Privacy Policy

1. Who We Are

Mohammed Ibrahim Ali, trading as "Alfaz Studio", operates Sonacove Meets. Our registered address is Stayçeken, Saide Sokak, Merkez Mahallesi, Kağıthane, Istanbul 34406, Türkiye. We are the data controller for the account, billing, security and usage data described in this policy. When an organisation uses Sonacove to host its own meetings, that organisation is the controller of the meeting content and we act as its processor under our Data Processing Agreement.

2. Information We Collect

We collect only the information needed to provide the Service:

• Account information: your name, email address, and authentication data such as password hashes, session and security tokens.
• Payment information: handled by our Merchant of Record, Paddle. We receive your name, email, billing country and tax information and a customer or subscription identifier; we never store full card details.
• Usage data: the meetings and rooms you create or join, access times, features used, and general service interactions.
• Device and connection data: browser type and version, operating system, device type, IP address, and app version.
• Meeting content: display name, chat messages, poll questions and votes, reactions, hand raises, shared files, whiteboard content, and attendance and join-leave records. If you enable transcription, transcript segments are processed to produce live captions and are not stored on our servers.
• Analytics and diagnostics: we use PostHog to understand how the Service is used and to diagnose problems. This covers explicit product events, screen views, crash reports and diagnostic logs. Session replay is disabled across the Service, including in meetings, so we do not record your screen.
• Push notification tokens: if you enable notifications in our mobile apps, we store a device token issued by Google Firebase Cloud Messaging. You can withdraw this at any time in your device settings.
• Guest participants: if you join without an account, we process the display name you choose, any email address used to invite you, and the meeting content above. Guests do not need to create an account or give an email address to join.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain and improve the Service
• Authenticate you and keep your account secure
• Process payments and manage subscriptions and invoices
• Send invitations, reminders, technical notices and support messages
• Deliver push notifications you have enabled
• Provide meeting features such as chat, polls, file sharing and whiteboards
• Diagnose, troubleshoot and fix crashes and technical problems
• Detect, prevent and address fraud, abuse and security incidents
• Comply with our legal obligations

4. Legal Bases for Processing

Where the GDPR or comparable law applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service, your account and paid features.
• Legitimate interests — to secure the Service, prevent abuse, and improve and diagnose it, balanced against your rights.
• Legal obligation — to keep billing and tax records and to respond to lawful requests.
• Consent — for optional features such as push notifications and, where required, non-essential analytics. You can withdraw consent at any time.
• Vital interests or public interest — in the rare circumstances the law requires.

5. When We Share Information

We do not sell your personal information, and we do not use meeting content for advertising or to train AI models. We share personal data only with the service providers listed below, who process it on our instructions, and where required by law:

• With our subprocessors, listed in section 6
• With professional advisers and auditors under confidentiality obligations
• To comply with legal obligations or valid legal requests
• To protect and defend our rights, property and users
• With your consent or at your direction

6. Subprocessors

We use the following service providers (subprocessors) to run the Service. Each is bound by a data-processing agreement, and transfers outside the EEA are covered by the safeguards described in section 7.

• Amazon Web Services (AWS EMEA SARL) — cloud hosting for our API and database, and encrypted object storage for files, avatars and logos; EU (Frankfurt, eu-central-1).
• LiveKit, Inc. — managed real-time audio, video and data infrastructure. Media is relayed in real time and LiveKit does not record meetings.
• PostHog (EU cloud) — product analytics, error and diagnostic tracking, and our support inbox; EU (eu.i.posthog.com).
• Svix — delivery of outbound webhooks to endpoints you configure; EU cluster by default.
• Paddle (Paddle.com Market Ltd, UK) — payment processing and Merchant of Record.
• Google Firebase Cloud Messaging (Google LLC) — delivery of mobile push notifications; device token and notification payload.
• Cloudflare, Inc. — DNS, TLS, transactional email delivery and Turnstile bot protection; email addresses, IP addresses and message content.

