Legal

Privacy Policy

Last updated: 23 March 2026

Sonaverse Ltd · Sonaverse Platform

Last Updated: 3 June 2026 Effective Date: 23 March 2026

This Privacy Policy describes how Sonaverse Ltd collects, uses, shares, and protects your personal data when you use the Sonaverse platform. Please read it carefully. By using our Services you confirm that you have read and understood this Policy. Capitalised terms used but not defined here have the meanings given in our Terms of Service.

Sonaverse Ltd · 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ · Company No. 17108925 · privacy@sonaverse.ai · www.sonaverse.ai/privacy

1. Who We Are and How to Contact Us

Sonaverse Ltd ("Sonaverse", "we", "us", or "our") is the data controller responsible for your personal data processed through the Sonaverse platform. We are incorporated in England and Wales under company number 17108925. Our registered office is at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Our appointed Data Protection Officer is Julian Saunders, contactable at privacy@sonaverse.ai.

We aim to respond to all privacy-related enquiries within 30 days. Where a request is complex or you have submitted multiple requests, we may extend this period by a further two months, in which case we will notify you within the initial 30-day period.

Sonaverse Ltd is registered with the Information Commissioner's Office (ICO) as a data controller (registration reference ZC114963). The ICO is the UK's supervisory authority for data protection.

2. What Personal Data We Collect

We collect different categories of personal data depending on how you use the platform.

Special category data

Certain data we process may constitute "special category data" under UK GDPR — data that carries heightened sensitivity and legal protection. This includes:

• Biometric data. Voice recordings processed for the purpose of creating a voice or identity representation may, depending on the processing involved, constitute biometric data within the meaning of Article 9 UK GDPR. We process such data only where we have your explicit consent.
• Health data. Personal Materials may, at your discretion, contain health-related information you choose to share as part of your personal narrative. We do not solicit health data and do not require it. Where you voluntarily include health information in Personal Materials, we process it solely on the basis of your explicit consent.
• Other special categories. Personal Materials may contain information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation or life. We process any such data on the basis of your explicit consent and solely to provide the Services you have requested.
• Conversation memory profiles. Because conversations with sonas are freeform, memory profiles synthesised from those conversations may contain or be derived from special category data. We process any special category data within memory profiles only on the basis of your explicit consent under Article 9(2)(a) UK GDPR. See Section 5.

You are never required to provide special category data. If you choose to include it in your Personal Materials, or if it arises in the course of conversation, you do so voluntarily and with the understanding that it will be processed as part of your sona or memory profile where you have given consent.

3. How We Collect Your Personal Data

(a) Directly from you

• When you create an account and complete registration;
• When you submit Personal Materials or Knowledge Materials to build or enrich a sona;
• When you complete identity verification;
• When you subscribe to a sona on the Creator Marketplace;
• When you interact with a sona (your prompts are recorded as interaction data);
• When you contact our support team or submit a report;
• When you provide posthumous provisions;
• When you respond to interviews conducted via WhatsApp as part of the sona-building process.

(b) Automatically when you use our platform

• Usage and technical data, including your IP address, browser type, and pages visited, are collected automatically via server logs and cookies when you access our Website or Services;
• Interaction data, including prompts submitted to sonas and the responses generated, are logged automatically when you use the chat interface;
• Where you have given consent to conversation memory, your interactions with sonas are periodically synthesised into a short profile by an AI model. See Section 5.

(c) From third parties

• Identity verification outcome data from our identity verification provider when you complete a verification check;
• Payment status and billing information from Stripe when you subscribe to a sona or when a subscription status changes;
• WhatsApp delivery confirmations and message status from Meta Platforms when we send OTP codes or interview messages via WhatsApp Business.

(d) From website visitors — where you talk to a founder demonstration sona on our public website, we process the audio you speak or the text you type during that conversation, together with basic session metadata, even if you do not hold a Sonaverse account.

4. Why We Process Your Data and Our Legal Bases

Under UK GDPR, we must have a lawful basis for processing your personal data.

Visitor speech is transcribed only to run the conversation and is not processed to uniquely identify the visitor, so it does not engage UK GDPR Article 9. No Article 9(2)(a) basis is required for this activity, in contrast to sona-creation voice (Section 6).

Legitimate interests balancing

Where we rely on legitimate interests as our lawful basis, we have conducted a balancing assessment to confirm that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests; see Section 11.

5. Conversation Memory and Profile Synthesis

This section describes how our optional conversation memory feature works. Memory is off by default and is activated only where you have given explicit consent.

When you give consent to conversation memory, Sonaverse synthesises your conversations with each sona into a short profile. That profile is used to provide continuity across future conversations with that sona.

What we synthesise: At the end of each conversation session (or at a suitable trigger point), your interaction with a sona is processed by an AI model to produce a short summary capturing relevant context, preferences, and patterns of engagement. This summary is stored as your memory profile for that sona relationship.

Where it is stored: Memory profiles are stored in Sonaverse's Supabase database, hosted in the EU. The synthesis step involves transmitting your conversation content to Anthropic PBC (USA), our AI model provider. This transfer is covered by the international transfer mechanism described in Section 9.

