Last updated: 27 September 2026
This policy explains how Sonian handles personal data: what we collect, why, who we share it with, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
Sonian is operated by Bruxon Tech BV, a company registered in Belgium.
- Company: Bruxon Tech BV
- Enterprise number: BE 1037.015.221
- Registered address: Termolenhoflaan 62/4, 1731 Asse, Belgium
- Privacy contact: info@sonian.ai
In this policy, "Sonian", "we" and "us" mean Bruxon Tech BV.
2. Our two roles
Controller. We are the controller of the personal data we collect to run our business: your account details, billing information, website visits, and access or demo requests.
Processor. The contracts, policies and other documents your organisation uploads to Sonian, and the review results generated from them, belong to your organisation. For that content, your organisation is the controller and we process it only on its instructions, to provide the service. If a document you upload contains personal data about someone else, your organisation is responsible for having a lawful basis to process it.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, work email, organisation, sign-in method (email link, Google or GitHub), role | You, when you create an account |
| Access and demo requests | Name, work email, company, role and any message you send | Forms on sonian.ai |
| Customer content | Documents you upload, playbooks, review results, comments | You and your team, while using the service |
| Billing data | Billing contact, company details, VAT number. Card details are handled by Stripe and never stored by us. | You, when you subscribe |
| Usage and technical data | IP address, browser and device type, pages visited, actions in the product, error logs | Automatically, when you use sonian.ai or the app |
| Communications | Emails and support messages you exchange with us | You |
We do not knowingly collect special-category data (such as health data) about our users, and the service is not intended for use by children.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the service, create and secure your account, process your documents | Performance of a contract |
| Respond to access and demo requests | Steps taken at your request before a contract |
| Billing, invoicing and accounting | Legal obligation; performance of a contract |
| Keep the service secure, prevent abuse, fix errors | Legitimate interest |
| Measure how the website is used (Google Analytics) | Consent, given through the cookie banner |
| Send essential service emails (security, changes to these terms) | Performance of a contract |
| Send occasional product news | Legitimate interest for existing customers, consent otherwise. You can opt out at any time. |
We do not sell personal data, and we do not use your documents to train AI models. The AI providers we use process your content only to return a result to you and, under their API terms, do not use it to train their models.
5. Who we share it with
We share personal data only with the service providers (subprocessors) that help us run Sonian, under written agreements that require them to protect it.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Application hosting, database, document storage and processing | European Union |
| Qdrant Cloud | Search index for your documents | European Union |
| OpenAI | AI analysis of documents | United States |
| Cohere | Search ranking of document passages | United States / Canada |
| Stripe | Payments and invoicing | United States / EU |
| Mailgun | Transactional email | United States |
| Sentry | Error monitoring | United States |
| Sign-in with Google; website analytics (only with your consent) | United States / EU | |
| GitHub | Sign-in with GitHub (only if you choose it) | United States |
We may also disclose data where the law requires it, or to protect our rights, our users or the public. If Bruxon Tech BV is involved in a merger or acquisition, personal data may transfer to the new owner under the same protections.
We will update this list before adding a new subprocessor that processes customer content.
6. International transfers
Your account data and documents are stored in the European Union. Some of the providers above are based outside the EU/EEA. When personal data is transferred to them, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
7. How long we keep it
| Data | Retention |
|---|---|
| Account data and customer content | For as long as your organisation's account is active. You can delete documents at any time. |
| After the account closes | Deleted from our active systems within 30 days, unless your organisation asks for an export first. Backups are overwritten on a rolling cycle. |
| Access and demo requests | Up to 24 months after our last contact, unless you become a customer |
| Billing records | 7 years, as required by Belgian accounting law |
| Technical logs | Up to 12 months |
8. How we protect it
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the people who need it to run the service. Each organisation's documents are isolated from other organisations' documents.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is inaccurate or incomplete;
- erase your data, where there is no reason for us to keep it;
- restrict or object to certain processing, including direct marketing;
- data portability: receive your data in a structured, machine-readable format;
- withdraw consent at any time, where we rely on consent, without affecting earlier processing.
To exercise any of these rights, email info@sonian.ai. We will respond within one month. If your request concerns documents your organisation uploaded, we may refer you to your organisation, as the controller of that content.
You also have the right to complain to a data protection authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données (dataprotectionauthority.be). We would appreciate the chance to address your concern first.
10. Cookies
We use strictly necessary cookies to keep you signed in and secure. Analytics cookies load only after you accept them in the cookie banner, and you can change your choice at any time. See our cookie policy.
11. Data Processing Agreement
For customer content, the terms of our processing are set out in our Data Processing Agreement (DPA), available on request at info@sonian.ai.
12. Changes to this policy
We may update this policy as the service evolves. We will change the "last updated" date above and, for material changes, notify account holders by email before the change takes effect.
13. Contact
Bruxon Tech BV
Termolenhoflaan 62/4, 1731 Asse, Belgium
info@sonian.ai