiry forms, emails, meeting notes and support tickets.
Console credentials, access logs, audit trail entries and configuration changes made by a user.
Billing and account administration details. We do not collect or store payment card numbers — card payments, where taken, are handled by a third-party payment provider.
3.2 Information collected through the Sammi experience
When an End User engages with Sammi on a Merchant's site, the platform may collect:
Conversation content — free-text messages typed into the assistant, selections from suggested prompts or conversational quiz tiles, and the assistant's responses.
Derived intent signals — filter values, product attributes, categories and preferences inferred from the conversation, and a per-turn measure of how specific the request has become.
Content interaction events — clicks, taps, hovers, scroll depth, dwell time on content, and interactions with page elements such as accordions, modals, image carousels, filters and video.
Commerce signals — product detail views, size or variant selection, add-to-bag actions, views of delivery, returns or sizing information, and other actions indicating proximity to a purchase. Sammi hands off to the Merchant's existing cart and checkout; we do not process the transaction or receive payment details.
Session and cohort identifiers — a session identifier and a record of which experience configuration the session was assigned to, held so the experience stays consistent across page reloads.
Technical and device information — IP address, browser type and version, operating system, device type, screen dimensions, language, referring URL, page URL and event timestamps. IP address may indicate approximate location (typically city or region level). We do not collect precise GPS location.
Merchant-supplied catalogue data — product feeds, imagery, descriptions, pricing and availability. This is ordinarily not personal information.
Merchant-supplied customer identifiers — only where a Merchant chooses to pass them (for example, a hashed customer ID or logged-in state) under its own agreement and notices.
3.3 Website visitor information
Analytics and usage data about how sammii.com is used, collected through cookies and similar technologies (see section 9).
Information you submit through demo request forms, contact forms or subscription sign-ups.
3.4 Information we do not want
Sammi is built for product discovery. It is not designed to collect, and we ask that you do not enter, sensitive information as defined in the Privacy Act — including information about health, racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union membership, sexual orientation or practices, criminal record, or biometric or genetic data.
We also ask that you do not enter government identifiers, payment card numbers, passwords or account credentials into the conversation.
If such information is entered into a free-text field anyway, we will handle it in accordance with this policy and applicable law, we will not use it to build a profile of you, and it is not used to train or further develop the platform.
3.5 Audience
Sammi is a general-audience product and we do not impose an age restriction on its use. Sammi surfaces only the products, imagery and content supplied by the Merchant from its own catalogue, arranged in response to what the person is asking for.
Each Merchant is responsible for the suitability of its own catalogue and content for the audience of its site, and for meeting any obligations that apply to it in respect of children or young people, including obtaining any consent required and providing age-appropriate notices.
4. How we collect information
Directly from you — when you complete a form, email us, speak with our team, or type into the Sammi assistant.
Automatically — through the Sammi script, tag, embedded frame or software development kit deployed on a Merchant's site, and through cookies and similar technologies on sammii.com.
From Merchants — including catalogue feeds, configuration data and details of authorised console users.
From third parties — analytics, error monitoring and business contact sources, and publicly available sources such as company websites and professional networks, where we are permitted to do so.
Where it is lawful and practicable to do so, you may deal with us anonymously or under a pseudonym. An End User can browse and buy on a Merchant's site without engaging the Sammi assistant.
5. Why we use information
We use personal information for the following purposes:
Delivering the experience — understanding a request, retrieving and ranking relevant products, assembling the page, and maintaining conversational context within a session.
Session continuity — keeping a conversation and its context available across page reloads and through the purchase journey.
Experience optimisation — allocating a session to one of a defined set of experience configurations and measuring how each performs (see section 6).
Reporting to the Merchant — providing performance analytics, conversation samples and taxonomy gap reports through the operator console. Conversation samples surfaced in the console are redacted and anonymised.
Safety, quality and guardrails — flagging off-brand language, potential product-claim errors and complaints for human review.
Security, fraud and abuse prevention — rate limiting, bot detection, investigating misuse and protecting the integrity of the service.
Support, billing and account administration.
Improving and developing the platform — including model evaluation and quality testing. Where we use information to train, test, improve or further develop Sammi other than for the direct provision of services to the Merchant whose data it is, we take reasonable steps to use it in aggregated, de-identified or otherwise privacy-protective form, except where reasonably necessary to provide the service, comply with law, investigate misuse or maintain security, or where the Merchant has expressly agreed otherwise.
