Legal

Privacy Policy

Last updated: 23 March 2026

Sonaverse Ltd · Sonaverse Platform

Last Updated: 5 August 2026 Effective Date: 23 March 2026

This Privacy Policy describes how Sonaverse Ltd collects, uses, shares, and protects your personal data when you use the Sonaverse platform. Please read it carefully. By using our Services you confirm that you have read and understood this Policy. Capitalised terms used but not defined here have the meanings given in our Terms of Service.

Sonaverse Ltd · 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ · Company No. 17108925 · privacy@sonaverse.ai · www.sonaverse.ai/privacy

1. Who We Are and How to Contact Us

Sonaverse Ltd ("Sonaverse", "we", "us", or "our") is the data controller responsible for your personal data processed through the Sonaverse platform. We are incorporated in England and Wales under company number 17108925. Our registered office is at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Our appointed Data Protection Officer is Julian Saunders, contactable at privacy@sonaverse.ai.

We aim to respond to all privacy-related enquiries within 30 days. Where a request is complex or you have submitted multiple requests, we may extend this period by a further two months, in which case we will notify you within the initial 30-day period.

Sonaverse Ltd is registered with the Information Commissioner's Office (ICO) as a data controller (registration reference ZC114963). The ICO is the UK's supervisory authority for data protection.

2. What Personal Data We Collect

We collect different categories of personal data depending on how you use the platform.

Special category data

Certain data we process may constitute "special category data" under UK GDPR — data that carries heightened sensitivity and legal protection. This includes:

• Biometric data. Voice recordings processed for the purpose of creating a voice or identity representation may, depending on the processing involved, constitute biometric data within the meaning of Article 9 UK GDPR. We process such data only where we have your explicit consent.
• Health data. Personal Materials may, at your discretion, contain health-related information you choose to share as part of your personal narrative. We do not solicit health data and do not require it. Where you voluntarily include health information in Personal Materials, we process it solely on the basis of your explicit consent.
• Other special categories. Personal Materials may contain information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation or life. We process any such data on the basis of your explicit consent and solely to provide the Services you have requested.
• Conversation memory profiles. Because conversations with sonas are freeform, memory profiles synthesised from those conversations may contain or be derived from special category data. We process any special category data within memory profiles only on the basis of your explicit consent under Article 9(2)(a) UK GDPR. See Section 5.
• Studio conversations with Sunny. Conversations with Sunny in the creator studio are freeform and may touch on health, beliefs, relationships, or other sensitive matters. We process any special category data within those transcripts only on the basis of your explicit consent under Article 9(2)(a) UK GDPR. See Section 6C.

You are never required to provide special category data. If you choose to include it in your Personal Materials, or if it arises in the course of conversation, you do so voluntarily and with the understanding that it will be processed as part of your sona or memory profile where you have given consent.

3. How We Collect Your Personal Data

(a) Directly from you

• When you create an account and complete registration;
• When you submit Personal Materials or Knowledge Materials to build or enrich a sona;
• When you complete identity verification;
• When you subscribe to a sona on the Creator Marketplace;
• When you interact with a sona (your prompts are recorded as interaction data);
• When you contact our support team or submit a report;
• When you provide posthumous provisions;
• When you respond to interviews conducted via WhatsApp as part of the sona-building process.

(b) Automatically when you use our platform

• Usage and technical data, including your IP address, browser type, and pages visited, are collected automatically via server logs and cookies when you access our Website or Services;
• Interaction data, including prompts submitted to sonas and the responses generated, are logged automatically when you use the chat interface;
• Where you have given consent to conversation memory, your interactions with sonas are periodically synthesised into a short profile by an AI model. See Section 5.

(c) From third parties

• Identity verification outcome data from our identity verification provider when you complete a verification check;
• Payment status and billing information from Stripe when you subscribe to a sona or when a subscription status changes;
• WhatsApp delivery confirmations and message status from Meta Platforms when we send OTP codes or interview messages via WhatsApp Business.

(d) From website visitors — where you talk to a founder demonstration sona on our public website, we process the audio you speak or the text you type during that conversation, together with basic session metadata, even if you do not hold a Sonaverse account.

4. Why We Process Your Data and Our Legal Bases

Under UK GDPR, we must have a lawful basis for processing your personal data.

