Legal
GDPR & UK GDPR Statement
Effective date: July 7, 2026 · Last updated: August 1, 2026
This statement supplements our Privacy Policy for users in the European Economic Area and the United Kingdom and describes how Sona complies with the General Data Protection Regulation (GDPR).
1. Controller
Sona Technologies, Inc., 548 Market Street, PMB 62828, San Francisco, CA 94105, United States is the controller of your personal data. Contact for all data-protection matters: privacy@sonatwin.com. Our EU representative under Art. 27 GDPR: Sona EU Representative Services Ltd., 32 Fitzwilliam Square, Dublin 2, D02 R744, Ireland - eu-rep@sonatwin.com.
2. What we process and why (legal bases)
| Processing | Data | Legal basis (Art. 6) |
|---|---|---|
| Account and billing | email, name, subscription status | contract (6(1)(b)) |
| Building and operating your twin | interview answers, imported content, conversations | contract (6(1)(b)) and consent (6(1)(a)) |
| Voice twin (voice cloning) | voice recordings, synthetic voice model | explicit consent (Art. 9(2)(a)) - voice data may constitute biometric data |
| Product analytics | usage events, device info | legitimate interest (6(1)(f)), privacy-preserving configuration |
| Security and abuse prevention | logs, signatures of twin output | legitimate interest (6(1)(f)) |
| Legal obligations | billing records, requests | legal obligation (6(1)(c)) |
We do not process personal data for advertising, and we do not sell personal data. Where processing is based on consent, you can withdraw it at any time with effect for the future - directly in the product.
3. Your rights
Under the GDPR you have the right to:
- Access (Art. 15) - obtain a copy of your personal data;
- Rectification (Art. 16) - correct inaccurate data (your twin has built-in tools to correct facts about you);
- Erasure (Art. 17) - the in-product Kill Switch deletes your twin and all capture data permanently;
- Portability (Art. 20) - one-tap export in a machine-readable format;
- Restriction (Art. 18) and objection (Art. 21);
- Withdraw consent (Art. 7(3)) at any time;
- Not to be subject to solely automated decisions with legal effect (Art. 22) - Sona's twin acts only within the mandate you configure, asks before acting, and every action is logged and reversible by you.
We respond to requests within one month. Exercising rights is free. To exercise them: in-product controls or privacy@sonatwin.com. You also have the right to lodge a complaint with your supervisory authority (for Ireland: the Data Protection Commission, www.dataprotection.ie).
4. International transfers
Where data is processed outside the EEA/UK (e.g., cloud hosting, infrastructure providers), we use the European Commission's Standard Contractual Clauses, the UK Addendum/IDTA, and, where applicable, adequacy decisions such as the EU-US Data Privacy Framework. A list of subprocessors and transfer mechanisms is available at https://sona.example/subprocessors.
5. Retention
Capture data and twin models: for the life of your account or plan; deleted within 30 days of account deletion, including from backups. Billing records: as required by tax law. Analytics: 12-24 months in aggregated or pseudonymized form.
6. Data protection by design
Sona applies data minimization (you choose what your twin learns), purpose limitation (your data serves only your twin), encryption in transit and at rest, post-quantum encryption for long-term storage (NIST ML-KEM/ML-DSA), least-privilege internal access, and records of processing under Art. 30. A Data Processing Agreement is available for business customers at https://sona.example/dpa.
7. EU AI Act
Sona's approach to AI transparency, labeling and human oversight is described in our AI Transparency Statement.