Marketing to business contacts — sending information about Sammi to business contacts. Every marketing email includes an unsubscribe function, consistent with the Spam Act 2003 (Cth). We do not send direct marketing to End Users.
Legal and regulatory compliance — meeting our obligations, responding to lawful requests, and establishing, exercising or defending legal claims.
6. Automated decision-making and artificial intelligence
Sammi is an AI system, and we would rather tell you plainly how it works than bury it.
6.1 What the technology does
Large language models interpret what an End User is asking for, extract structured intent from each turn, and select which content components to display.
A vision model reads Merchant catalogue imagery during ingestion and writes structured descriptive tags — for example colour, pattern, formality, occasion. This step operates on product images, not on images of people.
A multi-armed bandit algorithm assigns each session to one of a small, defined set of pre-approved experience configurations, and learns which configuration performs best for which kind of context. It measures three things: whether the conversation is progressing toward a clear intent, whether the End User engages with the content shown, and whether signals of purchase intent are present.
Product facts — specifications, materials, pricing, availability — are retrieved from the Merchant's verified catalogue rather than generated by the model. This is enforced as a system-level guardrail.
6.2 What these systems decide
The decisions made by these automated systems are about what to show on a page and in what arrangement. Specifically:
Kinds of personal information used: conversation content, derived intent signals, content interaction events, commerce signals, session and cohort identifiers, and technical and device information, as described in section 3.2.
Kinds of decisions made solely by automated means: which products to retrieve and in what order; which layout, component and content configuration to render; which follow-up prompts or filter chips to offer; and which experience configuration a session is assigned to.
Kinds of decisions substantially and directly assisted by automation, with a human deciding: Merchant-side merchandising, taxonomy and content decisions, where a person in the operator console reviews what the system has learned and chooses whether to act on it.
6.3 What these systems do not do
Sammi does not make, and is not designed to make, decisions that significantly affect an individual's rights or interests. In particular, Sammi does not:
set or vary prices, discounts or offers for an individual person;
assess creditworthiness, or determine eligibility for credit, insurance, employment, housing, healthcare, education or any government service;
refuse, restrict or withdraw access to goods or services;
produce any legal effect concerning an individual; or
make decisions based on sensitive information.
6.4 Human oversight
The set of experience configurations the system may choose between is defined and approved in advance, not generated freely.
Merchants can freeze brand-critical elements, pause any configuration, and adjust how the system weighs its signals.
Flagged conversations are routed for human review.
You can ask us, or the relevant Merchant, for an explanation of how automated processing affected what you were shown, and ask for a human to review it. Contact details are in section 14.
7. AI model providers and how your conversation is handled
To operate the conversational layer, content from a conversation may be sent to third-party AI model providers for processing. When we do this:
we use enterprise or commercial API arrangements, not consumer AI products;
we contract, where the provider offers it, so that inputs and outputs are not used to train the provider's general-purpose models; and
we apply retention settings that minimise how long the provider holds the content, including zero-retention options where available and appropriate.
The categories of provider we rely on are: AI model providers (conversation, intent extraction and vision tagging), embedding and re-ranking providers, cloud hosting and infrastructure, database and search services, analytics and error monitoring, and customer relationship and email tools.
8. Who we disclose information to
The relevant Merchant — for information collected through Sammi on that Merchant's site.
Service providers and sub-processors — as described in section 7, bound by confidentiality and data protection obligations, and permitted to use the information only to provide services to us.
Professional advisers — lawyers, accountants, auditors and insurers, where reasonably required.
Acquirers — a party involved in an actual or proposed merger, acquisition, financing or sale of assets, subject to confidentiality obligations and to this policy continuing to apply.
Law enforcement, courts and regulators — where required or authorised by law, or where necessary to protect the rights, property or safety of any person.
We do not sell personal information, and we do not disclose personal information to third parties for their own advertising or marketing purposes.
We do not disclose one Merchant's data to another Merchant. Insights derived across Merchants are only used in aggregated and de-identified form that does not identify any Merchant, End User or individual product performance.
9. Cookies and similar technologies
Sammi and sammii.com use cookies, local storage, session identifiers, scripts, tags, pixels and similar technologies. We group them as follows:
Strictly necessary — maintaining a session, preserving conversation state across reloads, recording experience configuration assignment, load balancing and security.
