Privacy Policy

The controller responsible for data processing on this website and web application (sonic-flow.ai) is:

Sonic Flow GbR
Dorfstraße 5
82395 Söchering, Germany

Represented by:
Jasper Albrecht
Maxime Pschera

Email: info@testsonic.ai
Phone: +4367761781852

sonic-flow.ai is not only an informational website but a web application ("Sonic") that lets registered users ("account holders") send AI-moderated interview invitations ("dispatches") to other individuals ("recipients"). This means we process data both about account holders and about recipients who never create an account themselves.

We process personal data only where a legal basis under Article 6 GDPR applies — in particular:

• Your consent (Art. 6(1)(a) GDPR)
• Necessity for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)
• Compliance with a legal obligation (Art. 6(1)(c) GDPR)
• Our legitimate interests, such as the secure and reliable operation of this website (Art. 6(1)(f) GDPR)

Note on roles: When an account holder uses Sonic to interview a colleague or other third party, the account holder (or their employer) determines the purpose and means of that specific processing and acts as the data controller for the recipient's data. Sonic Flow GbR acts as processor on the account holder's behalf for this dispatch data, under a Data Processing Agreement that is part of our Terms of Service. For account and platform data described below (Sections 8 and 10), Sonic Flow GbR acts as controller.

This website and web application are hosted by:

Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States

When you visit this website, Vercel automatically processes technical data required to deliver the site to you (see Section 7). Vercel acts as our processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR.

International data transfer: As Vercel Inc. is based in the United States, your data may be processed outside the European Economic Area (EEA). This transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where applicable, the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technically error-free and secure provision of our website), or Art. 28 GDPR processing on behalf of our customers where applicable.

We use a third-party email delivery provider to send transactional emails — including account-related emails (e.g., sign-up confirmation, login) and dispatch invitation emails sent to recipients on behalf of account holders.

This provider processes the relevant email address, the email content, and delivery metadata (e.g., delivery/open status) to deliver these emails. It acts as our processor under a Data Processing Addendum in accordance with Art. 28 GDPR.

International data transfer: Our email delivery provider may process data in the United States. Where applicable, this transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The current provider is listed in our sub-processor list at sonic-flow.ai/subprocessors.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract with the account holder) and, for recipients, Art. 6(1)(f) GDPR (legitimate interest of the account holder/their employer in reaching out) or Art. 28 GDPR (processing on the controller's instructions).

We use Supabase to store our production data, including account data, dispatch records, and interview transcripts. Our Supabase project is hosted on AWS in Frankfurt, Germany (eu-central-1), i.e., within the European Union. Supabase acts as our processor under a Data Processing Agreement in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 28 GDPR (processing on behalf of our customers where applicable).

To conduct the AI-moderated interview conversations described in Section 9, we use third-party providers of AI language models and transcription services, in particular:

• a provider of conversational AI language models — generates the AI agent's conversational responses during an interview
• a provider of speech-to-text transcription services — transcribes voice input, where a recipient chooses to respond by voice

These providers act as our processors under their respective standard Data Processing Addenda (Art. 28 GDPR), incorporating EU Standard Contractual Clauses for transfers to the United States where applicable. Under our agreements with these providers, they are contractually restricted from using API inputs or outputs to train their models. We may engage additional or alternative providers of these services over time, each under an equivalent Art. 28 GDPR DPA.

The current provider is listed in our sub-processor list at sonic-flow.ai/subprocessors.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the account holder/employer in conducting the interview) or another basis established by the account holder, as applicable; Art. 28 GDPR governs our own role as processor.

Each time you access this website, technical information is automatically collected and temporarily stored in log files. This typically includes:

• IP address (anonymized or shortened where technically possible)
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL (the page you came from)
• Requested file/page

This data is not merged with other data sources and is used solely to ensure a smooth connection, system security, and technical administration. Log data is automatically deleted after a short period, typically within a few days to weeks, unless retention is required for security purposes (e.g., investigating an attack).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the stability and security of our website).

Anyone can create a Sonic account — no separate enterprise agreement is required. When you register, we process:

• Name
• Email address
• Authentication data (e.g., hashed password or login credentials)
• Usage data related to your account (e.g., dispatches created, login timestamps)

This data is used to provide the service, secure your account, and communicate with you about your account.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract you enter into by creating an account). By creating an account, you also agree to our Terms of Service, which include the Data Processing Agreement (Art. 28 GDPR) governing how we process data about the recipients you invite (see Section 9).

Sonic lets account holders send an interview invitation to a recipient by entering the recipient's email address and a topic or question. An AI agent (see Section 6) then conducts an email-based, AI-moderated conversation with the recipient to gather their input, including transcribing voice responses where applicable.

This involves processing, on behalf of the account holder:

• The recipient's email address
• The content of the recipient's responses (text and, where applicable, transcribed voice) and the resulting conversation
• Any summaries, quotes, or insights generated from that conversation

If you are a recipient: the account holder who invited you (or their employer) determines why you were contacted and what your responses are used for. Sonic Flow GbR processes your data only on their instructions, as their processor. For questions about the purpose of your interview or to exercise your data subject rights, please contact the account holder or organization that invited you directly, or contact us at the details in Section 1 and we will route your request accordingly.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the account holder/employer in gathering feedback) or another basis established by the account holder, as applicable; Art. 28 GDPR governs our own role as processor.

Retention: dispatch and conversation data is retained for as long as the account holder's account is active, or as otherwise instructed by the account holder, unless a shorter period is required by applicable law.

We use technically necessary cookies required for the basic functioning of the platform, in particular to keep you logged in and to maintain your session securely. These necessary cookies do not require consent under Art. 6(1)(f) GDPR and Section 25(2) TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), as they are essential to deliver the service you requested.

We currently do not use analytics, marketing, or tracking cookies. Should this change, this policy will be updated accordingly, and — where legally required — your consent will be obtained beforehand via a cookie banner.

If you contact us directly by email or phone, the personal data you provide (e.g., name, email address, message content) will be processed solely to handle your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract performance) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries directed to us), as applicable.

We do not store this correspondence longer than necessary to process your request, unless a longer retention is legally required (e.g., under German commercial or tax law).

We use technical and organizational security measures, including TLS/SSL encryption, to protect the data transmitted through this website against unauthorized access, loss, or manipulation. You can recognize an encrypted connection by the "https://" prefix and the lock icon in your browser's address bar.

Under the GDPR, you have the right to:

• Access (Art. 15 GDPR) — request confirmation of and access to the personal data we hold about you
• Rectification (Art. 16 GDPR) — request correction of inaccurate data
• Erasure (Art. 17 GDPR) — request deletion of your data, subject to legal retention obligations
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR), in particular where processing is based on legitimate interest
• Withdraw consent (Art. 7(3) GDPR) at any time, with effect for the future, where processing is based on consent

If you are a dispatch recipient, some of these rights may need to be directed to the account holder or organization that invited you, as they act as controller for that processing (see Section 9).

To exercise any of these rights, contact us using the details in Section 1.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin, Germany

We may update this privacy policy from time to time to reflect changes in our data processing practices or legal requirements. The current version, as published on this page, always applies.