Data Policy
How Sona8 handles data in its service. For customers, the data processing terms in their contract govern; the current Data Processing Agreement is at sona8.com/legal/dpa. This page summarizes it in plain language. Data about visitors to sona8.com is covered by the Privacy Policy.
Roles
Sona8 runs voice interviews on behalf of its customers, usually the employer of the people interviewed. The customer decides who is invited, what is asked and how long data is kept. Under the GDPR the customer is the controller and Sona8 is the processor.
What we process
Interview audio while an interview runs, transcripts and translations, interview answers, and the themes, statements and reports derived from them. For invitations and reminders, the participant's email address or phone number and, if the customer provides them, name, department, role and similar attributes. For the customer's own users, name, email, role and login records.
What we use it for
Customer data is used only to provide, secure and support the service for that customer, and where the law requires it. Sona8 does not use customer data to train, fine-tune or improve any AI model, and its AI providers are bound by terms that exclude training. Aggregated, de-identified usage statistics that never include interview content may be used to operate and improve the service.
Anonymity
Results are shown aggregated by theme. A minimum group size of five participants applies to every customer view, export and API response; below that, figures are withheld. Supporting statements are de-identified, and names, email addresses and phone numbers are removed from transcripts before any AI provider processes them.
Where data is hosted and who processes it
Customer data is hosted in the EU (Frankfurt, Germany). Some processing, including AI analysis, takes place with subprocessors in the United States under EU Standard Contractual Clauses or the EU-US Data Privacy Framework. The current list of subprocessors is at trust.sona8.com/subprocessors. Customers receive 30 days' notice before a subprocessor is added or replaced.
Security
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), including backups. Each customer's data is isolated at database level. Staff access is limited by role, protected by SSO and MFA, and logged. Sona8's SOC 2 Type II observation period runs from 1 November 2026 to 31 January 2027; the report is expected in the first quarter of 2027.
Retention and deletion
Sona8 does not store interview audio; the voice provider's copy is deleted when the interview closes, within 24 hours. Transcripts and results are kept for the retention period the customer sets in the service, otherwise for the subscription term. Invitation and reminder emails are kept for 90 days. After a contract ends, the customer can export its results for 30 days; Sona8 then deletes customer data within 30 days from live systems and within 90 days from backups, unless the law requires retention.
Your rights
If you took part in an interview, the organization that invited you is responsible for the processing and is your first contact for access, correction or deletion requests. Sona8 assists its customers with such requests. You can also write to privacy@sona8.com and Sona8 will forward your request to the responsible customer.
Contact
privacy@sona8.com. EU contact point: Sona8 Inc., c/o Madeleine Malmsten, Stargarder Straße 55, 10435 Berlin, Germany
Last updated: 3 November 2026