Privacy Policy

1. Who we are, and what this covers

"Sonela", "we" and "us" mean the operator of the Sonela service. This policy covers this website, the dashboard at app.sonela.ai, and the assistant our customers embed in their own applications. It sits alongside the terms of service, which govern the service itself.

Sonela is operated from Albania and has no paid subscriptions yet. The full company registration details — legal entity name, registration number and registered address — are published on this page before the service accepts payment.

Privacy questions, and any request under section 10, go to hello@sonela.ai. A person reads it.

2. The two roles we play

We are the controller for the people who use Sonela directly: whoever opens a workspace and anyone they invite into it. That covers account details, billing records, messages you send us and our server logs — everything in section 3 that is about you rather than about your business.

We are a processor for the personal data that lives in your own systems and reaches the assistant while it answers a question, for the written material you upload to ground it, and for the words in an answer someone reported to you, or in a conversation someone handed to your people. You are the controller of that data and we act on your instructions, as section 5 of the terms sets out. The relationship is written up in the data processing agreement, which forms part of the terms once you are on a paid plan.

If you are an end user of a customer's application rather than a Sonela customer yourself, that customer decides what happens to your data and your request goes to them. When they ask us to act on it, we act.

3. What we collect

Account details. Your email address, a display name if you give one, and your password stored only as a hash. We also record when the account was created and which workspace it belongs to.
Sign-in and security records. Your two-factor settings, and a short label for each browser you allow to skip the second factor. We write that label ourselves from what the browser reports; the raw header is not kept. We also keep the time and the way (password, Google, two-factor code, remembered device or registration) of your account's last two sign-ins, and show you the earlier one on your home page.
Workspace configuration. The workspace name, the plan it is on, the schema you approved, the business context you wrote, the test questions you save to check its answers, and the written material you upload, or sync from Google Drive (Google Docs, Word and Excel files you share with us), or from SharePoint and OneDrive for work or school (Word and Excel files your own Microsoft app may read), or have read from the public Facebook pages and Instagram profiles you add, to ground the assistant. An AI provider key you supply is encrypted at rest and decrypted only in memory to serve a request; no API we expose returns it.
Database sign-in details, on a direct connection only. If you connect your database directly instead of running the gateway, we hold what your database expects at sign-in, encrypted with AES-256-GCM and bound to your workspace and that data source; no API we expose returns it, and deleting the data source or the workspace removes it. If you run the gateway, this category does not exist: what it needs stays inside your network and is not sent to us.
A Google service-account key, if you sync Google Docs. We hold its private key encrypted with AES-256-GCM and bound to your workspace; no API we expose returns it, and removing it, or the workspace, deletes it and every file synced with it. We use it only to read the files and folders you share with that service account. A file you delete or stop sharing in Google Drive is removed at the next hourly sync that reads everything you shared, and any file Google has not confirmed for seven days is removed even if no sync could reach it.
A certificate for your Microsoft app, if you sync SharePoint. We hold its private key encrypted with AES-256-GCM and bound to your workspace; no API we expose returns it, and removing the app, or the workspace, deletes it and every file synced with it. You upload only its public half to the app you registered in your own Microsoft 365, and we use it only to read the sites, folders and files you add. Word and Excel files you sync from SharePoint or OneDrive for work or school are kept the same way as uploads; a file you delete in SharePoint, or that your app may no longer read, is removed at the next hourly sync that reads everything you added, and any file SharePoint has not confirmed for seven days is removed even if no sync could reach it.
A Google Cloud key for reading scanned pages, if you upload one. We hold its private key the same way, encrypted with AES-256-GCM and bound to your workspace; no API we expose returns it, and removing it, or the workspace, deletes it. We use it only to have Google Cloud Vision read the scanned pages of a PDF you upload, and we record how many pages each upload sent, never their words.
Posts from social pages, if you add them. Posts from public Facebook pages and Instagram profiles you add are kept the same way, the latest ten from each: a scraping provider reads the page for us and is given its address and nothing else of yours. A post you delete from the page is removed within a week, at the page's next full reading, and a page no full reading has confirmed for fourteen days loses its posts. Comments, reactions and who wrote them are never read.
Products from a product feed, if you add one. Products from a product feed you add are kept the same way: each product’s name, description, price, availability, link, picture address, brand, product codes, categories and specifications, replaced whole at each reading and deleted with the feed or the workspace. Pictures load from your shop’s own address and are never copied, and the address of the page a visitor has open is used for that one question to find its product and to tell the assistant which page it is asked from, by its path and title and never its query string, then dropped.
Usage records. One row per question, holding counts, timings and token totals. There is no column in it for the text of a question, an answer, or the query behind either.
An answer someone reported. A person reading an answer can report it as incomplete, inaccurate, or both. We record that, and — only if they leave the ticked box as it is — that one question and that one answer. Unticking it reports the answer with no words at all. The business whose assistant gave the answer is the only one who can read them: we count reports per workspace and never see the text.
A conversation handed to a person. Where a business has switched it on, a person using its assistant can choose to carry on the conversation with that business's own people in the same chat, and the panel says what is kept before they choose. We then keep the conversation so far, each answer in it checked to be one the assistant gave, and every message written after it, with its time, the display name of whoever answers for the business, the language of the conversation, and a label for the person: the address they signed in with on a hosted page, the reference their organisation has in an application that signed them in, and otherwise only "Website visitor". The business whose assistant it is is the only one who can read it: we never see the text. Each member of that business's workspace gets one email saying someone is waiting, carrying none of the conversation's words.
Billing records. The plan you are on, and the customer and subscription references Paddle gives us. Card details are entered on Paddle's own checkout and are held by Paddle.
What you send us. The contact form takes an email address, a message, and one file if you choose to attach one. Anything you email us is the same.
Server logs. Every request on the web carries the caller's IP address, and each one appears in ordinary server logs alongside the time and the URL requested.

