Privacy Policy of SOPHONA

General provisions

This Privacy Policy applies to natural persons using "Sophona" platform (hereinafter: the "Platform") as a User (as defined in the Terms and Conditions of the Platform, hereinafter: the “T&C”). If a User is a legal entity or other organization, this Privacy Policy applies to the personal data of the natural persons acting on its behalf in connection with the use of the Platform. Hereinafter, the individuals to whom this Privacy Policy applies are referred to as "you."

Data Controller

The controller of your data is SOPHONA spółka z ograniczoną odpowiedzialnością, Marcina Kasprzaka 31 / 119, 01-234 Warsaw, Poland, registry court keeping files: District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, NCR (KRS) number: 0001261005, REGON: 545506387, NIP: 5273232841 (hereinafter as "we").

This applies to every instance of processing your data in connection with your use of the Platform, in particular in connection with: creating a user account, placing and fulfilling orders, handling payments, and using the tools available on the Platform (hereinafter: the "Tools").

For matters related to the processing of personal data, you may contact us by e-mail [email protected]; as well as by traditional mail: Marcina Kasprzaka 31 / 119, 01-234 Warsaw, Poland.

Data Processed

Name, surname, email address, IP address, cookies, server log data, and information about your device/browser, as well as any other data you provide in connection with your use of the Tool you have chosen (e.g., the content of your prompts, uploaded files), to the extent required for that Tool to function – the type of such data is indicated to you in the Platform's interface before you provide it.

If you act as an Administrator (as defined in the T&C), we additionally process your billing details necessary to issue an invoice (e.g., your name, business name, tax identification number, and billing address). This does not apply to Standard Users (as defined in the T&C), who do not have access to payment and billing functions on the Platform.

Purposes and Legal Basis for Processing

We process your data for the following purposes:

• for communication purposes, e.g., in connection with an inquiry about our offer or another type of contact related to our business activity (in this case we process data on the basis of Article 6(1)(f) GDPR, i.e., within the framework of a legitimate interest, that interest being responding to your inquiry);
• for the performance of a contract concluded with you, or to take steps at your request prior to entering into such a contract (in this case we process data on the basis of Article 6(1)(b) GDPR);
• for the purpose of providing you with access to the Tool selected by you on the Platform, including processing the content of your prompts, files you upload, and other data you provide in order for the given Tool to generate the requested output (in this case we process data on the basis of Article 6(1)(b) GDPR, as this processing is necessary for the performance of the contract concluded with you);
• to fulfill our legal obligations related to conducting business activity (in this case we process data on the basis of Article 6(1)(c) GDPR);
• to establish or pursue potential claims, or to defend against such claims (in this case we process data within the framework of a legitimate interest, our legitimate interest being the protection of our rights and the pursuit of claims);
• to detect and prevent misuse of the Tools and to ensure the security of the Platform, including automated or manual review of prompts submitted to the Tools and of the content they generate, in order to identify violations of the T&C or applicable law (in this case we process data within the framework of a legitimate interest, that interest being to ensure the security of the Platform and to prevent unlawful use of the Tools);
• to improve and develop the Platform and the Tools, including analysing how the Tools are used in order to enhance their functionality and reliability (in this case we process data within the framework of a legitimate interest, that interest being the ongoing improvement and development of our services);
• to send our newsletter, containing commercial information about our offer; in this case we process data on the basis of your consent (Article 6(1)(a) GDPR), as well as consent given pursuant to Article 398 of the Act – Law on Electronic Communications. When signing up for the newsletter, we use a "double opt-in" mechanism; this means that only after clicking the confirmation link is the e-mail address added to our mailing list, and only then will we send the newsletter to that e-mail address;
• for statistical analysis and platform optimization purposes – we use Google Analytics 4 to understand how users interact with the Platform, which allows us to improve the Platform's performance and tailor its content. In this case, we process data on the basis of your consent (Article 6(1)(a) GDPR). Consent given may be withdrawn at any time via the cookie settings.

Cookies

Our Platform uses cookies, i.e., small text files stored on the user's end device (e.g., computer, tablet, smartphone), which enable the proper functioning of the Platform and allow us to analyse how the Platform is used. On your first visit to the Platform, you are informed about the use of cookies and given the option to manage your cookie preferences via a dedicated banner.