Functional — remembering preferences and previously applied filters within a session.
Analytics and performance — measuring how the experience is used and how it performs.
Sammi does not set advertising or cross-site tracking cookies by default. If a Merchant configures its own advertising or measurement tags alongside Sammi, those tags are the Merchant's responsibility and are governed by the Merchant's notices.
On a Merchant's site, consent is managed through that Merchant's consent management platform, and your choices there apply. You can also control cookies through your browser settings. Blocking strictly necessary cookies will prevent the conversational experience from functioning.
10. How long we keep information
We keep personal information only as long as we need it for the purposes described in this policy, or as required by law.
Conversation content and interaction events: retained in identifiable form for [X months — CONFIRM], then deleted or de-identified. Aggregated and de-identified performance data may be retained indefinitely.
Session and cohort identifiers: 90 days.
Merchant account, billing and contractual records: for the term of the agreement and then for seven (7) years, to meet taxation, corporate and limitation-period requirements.
Marketing contact records: until you unsubscribe, and then a suppression record only.
Security and audit logs: three (3) months.
On termination or expiry of a Merchant agreement, we provide the Merchant with a reasonable opportunity to retrieve its data on written request, and thereafter delete or de-identify it, subject to legal, backup, compliance and evidentiary requirements. Backup copies are purged on our normal backup cycle.
11. Your rights and how to exercise them
Subject to the exceptions in the Privacy Act, you may:
Access the personal information we hold about you.
Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.
Request deletion or de-identification of information we hold about you.
Opt out of marketing at any time, using the unsubscribe link or by contacting us.
Ask about automated processing and request human review of what was shown to you (see section 6.4).
Complain about how we have handled your personal information.
To make a request, contact us using the details in section 14. We will acknowledge your request promptly and respond within 30 days. We may need to verify your identity first. We do not charge a fee for making a request, though a reasonable cost-based charge may apply to giving access in some circumstances. If we refuse a request, we will tell you why in writing and explain how to complain.
If your request relates to a conversation you had with Sammi on a Merchant's website, please contact that Merchant first — they control that information (see section 2.2).
11.1 Complaints
Send complaints to the contact in section 14, marked for the attention of the Privacy Officer. We will investigate and respond in writing, ordinarily within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:
Website: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001
12. Security and data breaches
We maintain administrative, physical and technical safeguards designed to protect personal information against unauthorised access, use, disclosure, alteration, loss or destruction, having regard to the nature of the information and the service. These include encryption of data in transit and at rest, role-based access control on a least-privilege basis, access logging and audit trails, environment separation, secure development practices, vendor security due diligence, and personnel confidentiality obligations and training.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
Where a breach affects a Merchant's data, we will notify that Merchant within 24 hours of becoming aware of the breach, and provide the information it reasonably needs to assess the incident and meet its own notification obligations.
13. If you are outside Australia
13.1 European Union and United Kingdom
Where the GDPR or UK GDPR applies, the Merchant is ordinarily the controller and we act as processor for End User data, under a data processing agreement. For our own business contacts we act as controller, relying on legitimate interests, contract performance, consent or legal obligation as the applicable basis.
Individuals in these jurisdictions may have rights of access, rectification, erasure, restriction, portability and objection, and a right to complain to a supervisory authority. Requests relating to Sammi on a Merchant's site should be directed to that Merchant. We are not required to appoint a representative under Article 27 of the GDPR or UK GDPR.
13.2 United States
We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, as amended, or comparable US state privacy laws. Where those laws apply, we act as a service provider or processor to the Merchant and handle personal information only for the purposes set out in our agreement with them.
13.3 New Zealand
Where the Privacy Act 2020 (NZ) applies, we comply with the Information Privacy Principles in respect of the personal information we handle.
14. Contact us
For any privacy question, request or complaint:
Privacy Officer, Sammii Pty Ltd
Email: privacy@sammii.com
Post: Level 10, 100 Arthur Street, North Sydney NSW 2060, Australia
ABN: 15 698 506 697
15. Changes to this policy
We may update this policy from time to time. The current version is always available at sammii.com/legals/privacy-policy, with the effective date shown at the top. Where a change is material, we will take reasonable steps to notify Merchants in advance, and will notify individuals where required by law. Continued use of the service after a change takes effect indicates acceptance of the updated policy.
This policy is governed by the laws of New South Wales, Australia.