Back to Home

Terms of Service

Last updated: September 14, 2026

1. Scope and Provider

These Terms of Service ("Terms") govern the use of the web application "Sonic" provided at sonic-flow.ai (the "Service") by:

Sonic Flow GbR
Dorfstraße 5
82395 Söchering, Germany
(Jasper Albrecht, Maxime Pschera)
Email: info@testsonic.ai
("we", "us", "Sonic Flow")

These Terms apply to any person who creates an account ("account holder", "you"). By creating an account, you accept these Terms, including the Data Processing Agreement in Annex 1.

2. Description of the Service

Sonic lets an account holder send an AI-moderated interview invitation ("dispatch") by email to a person they choose ("recipient"). An AI agent then conducts a text- and/or voice-based conversation with the recipient to gather their input on a topic defined by the account holder. Results are made available to the account holder within the platform.

3. Registration and Eligibility

  • The Service is intended for use in the course of a trade, business, or profession (§ 14 BGB). By creating an account, you confirm that you are acting in that capacity, and not as a consumer (§ 13 BGB). No separate enterprise agreement is otherwise required to use the Service.
  • You must provide accurate registration information and keep your login credentials confidential.
  • You must be legally capable of entering into a binding contract. If you are using Sonic on behalf of an employer or other organization, you confirm that you are authorized to do so and that these Terms (including Annex 1) also bind that organization where relevant.

4. Your Obligations When Using the Dispatch Feature

When you send a dispatch to a recipient, you, and not Sonic Flow, determine why that person is contacted and what happens with their responses. You act as the data controller for that processing (see Section 9 of our Privacy Policy and Annex 1). By using the dispatch feature, you confirm that you:

  • have a valid legal basis under applicable data protection law (e.g., GDPR) to have the recipient contacted and their responses processed for your stated purpose;
  • will not use Sonic to contact recipients for unlawful purposes, harassment, spam, or unsolicited marketing;
  • will, where required by law, inform recipients about the purpose of the interview and their data protection rights (a short default notice is included in our dispatch emails, which you may not remove);
  • are responsible for the accuracy and lawfulness of the topics, questions, and instructions you provide to the AI agent.

We reserve the right to suspend or terminate accounts used in violation of this Section.

5. Pricing

The Service is currently provided free of charge. We may introduce paid plans or usage limits in the future. If we do, we will give existing account holders reasonable advance notice, and continued use of any then-chargeable features will require your prior agreement to the applicable pricing.

6. Availability

We aim to provide a reliable Service but do not guarantee uninterrupted availability. As an early-stage product, the Service may be changed, extended, restricted, or temporarily unavailable, in particular for maintenance or further development.

7. Intellectual Property

The Service, including its software, design, and branding, is owned by Sonic Flow GbR or its licensors and protected by applicable intellectual property laws. You are granted a limited, non-exclusive, non-transferable right to use the Service in accordance with these Terms. Content you submit (e.g., dispatch topics, questions) remains yours; you grant us the right to process it as necessary to provide the Service.

8. Liability

Subject to mandatory statutory liability (in particular for intent, gross negligence, injury to life, body, or health, and under the Product Liability Act), our liability for ordinary negligence is limited to the breach of a material contractual obligation (an obligation whose fulfillment is essential to the proper performance of the contract and on which you may regularly rely), and in that case liability is limited to the foreseeable damage typical for this type of contract.

As the Service is currently provided free of charge, this limitation applies to the fullest extent permitted by law for gratuitous services.

9. Term and Termination

You may stop using the Service and delete your account at any time. We may terminate or suspend an account with reasonable notice, or without notice for a material breach of these Terms (e.g., unlawful use under Section 4). Upon termination, Annex 1 (Data Processing Agreement) continues to apply until all personal data processed on your behalf has been deleted or returned in accordance with its terms.

10. Data Protection

Our handling of personal data is described in our Privacy Policy. Where we process personal data of recipients on your instructions as described in Section 4, the Data Processing Agreement in Annex 1 forms an integral part of these Terms and governs that processing.

11. Changes to These Terms

We may update these Terms to reflect changes to the Service or legal requirements. We will notify account holders of material changes in advance (e.g., by email or in-app notice). Continued use of the Service after such changes take effect constitutes acceptance, provided you were given a reasonable opportunity to object or discontinue use beforehand.