We use the following categories of cookies on the Platform:

• necessary cookies – these are cookies required for the proper functioning of the Platform, in particular to: support the checkout process, maintain your session, enable secure login, and remember your cookie consent preferences. These cookies are exempt from the requirement to obtain your consent, as they are necessary for the provision of the service you have requested and for the Platform to function properly;
• functional cookies – functional cookies allow us to adapt the operation of the Platform to your preferences (e.g., how content is displayed). These cookies are used only after obtaining your consent;
• statistics cookies – statistics cookies are used to understand how users interact with the Platform (e.g., number of visits, traffic sources). We use Google Analytics 4 (GA4), provided by Google Ireland Limited, loaded on every page of the Platform. This service collects data such as pages visited, time spent on the Platform, traffic sources, and interaction events, which is transferred to Google's servers and processed to generate analytical reports that help us improve the Platform. Statistics cookies are used only after obtaining your consent;
• other third-party cookies – some cookies are set by third-party providers and do not load during an ordinary visit to the Platform – they appear only when you reach a specific flow that requires them, such as the payment flow (cookies set by our payment operator, Stripe, for fraud prevention and transaction security) or the sign-in flow (cookies set by Google Identity Services when you choose to sign in with your Google account, used for security and to manage the sign-in process). Depending on their specific purpose and duration, these cookies are either strictly necessary to complete the action you requested – and therefore exempt from consent – or used only after obtaining your consent. A detailed, up-to-date list of all cookies used on the Platform, including their provider, purpose, and duration, is available in the cookie settings.

You can change your cookie settings at any time via the cookie banner or through your browser settings.

Data Recipients

We may share your data with entities cooperating with us to the extent necessary to operate the Platform, in particular: hosting service providers, IT infrastructure providers, our accounting office, and our email delivery service provider (used solely for sending technical/transactional messages, such as account welcome emails or password reset links). Depending on the Tool selected by you, the Platform may also incorporate components and services provided by other third-party providers (e.g., providers of speech-to-text, text-to-speech, video generation, sign-in, or other supporting technologies). Where such providers are established within the European Economic Area, no transfer of data outside the EEA occurs in connection with their involvement.

Your data may, in some cases, be transferred to a third country (outside the European Economic Area), in particular to the following providers established in the United States: Deepgram, Inc.; LiveKit, Inc.; Eleven Labs Inc. (for voice data of users located in the EEA, Eleven Labs Poland sp. z o.o. acts as a separate, independent controller); HeyGen Technology Inc.; Pipedream, Inc.; and Together (US) Inc. Depending on the specific provider, the legal basis for such a transfer is either: (a) the European Commission's adequacy decision of 10 July 2023, confirming an adequate level of data protection under the EU–U.S. Data Privacy Framework (DPF), where the provider is a certified participant in the DPF program; or (b) standard contractual clauses (SCCs) approved by the European Commission. In certain cases, your data may also be transferred to further sub-processors of these providers, which may involve an additional transfer outside the EEA, on the same bases described above.

To enable payment on the Platform, for which purpose we transfer your payment-related data to the payment operator, Stripe Payments Europe, Limited (in this case we process data on the basis of Article 6(1)(b) GDPR, as this processing is necessary for the performance of the contract concluded with you). This does not apply to Standard Users, who do not have access to payment functions on the Platform. Please note that, with respect to the data transferred to it, the payment operator acts as a separate, independent data controller – not as our processor. It processes such data for its own purposes, including executing the payment transaction and complying with its own legal obligations (e.g., under anti-money laundering regulations). Information on how the payment operator processes your data, including with respect to international data transfers, is available in its own privacy notice: Stripe Privacy Center.

Data Retention Period

The data retention period depends on the purpose of processing; it may also result from applicable law, where such law constitutes the basis for processing.

Data related to the contract fulfillment is stored for the duration of the contract, and thereafter for the period required by law (in particular tax law – as a general rule, 5 years from the end of the tax year). Data processed for the purpose of pursuing claims – until the expiry of the relevant limitation periods. Data processed on the basis of consent – until such consent is withdrawn.

Your Rights

You have the right to:

• access your data;
• rectify it;
• request its erasure;
• restrict its processing;
• transfer it (if the processing is based on a contract concluded with you or on your consent);
• object to its processing.

If processing is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Providing your data is voluntary; however, failure to provide it may prevent the performance of the contract or contact with you.

Right to Lodge a Complaint

If we do something wrong, please let us know. However, you always have the right to lodge a complaint with the supervisory authority – in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

Google account access (OAuth)

The Platform may offer optional integration with Google services. You can sign in with Google, and separately authorize an Operator to access your Google account using OAuth. These are two distinct and optional actions.

• Google Sign-In is used for authentication; we receive basic profile information, typically your email address and name.
• Operator authorization: if you explicitly connect Google, you may grant the Operator permissions to access Gmail and Google Calendar, including read and write scopes, to perform tasks you request (for example reading emails, drafting or sending emails, and creating or updating calendar events).
• We do not access Gmail or Calendar data unless you explicitly authorize the integration.
• You can revoke access at any time in your Google Account settings, and the integration will stop functioning.

Google API Services User Data Policy (Limited Use)

When you authorize Google access, we handle Google user data in accordance with Google's API Services User Data Policy, including the Limited Use requirements:

• Google user data is used only to provide or improve user-facing features explicitly requested by you.
• We do not sell Google user data.
• We do not use Google user data for advertising.
• We do not allow humans to read Google user data except as necessary for security, support, or compliance, and only with appropriate access controls.