Visitor speech is transcribed only to run the conversation and is not processed to uniquely identify the visitor, so it does not engage UK GDPR Article 9. No Article 9(2)(a) basis is required for this activity, in contrast to sona-creation voice (Section 6).

Legitimate interests balancing

Where we rely on legitimate interests as our lawful basis, we have conducted a balancing assessment to confirm that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests; see Section 11.

5. Conversation Memory and Profile Synthesis

This section describes how our optional conversation memory feature works. Memory is off by default and is activated only where you have given explicit consent.

When you give consent to conversation memory, Sonaverse synthesises your conversations with each sona into a short profile. That profile is used to provide continuity across future conversations with that sona.

What we synthesise: At the end of each conversation session (or at a suitable trigger point), your interaction with a sona is processed by an AI model to produce a short summary capturing relevant context, preferences, and patterns of engagement. This summary is stored as your memory profile for that sona relationship.

Where it is stored: Memory profiles are stored in Sonaverse's Supabase database, hosted in the EU. The synthesis step involves transmitting your conversation content to Anthropic PBC (USA), our AI model provider. This transfer is covered by the international transfer mechanism described in Section 9.

How it is used: On subsequent visits to a sona, the memory profile for that relationship is injected into the sona's context, allowing the sona to recall relevant details from prior conversations.

Who can see it: Memory profiles are not visible to sona creators. They are used solely within the conversation context between you and the relevant sona.

Special category data: Conversations with sonas are freeform and may cover health, relationships, beliefs, political views, and other sensitive topics. A profile synthesised from those conversations may contain or be derived from special category data. We process any such data only on the basis of your explicit consent under Article 9(2)(a) UK GDPR.

International transfer: The synthesis step involves transmitting your conversation transcript to Anthropic PBC (USA). This transfer is governed by the ICO Approved Addendum (version B.1.0) to the EU Standard Contractual Clauses, incorporated into Anthropic's Data Processing Addendum and effective by acceptance of Anthropic's Commercial Terms. The resulting profile is stored in the EU. See Section 9.

Consent and opt-out: Conversation memory is off by default. After you have had a short exchange with a sona, we will offer you the option to enable memory inline within the conversation. If you do not respond at that point, the same offer will appear at the start of your next session. Consent is account-level: a single decision covers all sonas on the platform. You may withdraw consent at any time via your account settings or by contacting privacy@sonaverse.ai. On withdrawal, your memory profile is deleted within 30 days and memory deactivates. Withdrawing memory consent does not affect your account or your access to any tier of the service.

6. Voice Processing Notice

This section contains specific information about how we handle voice recordings and voice-derived data, which may constitute biometric data under UK GDPR. Please read it carefully.

This section concerns the voice of the person whose sona is being built. For how we handle the voice of website visitors who talk to a sona, see Section 6A.

If you provide voice recordings as part of your Personal Materials — for example, as part of a structured interview for your sona — we process those recordings as follows.

What we collect:

• The audio recording itself, stored securely in our database;
• A text transcript extracted from the recording;
• Vector embeddings derived from the transcript.

How we use it:

• To configure the sona model associated with your sona, giving it access to the content, tone, and style of your spoken responses;
• To inform the written communication style and knowledge base of your sona;
• For trust and safety purposes.

What we do not do:

• We do not use your voice recordings to create a synthetic voice model capable of generating audio in your voice, unless you separately and explicitly consent to this;
• We do not share your voice recordings with third parties for their own use;
• We do not use your voice data to train general AI models for use outside your specific sona without your explicit consent;
• We do not commercialise your voice or voice-derived data on a standalone basis.

Lawful basis: We process voice recordings on the basis of your explicit consent. You may withdraw this consent at any time by contacting us at privacy@sonaverse.ai. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Following withdrawal, we will deactivate your sona and delete your voice recordings. Voice-derived embeddings will be removed from operational systems within 30 days.

Retention: Voice recordings and transcripts are retained for as long as your sona remains active. They are deleted within 30 days of deactivation of the sona or upon a valid deletion request.

6A. Visitor Conversations with Founder Demonstration Sonas

Our public website lets you talk to AI "sonas" of our founders (Julian and Jena) without creating an account. This section explains how we handle your data when you do.

How it works: You can interact by speaking or by typing.

• If you speak, your microphone audio is streamed to a third-party speech-to-text provider (Deepgram, Inc., USA) and transcribed in real time so the sona can respond. The sona's reply is generated using an AI model (Anthropic PBC, USA) and voiced using an AI voice-generation provider (ElevenLabs Inc., USA).
• If you type, no audio is processed.