How it is used: On subsequent visits to a sona, the memory profile for that relationship is injected into the sona's context, allowing the sona to recall relevant details from prior conversations.

Who can see it: Memory profiles are not visible to sona creators. They are used solely within the conversation context between you and the relevant sona.

Special category data: Conversations with sonas are freeform and may cover health, relationships, beliefs, political views, and other sensitive topics. A profile synthesised from those conversations may contain or be derived from special category data. We process any such data only on the basis of your explicit consent under Article 9(2)(a) UK GDPR.

International transfer: The synthesis step involves transmitting your conversation transcript to Anthropic PBC (USA). This transfer is governed by the ICO Approved Addendum (version B.1.0) to the EU Standard Contractual Clauses, incorporated into Anthropic's Data Processing Addendum and effective by acceptance of Anthropic's Commercial Terms. The resulting profile is stored in the EU. See Section 9.

Consent and opt-out: Conversation memory is off by default. After you have had a short exchange with a sona, we will offer you the option to enable memory inline within the conversation. If you do not respond at that point, the same offer will appear at the start of your next session. Consent is account-level: a single decision covers all sonas on the platform. You may withdraw consent at any time via your account settings or by contacting privacy@sonaverse.ai. On withdrawal, your memory profile is deleted within 30 days and memory deactivates. Withdrawing memory consent does not affect your account or your access to any tier of the service.

6. Voice Processing Notice

This section contains specific information about how we handle voice recordings and voice-derived data, which may constitute biometric data under UK GDPR. Please read it carefully.

This section concerns the voice of the person whose sona is being built. For how we handle the voice of website visitors who talk to a sona, see Section 6A.

If you provide voice recordings as part of your Personal Materials — for example, as part of a structured interview for your sona — we process those recordings as follows.

What we collect:

• The audio recording itself, stored securely in our database;
• A text transcript extracted from the recording;
• Vector embeddings derived from the transcript.

How we use it:

• To configure the sona model associated with your sona, giving it access to the content, tone, and style of your spoken responses;
• To inform the written communication style and knowledge base of your sona;
• For trust and safety purposes.

What we do not do:

• We do not use your voice recordings to create a synthetic voice model capable of generating audio in your voice, unless you separately and explicitly consent to this;
• We do not share your voice recordings with third parties for their own use;
• We do not use your voice data to train general AI models for use outside your specific sona without your explicit consent;
• We do not commercialise your voice or voice-derived data on a standalone basis.

Lawful basis: We process voice recordings on the basis of your explicit consent. You may withdraw this consent at any time by contacting us at privacy@sonaverse.ai. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Following withdrawal, we will deactivate your sona and delete your voice recordings. Voice-derived embeddings will be removed from operational systems within 30 days.

Retention: Voice recordings and transcripts are retained for as long as your sona remains active. They are deleted within 30 days of deactivation of the sona or upon a valid deletion request.

6A. Visitor Conversations with Founder Demonstration Sonas

Our public website lets you talk to AI "sonas" of our founders (Julian and Jena) without creating an account. This section explains how we handle your data when you do.

How it works: You can interact by speaking or by typing.

• If you speak, your microphone audio is streamed to a third-party speech-to-text provider (Deepgram, Inc., USA) and transcribed in real time so the sona can respond. The sona's reply is generated using an AI model (Anthropic PBC, USA) and voiced using an AI voice-generation provider (ElevenLabs Inc., USA).
• If you type, no audio is processed.

No biometric identification: We transcribe what you say only to run the conversation. We do not create a voiceprint, and we do not use your audio to identify or authenticate you. Your inbound speech is not processed as biometric or special category data.

These are AI sonas: The sonas are AI representations of Julian and Jena. Their voices are AI-generated and their responses may not reflect the real views of either founder.

Purpose and lawful basis: We provide these sonas to demonstrate our product. Our lawful basis is our legitimate interest in showcasing and marketing the Services, together with the consent you give via the notice shown before the conversation begins. You must confirm you are 18 or over to proceed.

Sharing: To run the conversation, your audio or text is shared with the providers listed in Section 8 (speech-to-text, AI model, and AI voice generation). We do not sell this data and do not use it for advertising, and neither Deepgram nor ElevenLabs use it to train or improve their models.

Retention: Your conversation — including the transcript of anything you said or typed — is stored in the same way as a signed-in visitor's chat with a sona, and is retained for up to 12 months from the date of the conversation before automatic deletion. Inbound audio itself is processed transiently to produce the transcript and is not separately retained.

Your choices: You can type instead of speaking, and you can end the conversation at any time. For any question or request about data from these conversations, contact privacy@sonaverse.ai.

7. Knowledge Materials and Third-Party Data

(a) How Knowledge Materials are stored

We store: (i) the source document; (ii) extracted text derived from the document; and (iii) vector embeddings generated from the extracted text. All three are stored in our secure Supabase database infrastructure. Access to stored Knowledge Materials is restricted to authorised personnel and the AI processing systems that serve your sona.