4. What we do not collect

Some of these are the reason to choose the product, so each one is scoped to the thing it describes rather than claimed broadly.

This website is static pages. It sets no cookies and loads nothing from anyone else's servers — the assistant in the corner comes from our own API. It keeps one flag in your browser, saying only that the Meet Sonela tour has already been offered to you, and it counts page views without recording anything about who made them — see section 11.
Questions and the rows that answer them pass through our service, and reach one AI provider — the one section 6 names for your plan's key — with the personal details we recognise, of the kinds section 9 sets out, replaced by placeholders. The words of a question are not written to our storage unless someone reports the answer and leaves the ticked box as it is, or hands the conversation to a person at the business, both of which section 3 sets out. So that a repeated question can be answered from memory, we may keep for up to seven days a hash of the question, a numerical representation of it, and the answer the assistant gave. Each question also carries the device's offset from UTC, so the assistant knows today's date where it was asked. That date goes to the AI provider with the question, and an answer remembered for it is forgotten at the end of that day.
In the assistant's panel, the transcript is held in the end user's browser for the length of the conversation. We keep no conversation unless the end user hands it to a person at the business, as section 3 sets out; a reported answer is one exchange out of one, and nothing either side of it. An end user may ask, from the assistant's panel, to have the conversation emailed to them; it then passes once through our mail provider, and we keep no copy. An end user may also share it from the panel to WhatsApp or another app they choose; it then goes from their device to that app, not through us.
Where a business has set up document templates, a signed-in end user may ask the assistant for one. The values it fills in are shown to them first and wait in our service's memory for up to half an hour for their confirmation; the finished document then passes once through our mail provider to the address they signed in with, and we keep no copy of it or of the values.
Our usage records store counts, timings and token totals — never the text of a question, an answer, or a query.
We do not train any model on your data, and we do not use it to improve the service for anyone else.
We do not sell personal data, we do not share it for advertising, and we build no profile of anyone who reads this site.
We do not ask for special category data — health, beliefs, biometrics — and no feature of the product needs any. Where your own data holds such information it stays yours, and you stay its controller.

5. Why we use it, and our lawful basis

To run the service for you — answering questions, holding your configuration, keeping your workspace working. Our contract with you.
To bill you and keep our books — our contract with you, and a legal obligation for the accounting records themselves.
To keep the service secure and stop abuse — quotas, rate limits and the server logs in section 3. Our legitimate interest in a service that stays up and is not misused, which we think you share.
To answer what you send us — our legitimate interest in replying, and steps taken at your request before any contract exists.
To send you email about your workspace — confirming your address, resetting a password, telling you a trial has ended. Our contract with you.
To meet a legal obligation where one applies to us.

Where we ever rely on your consent for something, you can withdraw it at any time, and withdrawing it does not make what happened before unlawful.

None of that involves deciding anything about you by automated means, and we do not profile you. The assistant composes answers with an AI model, but it is a tool you point at your own data to get an answer, not a judgement we make about a person: the decisions that follow are yours, which is what section 6 of the terms says at more length.

6. Who else handles it

We use a small number of providers to run the service, and each one receives only what its job needs.

