Privacy Policy

Effective date: 2026-09-12 | Last updated: 2026-09-12

1. Data Controller

SonjaAI ("we", "us", "our") is the data controller for your personal data. If you have questions about this policy, contact contact@sonjaai.com.

2. Data We Collect

We only collect the minimum data necessary to provide the service:

• Account information: email address, account creation date, subscription status
• Service data: website URLs you provide, diagnostic reports, content generation history
• Technical data: IP address, device information, log files

3. How We Use Your Data

We process your personal data only when necessary for:

• Delivering audit reports and subscription services
• Account management and security verification
• Service improvement and troubleshooting
• Legal compliance obligations

4. Legal Basis (GDPR)

For EU data subjects, our processing is based on the following GDPR lawful bases:

• Contract performance: processing account and diagnostic data to deliver subscribed services
• Legitimate interests: service security, fraud prevention, service improvement
• Legal obligation: tax, accounting, and compliance requirements

5. Third-Party Processors

We only share data with GDPR-compliant service providers when necessary:

• Cloudflare: CDN and security services (DPA in effect)
• Postly: social media publishing service (DPA in effect, when publishing features are used)
• Resend: email delivery service

All third-party processors are bound by DPA and prohibited from using data for purposes other than service delivery.

6. International Transfers

Our service infrastructure may involve data transfers outside the EU. Such transfers are based on appropriate legal safeguards, including EU Standard Contractual Clauses (SCCs) and Data Privacy Framework (DPF). Data may be routed and processed globally, including in the United States.

7. Data Retention

We retain your data only for as long as necessary to provide the service. Upon account deletion, we will erase or anonymize your personal data within 60 days, except where legal retention requirements apply.

8. Your Rights

Under GDPR, you have the following rights:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your personal data
• Portability: receive your data in a structured format
• Restriction: request limitation of certain processing activities

To exercise these rights, contact contact@sonjaai.com. We will respond within 30 days.

9. Security Measures

We implement appropriate technical and organizational measures to protect your data, including encrypted transmission, access controls, security audits, and employee training. In the event of a data breach, we will notify regulators and affected users within 72 hours as required by GDPR.

10. Cookies

We use necessary cookies for session management and security verification. We do not use cookies for cross-site tracking or advertising.

11. Children's Privacy

Our service is designed for business users, not children under 13. If we discover we have collected personal data from a minor, we will delete it immediately.

12. Policy Changes

We may update this policy from time to time. Material changes will be communicated via in-service notification or email. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this privacy policy, contact contact@sonjaai.com.