No biometric identification: We transcribe what you say only to run the conversation. We do not create a voiceprint, and we do not use your audio to identify or authenticate you. Your inbound speech is not processed as biometric or special category data.

These are AI sonas: The sonas are AI representations of Julian and Jena. Their voices are AI-generated and their responses may not reflect the real views of either founder.

Purpose and lawful basis: We provide these sonas to demonstrate our product. Our lawful basis is our legitimate interest in showcasing and marketing the Services, together with the consent you give via the notice shown before the conversation begins. You must confirm you are 18 or over to proceed.

Sharing: To run the conversation, your audio or text is shared with the providers listed in Section 8 (speech-to-text, AI model, and AI voice generation). We do not sell this data and do not use it for advertising, and neither Deepgram nor ElevenLabs use it to train or improve their models.

Retention: Your conversation — including the transcript of anything you said or typed — is stored in the same way as a signed-in visitor's chat with a sona, and is retained for up to 12 months from the date of the conversation before automatic deletion. Inbound audio itself is processed transiently to produce the transcript and is not separately retained.

Your choices: You can type instead of speaking, and you can end the conversation at any time. For any question or request about data from these conversations, contact privacy@sonaverse.ai.

6B. Contact Lead Forms

When you are in a conversation with a sona and the sona shares the founder's contact details with you, you may be offered the option to leave your own name and email address so the founder can follow up with you directly. This section explains what we collect and how we handle it.

What we collect. If you choose to complete the contact lead card, we collect your name and email address as you enter them, along with a brief AI-generated summary of your conversation. The summary is produced automatically from your conversation transcript by a language model (Anthropic PBC, USA) acting as our processor. You do not write the summary yourself and you will not see it before it is sent. We also record technical metadata: the session mode (text or voice), the page from which the card was shown, and your anonymous session identifier.

Lawful basis. We process this data on the basis of your consent (Article 6(1)(a) UK GDPR). Completing the card is entirely optional. You already have the founder's contact details when the card appears; leaving your own details is not a condition of receiving them. Your consent is recorded with a version identifier and timestamp in our audit log.

What happens when you submit. Your name, email address, and the AI-generated summary of your conversation are transmitted to the sona's owner so they can contact you. We retain a record of your submission for compliance and audit purposes.

The sona owner as independent data controller. From the point at which your name and email are transmitted to the sona's owner, that person holds your data as an independent data controller. Sonaverse does not control what the owner does with your details after transmission, and the owner's use of your data is subject to their own data protection obligations.

A note on your conversation content. The AI-generated summary is derived from what was said in your conversation. If your conversation touched on sensitive or personal matters, those may be reflected in the summary sent to the founder. Please bear this in mind before submitting the card.

Erasure. You may ask us to delete our record of your contact lead submission at any time by writing to privacy@sonaverse.ai. We will delete the record from our systems. We cannot, however, retrieve or delete copies of your name and email already held independently by the sona's owner; any such request must be made directly to them.

Retention. We retain the submission and consent record for six years from the date of submission. See Section 10.

Optional: email copy and recap (separate opt-in). When you also tick the separate checkbox on the contact lead card, we additionally:

generate a short AI-generated recap of your conversation, addressed to you, produced from your conversation transcript by Anthropic PBC (USA) acting as our processor. The same international transfer mechanism described above and in Section 9 applies. The recap text is retained on our systems for the period set out in Section 10.

email you a single message via Resend Inc. (USA) containing a summary of the details you shared with the founder, the AI-generated note passed to the founder, the AI-generated recap of your conversation, and an invitation to create your own sona on Sonaverse. This is a one-off message. We will not email you again unless you create a Sonaverse account.

Your consent to receive this email is recorded separately from your consent to share your details with the founder, with its own version identifier and timestamp in our audit log.

Acquisition attribution. If you click through from the copy email and create a Sonaverse account, the sona you were visiting when you completed the contact lead card is recorded as your acquisition source. This is stored as part of your account data and used to understand how people discover the platform.

6C. Your Conversations with Sunny in the Creator Studio

This section applies to signed-in creators using the Sonaverse studio. It is separate from Section 5, which describes memory profiles built from visitors' conversations with a sona, and from Section 6A, which covers website visitors talking to our founder demonstration sonas.