Cloud hosting. This site, our API and the database behind it run on a commercial cloud platform.
Email delivery. An email provider sends the messages the product sends you, and the messages we send in reply to you.
Reading social pages. If you add a public Facebook page or Instagram profile, a web-scraping provider reads its latest public posts for us. It is given the page's address and nothing else of yours, and what it sends back is already public.
Reading scanned pages. When a PDF you upload as written material has pages that are pictures of pages, a scan or a photo, those pages, and no other page of the file, go to Google Cloud Vision, which reads their words off the picture and sends them back to be checked before anything is saved. Unless you uploaded a Google Cloud key of your own, this runs on our account with Google; with yours, it runs on your own Google Cloud project, under your own agreement with Google.
Payments. Paddle, acting as merchant of record. Your invoice comes from them, and what you pay with is entered on their checkout rather than ours.
The AI provider, which depends on whose key runs your plan. On a plan where you bring your own key, your questions, the rows that answer them and the written material you uploaded to ground the assistant all reach the provider you chose, under your own agreement with them, and no other, except that the scanned pages of a PDF are read by Google Cloud Vision first, as described above. On a plan where we supply the key, those same three reach one of the providers we contract with, under our agreement, on a model we pick — and trials always run this way. We hold accounts with more than one so that an outage at a provider does not take your assistant down with it: a question goes to a second one only when the first cannot answer it, and only that question. We never send your data to a second provider for any other reason, and nothing is copied between them. Files you sync from Google Drive, SharePoint or OneDrive travel exactly as uploaded written material does. Either way, the personal details we always mask, and those the business has chosen to mask, reach the provider as placeholders where we recognise them, as section 9 describes.
Professional advisers under a duty of confidence, and anyone a court or the law obliges us to tell.

Ask us and we will name the current provider in any of those categories. Once the data processing agreement in section 2 exists, it carries that list.

7. Where it goes

Sonela is operated from Albania, which is outside the EEA and the UK, and the providers in section 6 operate internationally. So personal data may be handled outside the country you are in.

That is two transfers rather than one, and they are covered separately. Personal data you give us directly — your account details, your workspace configuration, what you write to us — reaches us in Albania because that is where the service you signed up to is run from. For the personal data we handle on your behalf as a processor, the safeguard is the European Commission's standard contractual clauses, which the data processing agreement carries between you and us and which, like the registration details in section 1, is published before the service accepts payment.

Personal data reaching one of the providers in section 6 is covered by the safeguard in our agreement with that provider: the same standard contractual clauses, or that provider's own approved transfer mechanism. The data processing agreement sets this out provider by provider.

8. How long we keep it

Account and workspace configuration — for as long as the workspace exists. You may ask us to export your configuration or delete your workspace at any time by emailing hello@sonela.ai, and we will action it. Deleting a workspace removes its configuration and any key it held.
Usage counters — retained in aggregate for billing and accounting records, including after the workspace they came from is deleted.
An answer someone reported — 100 days from the report, then deleted by a nightly job. For those 100 days the business whose assistant gave the answer can read it; we count reports and never read them.
A conversation handed to a person — 30 days from the day it ends, then deleted by an hourly job. It ends when either side ends it, or when our service closes one nobody answered or nobody wrote in for a while. Until it is deleted the business it was handed to can read it; we never read it.
A paused trial workspace — if you do not choose a plan, we may delete it after 90 days, with notice first.
Messages sent through the contact form — stored with us while we answer you, then deleted automatically a fixed period after the request is closed, whether it was closed by an answer or by our giving up on delivering it. A file you attached does not survive the pipeline that forwards it, whether or not the forward succeeds; the privacy note on the terms page is the statement of record for what this website sends.
Emails waiting to be sent — the emails the product sends, such as address confirmations, password resets, sign-in codes and invitations for a hosted assistant, and notices about a trial, a quota or a workspace, wait in our database until our mail provider accepts them, so that a restart of our service does not lose them. Each holds the recipient's address and the subject as written, with the message itself sealed so it cannot be read where it is stored. It is deleted the moment it is sent; one the provider keeps refusing is given up after about a quarter of an hour, and its record deleted 24 hours later. An emailed conversation or document never waits there.
Server logs — kept on the rolling retention our hosting platform applies, for as long as they are useful in serving the site and looking into a security or abuse problem, and read for nothing else.
Billing and accounting records — for as long as tax and company law require them, which is longer than any of the above.

