Privacy Policy
Last updated: 15 July 2026
This policy applies to all users of sonneai.com, including visitors from the European Economic Area (EEA), the United Kingdom, and other jurisdictions. If you are located in the EEA or UK, the EU General Data Protection Regulation (GDPR) or UK GDPR applies to your personal data.
1. Data controller
The data controller responsible for your personal data is:
For all privacy requests and data subject rights, contact us at the email above. We respond within 30 days.
2. Data we collect and why (legal basis)
Under GDPR Art. 6, we must have a lawful basis for every processing activity. Here is what we collect and the specific legal basis for each:
Account data — name, email address
Legal basis: Art. 6(1)(b) — performance of the contract (account creation and service delivery)
Required to create and authenticate your account. Without it we cannot provide the service.
Interview answers and session data
Legal basis: Art. 6(1)(b) — performance of the contract
Your text answers are sent to our AI model to generate follow-up questions and produce your scorecard. Session metadata (module, language, score, timestamp) is stored to show your history.
CV / resume text (optional)
Legal basis: Art. 6(1)(a) — your explicit consent (you choose to upload and optionally save it)
Processed by our AI model to produce your CV diagnostic score. Stored against your account only if you click “Save to profile.” You can delete it at any time from Settings. Never shared with third parties for any other purpose. We do not use your CV to train AI models.
Payment data
Legal basis: Art. 6(1)(b) — performance of the contract
Handled entirely by Stripe. We receive only a customer ID and subscription status — never card numbers or full payment details.
Server logs — IP address, page visits, error events
Legal basis: Art. 6(1)(f) — legitimate interest (security, fraud prevention, debugging)
Standard infrastructure logs retained for up to 90 days. Used to detect abuse, enforce rate limits, and diagnose errors.
Analytics and advertising data (Google Analytics, Google Ads)
Legal basis: Art. 6(1)(a) — your consent via the cookie banner
Only collected if you accept analytics/advertising cookies. Includes page-view events, session data, and ad interaction data. You can withdraw consent at any time by clearing your cookie preference (refresh the page after clearing localStorage).
3. Automated processing and AI scoring
The following features involve fully automated processing that produces an assessment of you (relevant under GDPR Art. 22):
- CV Diagnostic — your CV text is analysed by an AI model (Claude by Anthropic) which assigns scores across 5 signals and generates written feedback. This assessment is not used for any employment decision by us — it is a practice tool for your own use.
- Interview scoring — your written answers during practice sessions are evaluated by the same AI model and assigned a numeric score and pass/fail verdict. Again, this is solely for your own practice feedback.
These assessments have no legal or similarly significant effect on you — they exist only to provide you with feedback. However, you have the right to request human review of any AI-generated assessment by emailing us. You also have the right to object to this processing under Art. 21 GDPR, in which case we cannot provide the core service features.
4. Sub-processors and international transfers
We share your personal data with the following sub-processors. Some are located outside the EEA; where that is the case, transfers are made under European Commission Standard Contractual Clauses (SCCs) or an applicable adequacy decision.
| Processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication | EU (AWS eu-west) | EEA — no transfer |
| Anthropic | AI model inference (CV scoring, interview Q&A) | USA | SCCs |
| Stripe | Payment processing | USA / EU | SCCs + adequacy |
| Vercel | Hosting and edge network | USA / global edge | SCCs |
| Analytics (GA4) and advertising (Google Ads) — consent only | USA | SCCs + consent | |
| E2B | Sandboxed code execution for coding exercises | USA | SCCs |
We do not sell personal data to any third party.
6. Your rights under GDPR
If you are in the EEA or UK, you have the following rights. We will respond within 30 days of receiving your request.
- Access (Art. 15) — request a copy of all personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate data. You can update your name and email directly in Settings.
- Erasure (Art. 17) — delete your account and all associated data. Go to Settings → Delete account, or email us. Data is purged within 30 days.
- Portability (Art. 20) — receive your interview history, session data, and CV diagnostic results in a machine-readable format (JSON). Email us to request an export.
- Restriction (Art. 18) — ask us to pause processing your data while a dispute is resolved.
- Objection (Art. 21) — object to processing based on legitimate interest (e.g. server logs). We will stop unless we have compelling grounds.
- Withdraw consent (Art. 7) — withdraw consent for CV storage or analytics cookies at any time without affecting prior processing.
- Lodge a complaint — you have the right to complain to your local supervisory authority. For France: CNIL (cnil.fr). For Germany: your state's Datenschutzbehörde. For the UK: ICO (ico.org.uk).
To exercise any right, email support@sonneai.com with the subject line “Data Subject Request.”
7. Data retention
- Account data — retained while your account is active. Purged within 30 days of account deletion.
- Interview session data — retained for 2 years so you can review your progress, then deleted.
- CV text — deleted immediately when you remove it from your profile, or within 30 days of account deletion.
- Server logs — 90 days.
- Analytics data — governed by Google's data retention settings (default 14 months in GA4).
8. Security
All data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed by Supabase Auth (bcrypt). We enforce row-level security on all database tables so users can only access their own data. Payment data never touches our servers — it is handled entirely within Stripe's PCI-DSS compliant environment.
9. Children
Sonne AI is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, email us and we will delete it promptly.
10. Changes to this policy
We will notify you of material changes by email at least 14 days before they take effect. The “last updated” date at the top of this page reflects the most recent revision. Continued use after the effective date constitutes acceptance.
11. Contact
For any privacy questions or data subject rights requests: support@sonneai.com. We aim to respond within 5 business days and will always respond within the 30-day GDPR deadline.