Your privacy rights and our current practices
Revision: 2.0
This page explains how Sophosic handles privacy requests and covers our service providers, data retention, and current audit and certification status. It describes our practices and is not legal advice or an independent certification.
1. Privacy Rights
Depending on where you live and how the law applies, you may have rights to learn how personal data is used, access it, correct it, delete it, restrict or object to certain processing, or receive a portable copy. Requests can be subject to identity verification, legal exceptions, and the role Sophosic has in processing the data.
Official guidance: European Commission data-protection rights and the California Attorney General's CCPA guidance.
Submit a request to [email protected]. We may ask for information needed to verify the request and locate the relevant account or workspace.
2. California Privacy Choices
California residents may have rights to know, delete, or correct personal information; opt out of certain sale or sharing; limit some uses of sensitive personal information; and receive equal service when exercising those rights. Sophosic does not sell personal information for money. Our Privacy Policy explains when an enabled advertising integration may be treated as sharing under applicable law and how consent controls or Global Privacy Control can be used.
3. Data Processing Terms
Customers with contractual data-protection requirements can contact [email protected] to discuss available terms, processing scope, and transfer safeguards. Availability depends on the service, plan, jurisdiction, and requested obligations; this page does not promise a custom DPA or a particular transfer mechanism for every account.
4. Core Service Providers and Integrations
We use service providers to operate Sophosic. Some optional integrations process data only when a workspace enables the relevant feature. The Privacy Policy provides the controlling disclosure.
| Provider | Purpose | Scope |
|---|---|---|
| Google Cloud | Application infrastructure | Core service |
| Supabase | Database and authentication | Core service |
| OpenAI | Sophia AI processing | Feature use |
| Stripe | Payments and subscriptions | Commerce use |
| Sentry | Error and performance diagnostics | Core service |
| SendGrid and OpenSRS | Platform and customer-facing email | Notification use |
| Apple Push Notification service | Requested mobile notifications | Mobile use |
| Meta | Book Now and measurement tools | Optional integration |
5. Logs, Retention, and Deletion
We retain account, business, security, and diagnostic data for as long as needed to provide the service and meet legitimate operational, contractual, security, dispute-resolution, and legal obligations. Retention varies by data category and provider; backup and log copies may expire on a different schedule from active records.
Verified deletion requests are handled subject to applicable law, security needs, contractual obligations, and technical backup lifecycles. We do not publish a universal deletion or log-retention deadline that applies to every system.
6. Audit and certification status
Sophosic does not currently claim SOC 2, ISO 27001, or HIPAA certification. Some infrastructure providers publish their own audit reports and certifications; those cover the provider's controls and do not transfer to Sophosic. Ask [email protected] for the current status before relying on a certification or regulated workload requirement.
7. Contact
- Privacy requests: [email protected]
- Contract questions: [email protected]
- General questions: contact page