Privacy Policy

1. Who we are and what this policy covers

Sonique Ltd., trading as Sonique AI ("Sonique," "we," "us"), provides the Sonique AI website and client Portal. This policy explains how we handle personal information across these services, including guest assessments, accounts, bookings, support and enabled Portal features. It also covers related communications and business relationships that refer to this policy.

We are responsible for personal information we use to operate these services, manage our business relationships, administer accounts and billing, and protect the service. Under applicable data-protection law, we act as the controller for those purposes.

When we process personal information solely on a client organization's instructions, that organization determines the purposes of processing and we act as its processor or service provider. The organization's privacy notice explains its purposes. Any separate services or data processing agreement that we enter into with it also governs that arrangement. This does not exclude our own account, security or relationship processing from this policy or limit your statutory rights.

This policy explains our practices; reading it or accepting our Terms of Service does not supply consent for optional processing.

2. Information we collect and where it comes from

We collect information you provide, information generated through service use, and information from the people and services involved in your relationship with us.

• Inquiries, accounts and organizations: Name, email, phone number when provided, company, role, account identifiers, access permissions, messages and verification or authentication records.
• Assessments and assistance: Answers, business activities, objectives, systems, classifications, location context, language preferences and assessment-help conversations. Generated results include scores, findings, recommendations and plans.
• Reports and bookings: Report records, delivery and access information, selected sharing choices, attendee details, appointment times, call details and related correspondence.
• Client and support chat: Messages, participants, sender details, room information and timestamps.
• Billing: Billing contacts, addresses, tax identifiers, subscriptions, invoices, service usage, transaction references and limited payment-method details, such as card brand, last four digits and expiry. Payment details entered into the payment provider's hosted forms are processed by that provider.
• Optional profile photos: The image you upload and associated profile information. Profile images are stored at a publicly accessible image address; anyone with that address may be able to view them.
• Service activity: IP address, browser/device details, authentication events, diagnostic and security records, pages or features used, interactions, referral information and campaign attribution. The information depends on the service and your applicable choices.

A "call" means a phone call or an online meeting with audio or video.

Your organization may supply your work identity, role or invitation details. We also receive relevant scheduling, payment and authentication information from connected providers. Business-contact information may come from referrals, public professional or company sources, and business-contact services. We use it for the purposes below and provide any additional notice required when information comes from another source.

Provide only information relevant to the service. Do not place payment credentials, government identifiers, health records or other highly sensitive information in ordinary messages or assessment fields unless we specifically request it through an appropriate channel.

3. Why we process information

We use personal information to:

• Answer inquiries, deliver requested assessments and reports, arrange calls and meetings and provide contracted services.
• Establish and secure accounts, verify identity, administer organizational access and support SSO.
• Generate assessment assistance and analysis, save results and support authorized review and follow-up.
• Manage client correspondence, support requests, billing, subscriptions and business records.
• Maintain service reliability, investigate errors, prevent abuse and protect accounts and information.
• Understand service use and campaign effectiveness, subject to applicable choices.
• Send permitted marketing communications and record consent, preferences and unsubscribe requests.
• Meet legal duties, address complaints and establish or defend legal claims.

Where the GDPR or UK GDPR applies, the relevant bases are:

• Services you request or purchase personally: Contract performance or steps you request before entering a contract.
• Managing a client organization's account, its authorized users, support and business relationships: Legitimate interests in delivering and administering the organization's services, unless we process solely on its instructions.
• Security, fraud prevention, service diagnosis and legal claims: Legitimate interests in protecting people, systems and our business, subject to the balancing required by law.
• Aggregate analytics on the Sonique AI website: Legitimate interests in understanding and improving the website, subject to your right to object.
• Optional analytics, attribution, improvement uses and marketing where consent is required: Consent, which you may withdraw. For permitted business marketing that does not require consent, our legitimate interest in relevant business communication, subject to your right to object.
• Tax, accounting and other necessary records or disclosures: Legal obligations recognized by the applicable data-protection law, or legitimate interests in necessary business recordkeeping where appropriate.

We obtain consent where Canadian law requires it. A legitimate-interest basis under European law does not replace consent required by electronic-marketing or browser-storage rules.