(b) Third-party personal data in Knowledge Materials

You are responsible for ensuring that any personal data of identifiable third parties contained in Knowledge Materials is handled lawfully. We recommend redacting the personal data of third parties from Knowledge Materials wherever it is not necessary for the operation of your sona.

To the extent that we process personal data of third parties contained in Knowledge Materials you upload, we do so as a data processor acting on your instructions, and our Data Processing Addendum governs that processing.

(c) Retrieval limits

Our retrieval system applies technical limits on the volume of content surfaced from any single Knowledge Material per interaction (500 words per passage; 1,000 words aggregate per source per session). These limits exist to protect the rights of third-party rights-holders and to reduce the risk of disproportionate disclosure.

8. Who We Share Your Data With

We do not sell your personal data. We do not share it for third-party advertising purposes. We share your data only as described in this section.

(a) Service providers (data processors)

Neither Deepgram nor ElevenLabs use data shared under this table to train or improve their models.

(b) Other Sonaverse users

When you interact with a sona as a subscriber, the creator may be able to see metadata about subscriber interactions (such as the number of interactions and the Access Tier). Individual prompts you submit to a sona are not shared with the creator unless you are interacting at the Legacy tier and the creator has configured the sona to retain interaction summaries.

(c) Legal and regulatory disclosures

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other public bodies where we are required to do so by law, by court order, or where we reasonably believe that disclosure is necessary to protect the rights, property, or safety of Sonaverse Ltd, our users, or the public.

(d) Business transfers

If Sonaverse Ltd is involved in a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

(e) Contact exchange — professional sona owners

Where you use the contact exchange feature in conversation with a professional sona and choose to share your email address, we transmit that email to the sona's owner so they can follow up with you directly. This transfer happens only on your explicit consent. The owner receives your email as an independent data controller and is responsible for their own compliance with applicable data protection law in relation to that data. Sonaverse can delete its own contact exchange record on your request, but cannot require deletion of copies held independently by the owner.

9. International Transfers of Personal Data

Several of our key service providers are based in the United States. For transfers to our US-based service providers (Supabase, Anthropic, Stripe, Resend, ElevenLabs, and Deepgram), we rely on UK International Data Transfer Agreements (UK IDTAs) or UK Addenda to EU Standard Contractual Clauses (SCCs). In particular, the transfer of conversation content to Anthropic for sona responses and for memory profile synthesis (where you have given consent) is covered by the ICO Approved Addendum (version B.1.0) to the EU Standard Contractual Clauses, incorporated into Anthropic's Data Processing Addendum by acceptance of their Commercial Terms. Copies of relevant transfer mechanisms are available on request from privacy@sonaverse.ai.

For transfers involving Meta Platforms Ireland Ltd (WhatsApp Business), data is processed within the EU under Meta's standard terms.

If you are resident in the European Economic Area, the same transfer safeguards apply to any transfer of your data from the UK to the EEA, which is currently subject to an EU adequacy decision for the UK.

10. How Long We Keep Your Data

Where data is anonymised (rather than deleted), it no longer constitutes personal data under UK GDPR. We may retain anonymised data for analytical and product development purposes indefinitely.

11. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of your rights, please contact us at privacy@sonaverse.ai. We will not charge a fee for processing rights requests, except where requests are manifestly unfounded or excessive.

Where you have shared your email address with a professional sona's owner via the contact exchange feature, your right to erasure (Article 17) applies to Sonaverse's own contact exchange records, which we will delete on request. We cannot, however, compel deletion of copies held independently by the owner in their capacity as a separate data controller. You may contact the owner directly to request deletion of the copy they hold.

12. Complaints and the Right to Lodge a Complaint

If you are unhappy with how we have handled your personal data, please contact us at privacy@sonaverse.ai in the first instance.

If you remain dissatisfied after contacting us, you have the right to lodge a complaint with a supervisory authority:

13. Cookies and Tracking Technologies

You can manage your cookie preferences at any time through the cookie settings panel accessible from the footer of our website.

We do not use cookies or tracking technologies for the purpose of serving targeted advertising to you, and we do not share cookie data with advertising networks.

14. Children's Data

Our Services are not directed at and may not be used by persons under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has provided us with personal data, please contact us immediately at privacy@sonaverse.ai and we will take prompt steps to delete that data.

A sona may only be created of a living adult. The creation of a sona of a minor is absolutely prohibited under our Terms of Service and Prohibited Use Policy.

15. Security

We implement appropriate technical and organisational measures, which include:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls limiting internal access to personal data on a need-to-know basis;
• Row-level security (RLS) policies enforced at the database layer, ensuring that data is segregated by user and Access Tier;
• Regular security reviews and vulnerability assessments;
• Access logging for sensitive operations.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

If you become aware of or suspect a security vulnerability or data breach involving our platform, please notify us immediately at security@sonaverse.ai.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting a notice on the platform at least 30 days before the change takes effect.

The current version is always available at www.sonaverse.ai/privacy.

Where a change to this Policy requires your consent, we will seek that consent separately before processing your data for that new purpose.

Appendix: Key Terms Used in This Policy

Legal documents