Privacy Policy

Who we are What we collect How we use it AI processing Legal bases Sharing Transfers Retention Your rights Contact

This is the current published policy. We keep it in plain language and update it as the service evolves; the date above always reflects the latest version.

This policy explains how Sois ("we", "us") handles personal data for visitors to this website and for people who use the Sois platform. The platform is multi-tenant: where you use a workspace operated by another organisation (a "network operator"), that operator is the controller of the data you put into their workspace, and we act as a processor on their behalf.

1. Who we are

Sois provides an agent-native business platform. For this website and for accounts created directly with us, the data controller is Sois AI, Inc., a Delaware corporation. If you reached Sois through a branded network operated by another organisation, that organisation is the controller for the data in that workspace.

2. What we collect

Account data: name, email, organisation, and authentication details when you create an account.
Usage data: actions taken in the product, including requests made to your agent and the credits they consume, so we can run, secure, and bill the service.
Workspace content: the business data you or your agent create in a workspace (contacts, documents, messages, and so on), including messages you send to your agent and any photos, files, or voice audio you attach or record for it.
Technical data: IP address, device and browser information, and approximate region (used to choose a default language).
Communications: messages you send us, including data-rights requests submitted through this site.

3. How we use it

To provide, secure, and improve the platform and this website.
To authenticate you and enforce permissions, so an agent only ever acts within the access of the person it acts for.
To meter and bill usage, and to prevent abuse.
To respond to your requests and to meet legal obligations.

AI processing (OpenAI)

The Sois agent is powered by large language models from OpenAI, our third-party AI provider. When you interact with your agent — in text chat, by voice, or by attaching photos or files — the messages you send, your voice audio, your attachments, and the workspace data needed to fulfil the request are transmitted to OpenAI on our behalf to generate the response; voice input is transcribed, and voice replies synthesised, by the same provider. In the mobile apps nothing is sent until you have reviewed the in-app disclosure and agreed to it. OpenAI acts as our processor under a data processing agreement that provides protection equivalent to this policy, does not use this data to train its models, and retains it only briefly for abuse monitoring under its API data-usage terms.

4. Legal bases

Where the GDPR applies, we rely on: performance of a contract (to provide the service you asked for); legitimate interests (to secure, improve, and run the platform); consent (for optional cookies and marketing, where used); and compliance with legal obligations.

Google user data

Where you connect a Google account (sign-in, Gmail inbox, or Google Calendar), Sois' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features you connect it for, is never used for advertising, and is never sold.

We do not sell personal data. We share it only with service providers who help us run the platform (such as cloud hosting, payment processing, email delivery, and the AI processing by OpenAI described above), each under contract and only as needed. When you connect your own AI agent or third-party services, data flows to those providers under their terms and your control.

6. International transfers

We may process data in countries outside your own. Where we do, we use appropriate safeguards such as standard contractual clauses to protect it.

7. Retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Workspace content is retained according to the operator's settings and is removed on account closure subject to legal requirements.

8. Your rights

Subject to local law, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to it. You can exercise any of these through our data-rights request form. We respond within the timeframes the law requires. If you used a workspace operated by a network operator, send the request to that operator; we will help them fulfil it.

9. How to reach us

For any privacy question or to exercise a right, use the data-rights request form. It reaches our data team directly. You also have the right to complain to your local data protection authority.