Required information is identified in the relevant interaction. Without identity verification we cannot provide protected account access; without required assessment, booking or billing details we may be unable to complete that request. Optional information and optional marketing are not required to use unrelated core services.

4. AI processing, reports and access

We use AI services, including OpenAI for supported assessment functions, to process submitted answers and relevant business and conversation context into assistance, analysis and reports. Information sent for this purpose may identify you or your organization; do not assume that an assessment is anonymous.

Assessment scores and recommendations summarize the information supplied and support human business decisions. They can be incomplete or inaccurate. You can contact us about inaccurate personal information or a concern with an assessment result.

We use submissions and generated results to deliver and support your assessment. Any optional use of personal information for product improvement is explained separately and follows the applicable choices. Acceptance of our Terms is not permission for an unrelated optional use.

Authorized Sonique personnel can access information needed for support, service delivery, administration or security. Guest report summaries and full internal analysis are different records; receiving a summary does not mean that it contains everything retained about the assessment. Client access depends on organizational permissions. If you choose to associate an assessment with a booking, we use the selected report to prepare for that call. That sharing choice is separate from marketing consent.

5. Browser storage, analytics and communications

We use browser storage and similar technologies for sign-in, security, preferences, requested draft recovery and recognizing visits that start from links in our emails. Some storage lasts for a browser session; other storage can remain between visits, including remembered sign-in or saved drafts. Clearing browser data may remove a local draft or sign you out, but does not delete server records.

Analytics help us understand page and feature use; attribution helps identify the campaign or referral that brought you to us. These are distinct purposes. Analytics can process interaction, page/referral and network/device information even when it does not use cookies.

On the Sonique AI website (soniqueai.io, not the client Portal), we use Plausible for cookieless, aggregate analytics. It records the pages viewed, referring sites, campaign tags in links (such as UTM parameters), outbound-link clicks, file downloads, how far each page is scrolled and how long it is actively viewed. It uses the IP address and browser information sent with each request to estimate approximate location (country, region and city), browser, operating system and device type, and to count unique visitors. Plausible does not set cookies or store an identifier in your browser, and its reports show totals and trends rather than individual visitor histories. We use these statistics to understand and improve the website and, where the GDPR or UK GDPR applies, rely on our legitimate interest in doing so.

You can object to analytics or attribution using the contact below. On the website, you can also prevent analytics data from being sent by using browser settings or extensions that block requests to analytics services. Because Plausible statistics are aggregate and not linked to your identity, we generally cannot find or remove an individual visit within them. Objecting does not stop necessary security or requested-service processing.

We may send follow-up emails about your assessment and our services. We measure email opens, link clicks and website visits to help improve those emails and services. You can unsubscribe from any email at any time.

Our sales and marketing emails may record when a message is opened and when a link in it is clicked. Links in those emails to the Sonique AI website can include a random reference code that does not contain your name or email address. When you arrive through such a link, the website removes the code from the page address before analytics runs and keeps it in your browser's session storage, which is cleared when you close that tab. While the tab stays open, the website sends the code with each page you view, and we add the time of your visit and the pages you viewed to your contact record in our sales system (Apollo). We also use the IP address of each request to protect this feature from misuse. Open and click records are approximate, because some email services and security tools load images or follow links automatically. You can limit open recording by blocking images in your email, and you can object to this activity, or unsubscribe from our marketing emails, using the link in any message or the contact below.

For commercial electronic messages, we obtain express consent or rely on another basis specifically permitted by the applicable rules, including valid implied consent under Canada's anti-spam legislation (CASL). We identify the sender, provide contact details and an unsubscribe mechanism, and maintain records supporting our sending permissions.

You can object to direct marketing or unsubscribe at any time, free of charge, using the message's unsubscribe link or the contact below. We act on requests promptly and, for CASL-covered messages, within 10 business days. We retain the minimum suppression information needed to respect your choice. Requested report, verification, security, booking or billing communications continue where permitted; adding promotional content does not make a message exempt from marketing rules.

6. Who receives information

We do not sell personal information or share it for advertising across unrelated businesses' websites and services.

