Legal
GDPR, UK GDPR & CCPA Statement
Effective date: July 7, 2026 · Last updated: August 1, 2026
This statement supplements our Privacy Policy for users in the European Economic Area, the United Kingdom, and California, and describes how Sona complies with the General Data Protection Regulation (GDPR) and, for California residents, the CCPA/CPRA.
1. Controller
Sona Technologies, Inc., 548 Market Street, PMB 62828, San Francisco, CA 94105, United States is the controller of your personal data. Contact for all data-protection matters: privacy@sonatwin.com. Our EU representative under Art. 27 GDPR: Sona EU Representative Services Ltd., 32 Fitzwilliam Square, Dublin 2, D02 R744, Ireland - eu-rep@sonatwin.com.
2. What we process and why (legal bases)
| Processing | Data | Legal basis (Art. 6) |
|---|---|---|
| Account and billing | email, name, subscription status | contract (6(1)(b)) |
| Building and operating your twin | interview answers, imported content, conversations | contract (6(1)(b)) and consent (6(1)(a)) |
| Voice twin (voice cloning) | voice recordings, synthetic voice model | explicit consent (Art. 9(2)(a)) - voice data may constitute biometric data |
| Product analytics | usage events, device info | legitimate interest (6(1)(f)), privacy-preserving configuration |
| Security and abuse prevention | logs, signatures of twin output | legitimate interest (6(1)(f)) |
| Legal obligations | billing records, requests | legal obligation (6(1)(c)) |
We do not process personal data for advertising, and we do not sell personal data. Where processing is based on consent, you can withdraw it at any time with effect for the future - directly in the product.
3. Your rights
Under the GDPR you have the right to:
- Access (Art. 15) - obtain a copy of your personal data;
- Rectification (Art. 16) - correct inaccurate data (your twin has built-in tools to correct facts about you);
- Erasure (Art. 17) - the in-product Kill Switch deletes your twin and all capture data permanently;
- Portability (Art. 20) - one-tap export in a machine-readable format;
- Restriction (Art. 18) and objection (Art. 21);
- Withdraw consent (Art. 7(3)) at any time;
- Not to be subject to solely automated decisions with legal effect (Art. 22) - Sona's twin acts only within the mandate you configure, asks before acting, and every action is logged and reversible by you.
We respond to requests within one month. Exercising rights is free. To exercise them: in-product controls or privacy@sonatwin.com. You also have the right to lodge a complaint with your supervisory authority (for Ireland: the Data Protection Commission, www.dataprotection.ie).
4. International transfers
Where data is processed outside the EEA/UK (e.g., cloud hosting, infrastructure providers), we use the European Commission's Standard Contractual Clauses, the UK Addendum/IDTA, and, where applicable, adequacy decisions such as the EU-US Data Privacy Framework. A list of subprocessors and transfer mechanisms is available at https://sonatwin.com/subprocessors.
5. Retention
Capture data and twin models: for the life of your account or plan. Deleted within 30 days of account deletion, including from backups. Billing records: as required by tax law. Analytics: 12-24 months in aggregated or pseudonymized form.
6. Data protection by design
Sona applies data minimization (you choose what your twin learns), purpose limitation (your data serves only your twin), encryption in transit and at rest, post-quantum encryption for long-term storage (NIST ML-KEM, ML-DSA, and SLH-DSA), least-privilege internal access, and records of processing under Art. 30. A Data Processing Agreement is available for business customers at https://sonatwin.com/dpa.
7. EU AI Act
Sona's approach to AI transparency, labeling and human oversight is described in our AI Transparency Statement.
8. California Consumer Privacy Act (CCPA/CPRA)
For California residents, this section supplements our Privacy Policy and describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).
- Right to know what personal information we collect, use, and disclose, and the sources and purposes - described in full in our Privacy Policy.
- Right to delete - the in-product Kill Switch permanently deletes your twin and all capture data on request.
- Right to correct inaccurate personal information, directly through your twin's built-in correction tools.
- Right to opt out of sale or sharing - we do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of, and this will not change without notice.
- Right to limit use of sensitive personal information - we do not use sensitive personal information, including voice and biometric data, for any purpose beyond building and operating your twin.
- Right to non-discrimination - we will not deny goods or services, charge different prices, or provide a different level of service because you exercised a CCPA right.
To exercise any of these rights, use the in-product controls or contact privacy@sonatwin.com. We verify requests using your account credentials and respond within 45 days, as required by law. You may designate an authorized agent to submit a request on your behalf. We do not knowingly sell or share the personal information of consumers under 16 years of age.