12. Governing Law and Jurisdiction

These Terms are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods. For business users (merchants within the meaning of the German Commercial Code), the place of jurisdiction is Berlin, Germany.

13. Severability

If any provision of these Terms is or becomes invalid, the validity of the remaining provisions is unaffected.

14. Contact

Sonic Flow GbR — info@testsonic.ai

Annex 1 — Data Processing Agreement (Art. 28 GDPR)

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service between the account holder ("Controller") and Sonic Flow GbR ("Processor") and applies whenever the Processor processes personal data of recipients on the Controller's behalf via the dispatch feature described in Section 4 of the Terms.

A1.1 Subject Matter and Duration

The Processor processes personal data on behalf of the Controller for the duration of the Controller's use of the Service, i.e., for as long as the Controller's account remains active, unless otherwise agreed or required by law.

A1.2 Nature and Purpose of Processing

The Processor processes personal data to operate the dispatch and AI-moderated interview feature: sending an invitation to the recipient, conducting a text- and/or voice-based conversation via the AI agent, transcribing voice input where used, and generating summaries or insights for the Controller.

A1.3 Type of Data and Categories of Data Subjects

  • Categories of data subjects: Recipients invited by the Controller (e.g., the Controller's colleagues, employees, or contacts).
  • Types of data: Recipient's email address; content of the recipient's responses (text and transcribed voice); metadata about the dispatch and conversation (timestamps, delivery/read status); AI-generated summaries or quotes derived from the conversation.

A1.4 Obligations of the Processor

The Processor shall:

  • process personal data only on the Controller's documented instructions, as reflected in the Controller's use of the Service's features, unless required otherwise by EU or member state law;
  • ensure that persons authorized to process the data are bound by confidentiality;
  • implement appropriate technical and organizational measures (Art. 32 GDPR) as summarized in Annex 2;
  • taking into account the nature of the processing, assist the Controller, insofar as reasonably possible, with fulfilling data subject requests under Chapter III GDPR;
  • assist the Controller in ensuring compliance with Art. 32–36 GDPR, taking into account the nature of processing and information available to the Processor;
  • notify the Controller without undue delay after becoming aware of a personal data breach concerning the processed data;
  • at the Controller's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless EU or member state law requires storage;
  • make available to the Controller information reasonably necessary to demonstrate compliance with this Annex, upon the Controller's reasonable request.

A1.5 Sub-Processors

The Controller authorizes the Processor to engage the sub-processors listed at sonic-flow.ai/subprocessors, which the Processor maintains as the current and authoritative list, including, for each sub-processor, its purpose, processing location, and (where applicable) transfer mechanism.

For sub-processors located outside the EEA, the transfer is governed by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) concluded between the Processor (or the sub-processor directly) and the relevant sub-processor, as indicated on the list.

The Processor will inform the Controller of any intended addition or replacement of sub-processors, giving the Controller the opportunity to object on reasonable data-protection grounds within a reasonable period. If the Controller objects and the parties cannot resolve the objection, either party may terminate the affected part of the Service.

A1.6 Technical and Organizational Measures

A summary of the technical and organizational measures implemented by the Processor and its sub-processors is set out in Annex 2.

A1.7 Liability

Liability under this Annex follows Section 8 of the Terms of Service and applicable law, in particular Art. 82 GDPR.

A1.8 Term

This Annex applies for as long as the Processor processes personal data on the Controller's behalf under the Terms of Service and terminates upon complete deletion or return of such data in accordance with Section A1.4.

Annex 2 — Technical and Organizational Measures (Art. 32 GDPR)

The Processor implements technical and organizational measures appropriate to the risk associated with the processing, including in particular:

  • Encryption in transit (TLS/HTTPS) for connections to the Service and between the Service and its sub-processors
  • Encryption at rest for data stored in the production database
  • Production data stored within the EU
  • Authentication-based access control to account and dispatch data; no public access to production data
  • Restricted access to underlying infrastructure, limited to authorized personnel

These measures are reviewed and developed on an ongoing basis in line with the state of the art, the cost of implementation, and the nature, scope, and risk of the processing. Further detail is available to the Controller on reasonable request.