We use providers for hosting and storage, authentication, AI and voice processing, email, scheduling, payment handling, customer relationship management, analytics and security. Relevant services include Supabase for account and service records; OpenAI for supported assessment processing; Postmark for delivery; Cal.com and Google Workspace for bookings and calls; Apollo for business-contact and relationship records; Stripe for payments; and Plausible for enabled analytics. Voice and avatar modes use the configured service, which may include OpenAI, ElevenLabs, LiveAvatar or browser speech services. The providers involved depend on the feature you use.

Providers acting for us receive information needed for their work and are subject to appropriate processing and confidentiality terms. Some recipients, such as an organization-selected identity provider or a payment provider acting for its own regulatory purposes, have independent responsibilities and privacy notices. We remain responsible for our own disclosures and provider arrangements.

We also disclose relevant information to authorized members of your organization; recipients you select or ask us to contact; professional advisers; authorities or other parties where lawfully required or necessary to protect rights; and parties to a business transaction under appropriate confidentiality and privacy safeguards.

7. International processing

We are based in Canada. Information may be processed in Canada and other countries where our providers operate, including the United States. Foreign laws may allow access by courts or public authorities, and may differ from the laws where you live.

For transfers subject to European or UK transfer rules, we use an applicable adequacy decision or appropriate safeguards, such as approved contractual clauses and any required supplementary measures. You can contact us for information about the safeguards relevant to your information and how to obtain a copy, with necessary confidential details protected.

8. Retention and deletion

We determine retention by the purpose, sensitivity, service relationship and applicable legal requirements:

• Account and organization records support active access, administration and necessary closure activities.
• Assessment answers, analysis, reports and correspondence support delivery, authorized access and relevant follow-up. An expired download link or deleted report file does not itself erase all underlying records.
• Prospect and relationship records are assessed against ongoing contact purposes, interaction history and your choices; they are not retained indefinitely merely because an assessment once existed.
• Invoices, contract records and relevant audit/security information follow applicable accounting, legal, investigation and claim requirements.
• Consent and suppression records are retained as needed to demonstrate and respect communication choices. Local drafts, temporary files and recovery copies follow the purposes and lifecycle of the relevant system.

We delete or effectively anonymize information when no justified retention purpose remains. Legal holds and other lawful exceptions can require limited retention. Backups and provider-held copies have their own controlled deletion cycles; account closure is not a promise of immediate removal from every copy. We coordinate applicable requests with our processors and explain relevant exceptions. Copies held independently by your organization or recipients may require a request to them.

9. Your rights and choices

Depending on the law that applies, you can request access to your personal information, correction, deletion, restriction of processing or a portable copy. You may object to processing based on legitimate interests for reasons relating to your situation and exercise applicable rights concerning automated decisions. Withdrawal of consent affects future processing and does not invalidate earlier lawful processing.

Contact us below to make a request; an account is not required. We may need proportionate information to verify identity or authority. We respond within applicable deadlines and explain any lawful limitation. If your request concerns information controlled by a client organization, we help direct it to that organization and assist it as required. This does not prevent you from asking about processing for which Sonique is responsible.

You may complain to the Office of the Privacy Commissioner of Canada or the relevant provincial regulator. Where European or UK data-protection law applies, you may also complain to the supervisory authority for your habitual residence, workplace or the alleged infringement, as applicable. You do not have to contact us before approaching a regulator.

10. Security, children and policy changes

We use administrative, technical and organizational measures appropriate to the information and risks, including restricting access to authorized purposes. No service can guarantee absolute security. For further information about our safeguards and assurance work, visit Security & Trust.

Our services are for business use and are not directed to children under 16. Contact us if you believe a child has provided personal information so we can address it appropriately.

We update this policy when our practices change and identify the effective date above. We provide additional notice of material changes and obtain further consent where required before beginning a new consent-based use.

We may provide translations of our website, Portal, and this policy as a courtesy. Translations may be machine-generated and may contain errors. Unless applicable law requires otherwise, if a translation differs from the English version, the English version prevails.

11. Contact

For privacy questions, rights requests or security concerns, contact:

Sonique Ltd., trading as Sonique AI Privacy and security contact: security@soniqueai.io Mailing address: 18 King Street East, Suite 1400 Toronto, Ontario M5C 1C4 Canada