Sunny is our assistant inside the signed-in creator studio. She helps you build and manage your sona. You can talk to her by typing or by speaking. Where you have given consent, we keep a transcript of each conversation so that Sunny can pick up where you left off.

What we keep. For each conversation: a transcript of both sides, held as a structured record and as plain text; the start and end times and the duration; and whether the conversation was text-only or included voice. Where you speak, your inbound microphone audio is processed to produce the transcript, as described below.

Voice processing. Studio conversations with Sunny run on ElevenLabs Inc. (USA). When you speak, your inbound microphone audio is sent to ElevenLabs, who transcribe it and return the transcript to us. Separately, Deepgram, Inc. (USA) provides speech-to-text for the dictation control in Sunny's panel. Both transfers are covered by the mechanisms described in Section 9. Your voice is processed here only to run and record the conversation. We do not create a voiceprint from studio conversations and we do not use this audio to identify or authenticate you.

How your previous conversations are used. When you open a new conversation with Sunny, excerpts from your three most recent completed conversations are supplied to her so she has continuity. These are direct excerpts of what was said, kept within a fixed size limit. No AI summarisation or profiling step is applied to them.

Who can see your transcripts. Studio conversations are private to you. Access is restricted at the database level so that you are the only user who can read your own transcripts. They are not visible to other creators, to subscribers, or to visitors.

Lawful basis. We keep transcripts on the basis of your consent. Before your first conversation, we show you a consent card explaining what is kept and for how long. Consent is off by default and the studio remains fully usable if you decline: declining means conversations are not kept, not that you lose access to Sunny or to any other part of the studio. Because these conversations are freeform and may touch on health, beliefs, relationships, or other sensitive matters, we rely on your explicit consent under Article 9(2)(a) UK GDPR for any special category data within them, alongside Article 6(1)(a) for ordinary personal data.

Withdrawing consent. You can change your mind at any time from your profile page. Future conversations will not be kept. You may also request deletion of transcripts already held by contacting privacy@sonaverse.ai.

Retention. Studio conversation transcripts are deleted 365 days after the conversation took place, by an automated daily process. See Section 10.

7. Knowledge Materials and Third-Party Data

(a) How Knowledge Materials are stored

We store: (i) the source document; (ii) extracted text derived from the document; and (iii) vector embeddings generated from the extracted text. All three are stored in our secure Supabase database infrastructure. Access to stored Knowledge Materials is restricted to authorised personnel and the AI processing systems that serve your sona.

(b) Third-party personal data in Knowledge Materials

You are responsible for ensuring that any personal data of identifiable third parties contained in Knowledge Materials is handled lawfully. We recommend redacting the personal data of third parties from Knowledge Materials wherever it is not necessary for the operation of your sona.

To the extent that we process personal data of third parties contained in Knowledge Materials you upload, we do so as a data processor acting on your instructions, and our Data Processing Addendum governs that processing.

(c) Retrieval limits

Our retrieval system applies technical limits on the volume of content surfaced from any single Knowledge Material per interaction (500 words per passage; 1,000 words aggregate per source per session). These limits exist to protect the rights of third-party rights-holders and to reduce the risk of disproportionate disclosure.

8. Who We Share Your Data With

We do not sell your personal data. We do not share it for third-party advertising purposes. We share your data only as described in this section.

(a) Service providers (data processors)

Neither Deepgram nor ElevenLabs use data shared under this table to train or improve their models.

(b) Other Sonaverse users

When you interact with a sona as a subscriber, the creator may be able to see metadata about subscriber interactions (such as the number of interactions and the Access Tier). Individual prompts you submit to a sona are not shared with the creator unless you are interacting at the Legacy tier and the creator has configured the sona to retain interaction summaries.

(c) Legal and regulatory disclosures

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other public bodies where we are required to do so by law, by court order, or where we reasonably believe that disclosure is necessary to protect the rights, property, or safety of Sonaverse Ltd, our users, or the public.

(d) Business transfers

If Sonaverse Ltd is involved in a merger, acquisition, restructuring, or sale of all or part of its assets, your personal data may be transferred to the acquiring entity. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

(e) Contact exchange — sona owners

Where you use the contact exchange feature in conversation with a sona and choose to share your email address, we transmit that email to the sona's owner so they can follow up with you directly. This transfer happens only on your explicit consent. The owner receives your email as an independent data controller and is responsible for their own compliance with applicable data protection law in relation to that data. Sonaverse can delete its own contact exchange record on your request, but cannot require deletion of copies held independently by the owner.

