← Back to SoundAgent

Privacy Policy

Last updated: July 14, 2026

1. Who we are

SoundAgent ("we", "our", "us") is a project management platform. This policy explains how we collect, use, and protect your personal data when you use our service at soundagent.io.

2. Data we collect

  • Account data: your name, email address, and password hash when you register.
  • Organisation data: names, projects, activities, and other content you create inside SoundAgent.
  • Usage data: IP address, user agent, and audit log entries generated by your actions in the app.
  • Billing data: subscription status and customer ID managed by Lemon Squeezy. We do not store payment card details.
  • AI data: messages sent to the AI assistant, stored encrypted (AES-256-GCM) at rest.

3. How we use your data

  • To provide and operate the SoundAgent service.
  • To send transactional emails (invitations, password resets, billing receipts).
  • To detect and prevent fraud or security incidents.
  • To fulfil our legal obligations.

We do not sell your personal data. We do not use your data for advertising.

4. Data sharing

We share data only with the following sub-processors required to operate the service:

  • Supabase — PostgreSQL database hosting (EU region available).
  • Vercel — application hosting and edge network.
  • Lemon Squeezy — payment and subscription processing.
  • Anthropic / OpenAI / Google — AI features (when enabled). Only the content you submit to the AI assistant is sent.
  • Pusher — real-time notifications.
  • PostHog — product analytics (EU region, eu.i.posthog.com). Loaded only after you grant cookie consent.

5. Data retention

We retain your data for as long as your account is active. When you delete your account, your personal data is deleted within 30 days. Anonymised aggregate data may be retained indefinitely.

6. Your GDPR rights and legal bases

SoundAgent is the data controller for the personal data described in this policy. If you are in the European Economic Area or the UK, the General Data Protection Regulation (GDPR) gives you the rights below.

Legal bases we rely on:

  • Contract (Art. 6(1)(b)) — to provide the service you sign up for, including account, organisation, and billing data.
  • Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent fraud, and maintain audit logs.
  • Consent (Art. 6(1)(a)) — for optional analytics cookies. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other laws.

Your rights:

  • Access a copy of the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten").
  • Restrict or object to certain processing.
  • Data portability — receive your data in a machine-readable format.
  • Withdraw consent for analytics at any time.

To exercise any of these rights, contact us at privacy@soundagent.io. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority — in the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

International transfers:

Our database and analytics are hosted in the EU. Some AI sub-processors (Anthropic, OpenAI, Google) process data in the United States. Where data leaves the EEA, transfers are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

7. Cookies and similar technologies

We use the following categories of cookies and browser storage. We do not use advertising cookies and we do not sell data to third parties.

  • Strictly necessary: a first-party HTTP-only cookie (activeOrgId) that remembers your active organisation, plus the session cookie that keeps you signed in. These are required for the service to function and cannot be switched off.
  • Analytics (optional): if you accept cookies, PostHog sets first-party storage (a localStorage entry and a cookie) to measure page views and product usage so we can improve SoundAgent. These load only after you click "Accept" in the cookie banner, and are never set if you decline.

You can withdraw analytics consent at any time by clearing the cookie_consent value in your browser storage, which will re-display the banner on your next visit. Declining analytics does not affect your access to the service.

8. Security

All data is transmitted over HTTPS. Sensitive data (AI conversation history) is encrypted at rest. Passwords are stored as bcrypt hashes. We perform regular security audits.

9. Changes

We may update this policy. We will notify you by email or in-app banner for material changes. Continued use after notice constitutes acceptance.

10. Contact

Questions about this policy: privacy@soundagent.io