Privacy Policy

This policy explains what personal data SOMPO AI ("we", "us") collects, why, and what choices you have. The data controller is [company legal name and registered address]. It describes the Service as it works today; we will update it before we add features that process more data.

1. What we collect

Account details you give us: name, email address, country, language, time zone, the role you chose (promoter or follower) and, for promoters, company information such as company name, legal name and website. Your password is never stored: we keep only a one-way hash.

Team and workspace data: which companies you belong to, your role, and invitations sent to or by you.

Security and technical data: your IP address, used for rate limiting and security logs, is stored only as a keyed hash that we cannot turn back into the address. For mobile sign-ins we keep the device name and platform you provide and when the device was last used. Our server logs record technical events and errors, with secrets and passwords redacted.

Records of actions: sensitive actions (for example sign-ins, role changes, account suspensions and administrator changes) are written to an audit log with the time, the acting account and, for administrator actions, the reason given.

Your acceptance of these documents: the version and time you accepted.

2. Why we use it, and our legal basis

To create and run your account and workspace, which is necessary to provide the Service you asked for (performance of a contract). To keep the Service secure, prevent abuse and keep audit records, which is our legitimate interest and, where applicable, a legal obligation. To send service emails such as address verification, password reset, sign-in codes and team invitations, which is necessary to provide the Service. We do not use your data for advertising and we do not sell it.

3. Cookies and similar technologies

We use one strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery. We do not use advertising or analytics cookies, and the pages load their scripts and fonts from our own servers rather than from third parties. The mobile app uses access tokens instead of cookies. Because the cookie is strictly necessary, it does not need your consent.

4. Who we share data with

Service providers that help us run the Service, acting on our instructions: our email delivery provider (Mailgun) receives the recipient address and message content of the emails we send; our hosting provider [hosting provider and location to be confirmed] stores the data. Other members of your company workspace can see your name and role (and, if they can manage the team, your email address). We may disclose data where the law requires it or to protect rights and safety.

5. Where data is processed

[Hosting location and any international transfers, and the safeguards used, to be confirmed.]

6. How long we keep it

We keep account data while your account exists. Audit and security records are kept for as long as needed for security, accountability and legal compliance; we will set and publish retention periods before financial features launch (we expect to keep financial records for the period required by law, by default ten years). Email verification and password-reset tokens expire within hours or days and are deleted by routine maintenance. Backups are kept for [backup retention to be confirmed] and then overwritten.

7. How we protect it

Passwords are hashed; secrets such as service credentials are encrypted at rest; traffic uses HTTPS; companies' data is separated from each other; and access to administrator functions is permissioned and audited. No system is perfectly secure, and we will tell affected people and the authorities where the law requires us to.

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to some processing, receive a copy in a portable format, and complain to your data-protection authority. You can already correct your name, language, country and time zone in your account settings. For other requests, including deleting your account, contact us at [support email]; we will respond within the time required by law. Automated self-service export and deletion are not yet available.

9. Children

The Service is not directed to children, and you must be old enough to enter a binding contract where you live. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes

We will publish changes on this page and update the date above. If a change is significant we will tell you through the Service or by email.

11. Contact

[Company legal name], [registered address]. Email: [support email]. [Data protection officer or grievance officer details, if required in your jurisdiction.]