Legal

Privacy Policy

Effective date: July 7, 2026 · Last updated: August 1, 2026

Sona ("Sona", "we", "us") builds a personal digital twin: a private AI model of you, created by you, with your consent, under your control. Privacy is not a checkbox for us - it is the product. This policy explains what we collect, why, and the controls you always keep.

1. The short version

  • You own your twin and everything it is made of.
  • We never sell your data. We never show you ads. We are funded by subscriptions, not by your information.
  • You can export everything and permanently delete your twin at any time, in one tap.
  • Only you can create a twin of yourself. We do not build twins of other people without their own consent.
  • Everything your twin generates is labeled and cryptographically signed as AI output.

2. What we collect

Account data. Email address, name, password hash, subscription and billing status (payments are processed by our payment provider; we do not store full card numbers).

Capture data (the material of your twin). Only what you choose to provide: your answers in the onboarding interview, messages and documents you import, voice recordings you make, photos you add, and ongoing conversations with your twin. This is the most sensitive category we hold, and it is used for one purpose only: building and operating your twin.

Voice data. If you enable the voice twin, we process voice recordings to create and operate a synthetic clone of your voice. Voice data may qualify as biometric data in some jurisdictions; we process it only with your explicit consent and only for your twin.

Usage data. Basic product analytics (features used, session length, device type), collected in privacy-preserving form. We do not track you across other sites or apps.

3. What we use it for

  • Creating, operating and improving your twin (the core service).
  • Measuring twin fidelity (for example, blind-test results you choose to run).
  • Service communications: onboarding, security notices, billing.
  • Safety and abuse prevention (for example, preventing impersonation of others).
  • Legal compliance.

What we do not do: we do not sell or rent personal data; we do not use your capture data to advertise to you; we do not use your personal data to train shared or general-purpose models. Your data trains your twin, full stop.

4. Who processes your data on our behalf

To operate Sona we use a small number of vetted processors under data-processing agreements: cloud hosting and storage, voice-synthesis providers, transcription providers, payment and analytics providers. A current list of subprocessors is available at https://sona.example/subprocessors. Where a processor handles capture data, data is encrypted in transit, minimized where possible, and never authorized for the processor's own training or advertising purposes.

5. Security

  • Encryption in transit and at rest for all personal data.
  • Sona Vault: our long-term storage layer is designed around post-quantum cryptography standardized by NIST (ML-KEM for key exchange, ML-DSA for signatures), because a twin is meant to be safe for decades, not quarters.
  • Access controls, audit logging, and strict internal least-privilege access to capture data.
  • All twin output is cryptographically signed ("Signed Persona") so it can always be identified as AI-generated.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by law.

6. Retention and deletion

Your capture data and twin are retained for as long as your account is active or as your plan provides. You can:

  • Export everything in a portable format, free, at any time.
  • Delete your twin and all associated capture data permanently, at any time, in one tap ("Kill Switch"). Deletion is irreversible and propagates to our processors and backups within 30 days.

If your account is inactive for 24 months on a free plan, we will contact you before any deletion occurs.

7. Your rights

Depending on your location, you have the right to access, correct, export, delete, and restrict or object to the processing of your personal data, and the right to withdraw consent at any time. See our GDPR Statement for the full description of rights in the EU/EEA and UK. To exercise any right: privacy@sonatwin.com - or simply use the in-product controls, which cover the most important rights directly.

8. Children

Sona is for adults. You must be 18 or older to create a twin. We do not knowingly collect data from minors; if we learn we have, we delete it.

9. International transfers

Where personal data is transferred across borders (for example, to cloud infrastructure providers), we rely on appropriate safeguards such as the EU Standard Contractual Clauses and equivalent mechanisms.

10. Changes and contact

We will notify you of material changes to this policy before they take effect. Questions and requests: privacy@sonatwin.com. Controller: Sona Technologies, Inc., 548 Market Street, PMB 62828, San Francisco, CA 94105, United States.