Optional integrations and features

These providers are used only when the relevant feature is enabled for your account:

• Polar — usage-based billing for organisations, where enabled.
• Zoom Video Communications, Inc. — only if you connect a Zoom account; Zoom account tokens and meeting or attendance data.
• Meta Platforms, Inc. (WhatsApp Cloud API) — only if you enable WhatsApp reminders; phone number and message content.
• Gravatar (Automattic Inc.) — only to display an avatar based on a hash of your email address.
• LiveKit Inference — provides the speech-to-text and language model used by optional live captions and the teaching copilot; audio is processed in real time and transcript segments are not stored.

Our Data Processing Agreement, including the current subprocessor list, is available for download as a PDF.

7. International Data Transfers

We store the Service's primary data in the EU/EEA (AWS Frankfurt, eu-central-1), and our analytics provider is hosted in the EU. We are established in Türkiye, and our personnel may access personal data from there to provide support and maintain the Service. Some of our subprocessors are established outside the EEA or operate global networks, so personal data may also be processed in the United States, the United Kingdom or other countries. Where we or our subprocessors transfer personal data out of the EEA or the UK — including access from Türkiye — we rely on appropriate safeguards: the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and, where applicable, the EU-U.S. and UK Extension to the Data Privacy Framework. You can request a copy of the relevant safeguards from privacy@sonacove.com.

8. Data Retention

We keep personal data only as long as needed for the purposes described above:

• Account, organisation and room data — for as long as your account is active.
• Meeting history (attendance, chat, polls, shared-file references) — retained for as long as the room's hosting account remains active, because it forms part of a shared meeting record.
• Billing and tax records — retained as required by tax and accounting law, typically up to 10 years.
• Analytics and diagnostic data — retained for a limited period configured in our analytics provider, currently up to 30 days for event data.
• Files, avatars and logos — until you or an authorised participant delete them, or the account is deleted.
• When you delete your account we delete your profile, credentials, sessions, rooms, subscriptions, push tokens and avatar. Some records, including meeting history and shared files, may be retained where they are shared with other participants or where we have a legal obligation; you can request their erasure at privacy@sonacove.com.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including encryption in transit and at rest, access controls, and regular backups. However, no method of transmission over the Internet or electronic storage is 100% secure.

10. Recording, Transcription and AI Features

Recording is off by default and is started by a participant. Recordings are saved to the recorder's own device, not to our servers, and automatic cloud recording is disabled. If a recorder chooses to upload a recording, it is stored as a shared file and subject to the same controls and retention as other shared files. Live transcription and the teaching copilot are optional and enabled per meeting; audio is processed by LiveKit Inference to produce captions or AI output, and transcript segments are not stored on our servers. We do not use meeting content to train AI models.

11. Guest Participants

Guests can join a meeting without an account. For guests we process the display name entered, the meeting content described above, and connection data such as IP address and device information. If a host invites a guest by email, that email address is stored with the invitation and may appear in the meeting's participant record. Guests can exercise their rights using the contact details below; because we may not be able to identify a guest on our own, we may need the meeting link and approximate time to locate the record.

12. Your Rights

Where the GDPR or comparable law applies, you have the right to:

• Access and receive a copy of your personal data
• Rectify inaccurate or incomplete personal data
• Erase your personal data (the right to be forgotten)
• Restrict or object to our processing
• Data portability
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with your local supervisory authority

To exercise these rights, contact privacy@sonacove.com. If you are a guest at an organisation's meeting, we may direct your request to that organisation as the controller of the meeting content.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data without appropriate consent. Schools and organisations that use Sonacove with younger students are responsible for obtaining any required parental or guardian consent. If you believe a child has provided us with personal data, contact privacy@sonacove.com.

14. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on this page and, where appropriate, by email. The date at the top of this page shows when it was last updated.

15. Contact Us