Privacy Policy

1. Controller

The controller within the meaning of the GDPR for this website is: Sona8 Inc., a Delaware corporation, 1875 Mission St Ste 103 #813, San Francisco, CA 94103, USA. EU contact point: Sona8 Inc., c/o Madeleine Malmsten, Stargarder Straße 55, 10435 Berlin, Germany. Email: privacy@sona8.com. We prefer digital correspondence. Please contact us by email rather than by post.

2. Overview of Data Processing

Protecting your personal data is important to us. This privacy policy explains what personal data is collected when you use this website, for what purpose, and on what legal basis. This policy covers the sona8.com website and the demos on it. Personal data processed in the Sona8 service on behalf of our customers is governed by the Data Processing Agreement and summarized in our Data Policy.

3. Hosting

This website is built with Lovable and hosted on Lovable Cloud, a service provided by Lovable Labs AB, Box 190, 101 23 Stockholm, Sweden. Lovable Cloud uses Supabase as its underlying infrastructure provider for database, authentication, and storage services.

When you visit this website, data that is technically necessary to deliver the website to you is processed. This may include your IP address, browser type and version, operating system, referrer URL, pages visited, date and time of access, and the amount of data transferred.

The use of Lovable Cloud is based on Art. 6(1)(f) GDPR (legitimate interest in the reliable and efficient presentation of this website). A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

Lovable Cloud supports regional data hosting in the EU, US, and Australia. Customer data remains in the selected region and does not move across regions by default. If personal data is transferred to third countries, appropriate safeguards (e.g. EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR) are in place to ensure an adequate level of data protection.

For more information on Lovable's data handling, please refer to the Lovable Privacy Policy and the Lovable Data Processing Agreement.

4. Server Log Files

The hosting provider automatically collects and stores information in server log files that your browser transmits. This includes: the page accessed, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (previously visited page), and the IP address of the requesting device.

This data is not merged with other data sources. The collection of this data is based on Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of the website. Server log files are typically deleted automatically after a short retention period, unless longer retention is required for security or legal reasons.

5. Contact by Email

If you contact us by email, your details (email address, name if provided, and the content of your enquiry) will be stored for the purpose of processing your request and in case of follow-up questions. This data will not be shared without your consent. The processing of this data is based on Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry). Your data will be deleted once the purpose of storage no longer applies and no statutory retention obligations require continued storage.

6. Cookies

This website may use cookies. Cookies are small text files stored on your device. Some cookies are technically necessary for the website to function (essential cookies), while others may be used to analyse user behaviour (analytics cookies). Essential cookies are stored on the basis of Art. 6(1)(f) GDPR. Analytics cookies are only set with your consent pursuant to Art. 6(1)(a) GDPR and § 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz).

You can configure your browser to notify you when cookies are set, to allow cookies only on a case-by-case basis, to block cookies for certain cases or in general, and to enable automatic deletion of cookies when you close your browser. Disabling cookies may affect the functionality of this website.

7. Analytics and Third-Party Services

This website uses Snitcher, a website visitor identification service provided by Snitcher B.V., Netherlands. Snitcher processes technical data such as your IP address, pages viewed, referrer and browser information in order to identify the company a visit may originate from. The IP address is used for a company lookup and is not used to identify you as a private individual. Processing is based on our legitimate interest in understanding business interest in our services (Art. 6(1)(f) GDPR), and on your consent where cookies or similar technologies are used (Art. 6(1)(a) GDPR, § 25 TDDDG). You can object or withdraw consent at any time through the cookie settings on this site or by contacting privacy@sona8.com. More information: https://www.snitcher.com/privacy-policy.

We also use Leadfeeder (Dealfront) for company-level visit analysis and Vercel Analytics for aggregated, cookie-free usage statistics. Should further third-party services be added, this privacy policy will be updated accordingly.

This website also uses Contentsquare, a digital experience analytics service provided by Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France. Contentsquare records how visitors interact with pages, for example scrolling, clicks, mouse movement and page load behaviour, in pseudonymised form, so we can improve the usability of the site. Input fields are masked and not recorded. Processing is based on your consent (Art. 6(1)(a) GDPR, § 25 TDDDG), which you can withdraw at any time through the cookie settings on this site or by contacting privacy@sona8.com. More information: https://contentsquare.com/privacy-center/.

With your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG), this website uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It shows us which pages are visited, how visitors arrive and how they move through the site. Google Analytics sets cookies and processes usage data such as pages viewed, device and browser details and an approximate location; GA4 does not log or store full IP addresses. Google signals and advertising features are switched off. Data may be transferred to Google LLC in the United States on the basis of the EU-U.S. Data Privacy Framework, with standard contractual clauses as a fallback. Data is kept for 14 months. Google Analytics only loads after you accept in the cookie banner, and you can withdraw your consent at any time through "Cookie settings" at the bottom of every page.

Our product videos are hosted by Tella, a service of Tella HQ Inc., 2261 Market Street #4122, San Francisco, CA 94114, United States. Until you press play, each video is a still image from our own server and nothing is loaded from Tella. When you press play, Tella's player loads in your browser: your IP address, device and browser details and the page you watch from are sent to Tella, and Tella may set cookies or similar technologies. The legal basis is § 25(2) No. 2 TDDDG (access needed for a service you have explicitly requested) and Art. 6(1)(f) GDPR (our legitimate interest in showing the video you asked to watch). Tella stores data in the United States; transfers are based on standard contractual clauses (Art. 46(2)(c) GDPR). More information: https://tella.com/legal/privacy-policy.

To book a call, you can use the calendar on our profile and booking pages. It shows free times from Cal.com, a service of Cal.com, Inc., United States. When you book, your name, email address and the chosen time are sent to Cal.com to create the meeting and send the invitation. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract at your request). Data is transferred to the United States on the basis of standard contractual clauses.

8. Voice Demos

On some pages you can talk to one of our AI interviewers to try the product. A conversation only starts when you choose to start it and allow your browser to use your microphone. Your voice is then processed so the interviewer can understand you and reply. The voice agent is provided by ElevenLabs, which processes the audio on our behalf on servers in the United States. On the works council pages we also ask for your first name and company, which the interviewer uses to greet you. Processing is based on your consent (Art. 6(1)(a) GDPR). Taking part is voluntary, and you can end the conversation at any time. More information: https://elevenlabs.io/privacy-policy.

9. SMS Communications

If we text you, we use your mobile number only to communicate with you about Sona8. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. We do not share mobile numbers or SMS opt-in data with third parties or affiliates for marketing purposes.

10. SSL/TLS Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the lock icon in your browser bar. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

11. Your Rights as a Data Subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request information about the personal data processed about you.
• Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate data.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided no statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data.
• Right to data portability (Art. 20 GDPR): You may request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your data at any time if the processing is based on Art. 6(1)(f) GDPR.
• Right to withdraw consent (Art. 7(3) GDPR): You may withdraw any consent you have given at any time with effect for the future.

To exercise any of these rights, please contact us at privacy@sona8.com.

12. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is generally the one at your habitual residence, your place of work, or the place of the alleged infringement. For Berlin, this is: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Friedrichstr. 219, 10969 Berlin, Germany, www.datenschutz-berlin.de

13. Changes to This Privacy Policy

This privacy policy may be updated from time to time to reflect changes in data processing practices or legal requirements. The current version published on this website shall always apply.

Edits & Corrections. If you notice any errors or have suggestions for corrections on this website, please reach out directly to thilo[at]sona8.com.