(f) Contact lead forms

Where you complete a contact lead card during a conversation with a sona, your name, email address, and an AI-generated summary of your conversation are transmitted to the sona's owner so they can follow up with you directly. This transfer happens only where you have ticked the checkbox on the contact lead card. The AI-generated summary is produced by Anthropic PBC (USA) from your conversation transcript; that processing is covered by the international transfer mechanism described in Section 9. The sona's owner receives your details as an independent data controller. See Section 6B for full details.

9. International Transfers of Personal Data

Several of our key service providers are based in the United States. For transfers to our US-based service providers (Supabase, Anthropic, Stripe, Resend, ElevenLabs, and Deepgram), we rely on UK International Data Transfer Agreements (UK IDTAs) or UK Addenda to EU Standard Contractual Clauses (SCCs). In particular, the transfer of conversation content to Anthropic for sona responses and for memory profile synthesis (where you have given consent) is covered by the ICO Approved Addendum (version B.1.0) to the EU Standard Contractual Clauses, incorporated into Anthropic's Data Processing Addendum by acceptance of their Commercial Terms. Copies of relevant transfer mechanisms are available on request from privacy@sonaverse.ai.

Where you speak to Sunny in the creator studio, your inbound microphone audio and the resulting conversation transcript are transferred to ElevenLabs Inc. (USA), and dictation audio in Sunny's panel is transferred to Deepgram, Inc. (USA). Both transfers rely on the mechanisms described above. See Section 6C.

For transfers involving Meta Platforms Ireland Ltd (WhatsApp Business), data is processed within the EU under Meta's standard terms.

If you are resident in the European Economic Area, the same transfer safeguards apply to any transfer of your data from the UK to the EEA, which is currently subject to an EU adequacy decision for the UK.

10. How Long We Keep Your Data

Where data is anonymised (rather than deleted), it no longer constitutes personal data under UK GDPR. We may retain anonymised data for analytical and product development purposes indefinitely.

11. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of your rights, please contact us at privacy@sonaverse.ai. We will not charge a fee for processing rights requests, except where requests are manifestly unfounded or excessive.

Where you have shared your email address with a sona's owner via the contact exchange feature, your right to erasure (Article 17) applies to Sonaverse's own contact exchange records, which we will delete on request. We cannot, however, compel deletion of copies held independently by the owner in their capacity as a separate data controller. You may contact the owner directly to request deletion of the copy they hold.

Where you have completed a contact lead card during a conversation, the same applies: we will delete our own record of your submission on request, but we cannot retrieve or delete copies of your name, email, or AI-generated conversation summary already transmitted to and held independently by the sona's owner. Any such request must be directed to them.

12. Complaints and the Right to Lodge a Complaint

If you are unhappy with how we have handled your personal data, please contact us at privacy@sonaverse.ai in the first instance.

If you remain dissatisfied after contacting us, you have the right to lodge a complaint with a supervisory authority:

13. Cookies and Tracking Technologies

You can manage your cookie preferences at any time through the cookie settings panel accessible from the footer of our website.

We do not use cookies or tracking technologies for the purpose of serving targeted advertising to you, and we do not share cookie data with advertising networks.

14. Children's Data

Our Services are not directed at and may not be used by persons under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has provided us with personal data, please contact us immediately at privacy@sonaverse.ai and we will take prompt steps to delete that data.

A sona may only be created of a living adult. The creation of a sona of a minor is absolutely prohibited under our Terms of Service and Prohibited Use Policy.

15. Security

We implement appropriate technical and organisational measures, which include:

• Encryption of data in transit (TLS) and at rest;
• Role-based access controls limiting internal access to personal data on a need-to-know basis;
• Row-level security (RLS) policies enforced at the database layer, ensuring that data is segregated by user and Access Tier;
• Regular security reviews and vulnerability assessments;
• Access logging for sensitive operations.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

If you become aware of or suspect a security vulnerability or data breach involving our platform, please notify us immediately at security@sonaverse.ai.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email and by posting a notice on the platform at least 30 days before the change takes effect.

The current version is always available at www.sonaverse.ai/privacy.

Where a change to this Policy requires your consent, we will seek that consent separately before processing your data for that new purpose.

Appendix: Key Terms Used in This Policy

Legal documents