9. How we keep it safe

Everything travels over HTTPS, on this site and in the product.
Passwords are stored as hashes. A token that lets a browser skip your second factor is stored as a hash of itself and expires on a fixed date rather than being extended by use. You can turn two-factor sign-in on from your dashboard.
An AI provider key you supply is encrypted at rest and decrypted only in memory to serve a request.
Before the AI model that answers a question reads it, on your own key or on ours, the personal details we recognise are replaced with placeholders in the question, the conversation, the records that answer it and, outside a public assistant, the uploaded material it draws on. Card, bank and ID numbers, passwords and keys are replaced for every workspace, and the business chooses whether names, contact details (the part of an email address before the @, and phone numbers), addresses and company names are. The real values are put back before the answer is shown, unless the business chooses to show placeholders instead; card numbers, IBANs, passwords and keys stay out of the answer, which says one was removed. The pairing of each value and its placeholder is held in memory for that one answer, and a follow-up is masked again from a note sealed so that only we can open it, which the conversation carries and which expires after a day. We recognise values by their format, their column and the label beside them, so this is not a guarantee, and a value someone types that the business's own notes to the assistant, its templates or its public pages already show goes as typed. We can pause masking for every workspace in an emergency: the security brief says where it stops, including that a screenshot or a voice recording reaches its provider as it is.
Every question is bound on our server to the workspace that asked it, and the read-only validation described on the security brief runs before a query is executed. That page names the file behind each layer, so you can check it rather than take our word.

No system is perfect. If a breach affects your personal data we will tell you, and the relevant authority, where the law requires it — and we would rather tell you early than tidily.

10. Your rights

If you are in the UK or the EEA the law gives you the rights below over personal data we hold as controller. We honour them wherever you are, because running two standards is how one of them slips.

Access — a copy of the personal data we hold about you.
Rectification — correction of anything wrong or incomplete.
Erasure — deletion, where we have no overriding reason or legal duty to keep it.
Restriction — a pause on our use of it while something is disputed.
Portability — the data you gave us, in a machine-readable form, sent to you or to someone you name.
Objection — to any use we base on a legitimate interest, and at any time to direct marketing.
Complaint — to the data protection supervisory authority in your country, whether or not you raise it with us first.

Write to hello@sonela.ai and we will answer within one month, or tell you honestly that a request will take longer and why. There is no fee. We may ask you to confirm who you are before we hand over personal data, and we will not use that as a way to delay you.

11. Cookies

This website is static pages. It sets no cookies and loads nothing from anyone else's servers: the assistant in the corner comes from our own API, and is the only thing on the page that is not part of the page. The site keeps exactly one thing in your browser: one flag, set when you close, finish or decline the Meet Sonela tour, so the tour does not open by itself again. It holds nothing about you, is never sent anywhere, and clearing your browser's data for this site removes it. You can check that in your browser's developer tools, on this tab, right now.

The assistant sets nothing either. It asks our API once per page how it should appear here, and asks this site's own address for a short-lived signature that vouches for the page, once when the page loads and again before each conversation it starts; neither carries anything about you, and it stays silent until you open it. A conversation you start lives in that browser tab and is gone when you close it: no transcript is kept, and what is recorded is counts and timings, never your words. Before your question and the conversation so far reach the AI provider, the part of an email address before the @, phone numbers and ID numbers we recognise in them are replaced with placeholders — names are not, here — and card numbers and IBANs are removed, while a detail our own material for it already shows goes as you typed it; the values replaced stay with the conversation in that tab, sealed so that only our service can read them. If you report an answer here and leave the ticked box as it is, that one question and that one answer are sent to the business behind this assistant, which on this site is us, and deleted 100 days later. The privacy note on the terms page sets out what a question does when you send one.

It does count page views. Opening a page tells our own API which page was opened. The country it was opened from is worked out on our own server, from the request's address, in memory, against a database we hold — and the address is then discarded rather than stored; it is never sent to anyone else. It does not say who: there is no identifier in the request and nothing is kept that could recognise you on your next visit. What is kept is a running total per page, per country, per day — a number you are one of, with nothing in it that describes you. That is why there is nothing to consent to and no banner asked you. What else the site fetches — and the one request that carries anything you typed — is set out in the privacy note on the terms page.

The dashboard at app.sonela.ai has to keep you signed in, so while you are using it, it holds your session in your browser. That is strictly necessary for a service you asked for, and it is used for nothing else. The embedded assistant keeps a conversation in the page's own memory for as long as that page is open, and it ends when the page does.

12. Children

Sonela is a tool for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to hello@sonela.ai and we will delete it.

13. Changes to this policy

We may update this policy as the product changes. For a material change we will give at least 30 days' notice by email to the address on your account and update the version and date at the top of this page. Everything else — corrections, clearer wording — takes effect when the date changes.

14. Contact

Questions about this policy, a request under section 10, or a concern about how we handle personal data: hello@sonela.ai. We answer. If our answer does not satisfy you, you can take it to the data protection supervisory authority in your country.