Privacy & GDPR

1. Who we are

Sohobyte AI is a trading name and product of Sohobyte Ltd, a company registered in England and Wales under company number 16940389.

For account, website, billing and business administration data, Sohobyte Ltd generally acts as the data controller. When we process visitor conversations and customer-provided content on behalf of a business customer, we may act as a data processor and the customer remains the controller.

2. Information we collect

• Account information, including name, email address, authentication identifiers and organisation details.
• Workspace information, including business context, website details, widget configuration, uploaded knowledge and FAQs.
• Billing information, including subscription status, billing currency, Stripe customer and subscription identifiers. We do not store complete card details.
• Conversation information, including questions submitted to an AI assistant, responses, timestamps and derived intent or analytics data.
• Contact and sales enquiry information, including name, email, company, website URL, enquiry type and message.
• Technical information, including IP address, browser information, device information, logs, security events and usage activity.
• Product feedback, support requests and communications sent to Sohobyte.
• Cookie preferences and analytics information where analytics has been enabled with the required consent.

3. How we use information

• To create and administer accounts and workspaces.
• To provide, secure, maintain and improve Sohobyte AI.
• To generate AI responses and conversation insights.
• To process payments, subscriptions, renewals and cancellations.
• To respond to product, sales, Enterprise, partnership and support enquiries.
• To detect abuse, investigate incidents and protect customers and the service.
• To understand product usage and improve features and user experience.
• To comply with legal, accounting and regulatory obligations.

4. Legal bases

Depending on the circumstances, we process personal information because it is necessary to perform a contract, comply with a legal obligation, pursue legitimate business interests, or because consent has been provided.

Where consent is used, including for non-essential analytics cookies, consent may be withdrawn at any time without affecting processing that occurred before withdrawal.

5. AI processing

Customer-provided knowledge and visitor messages may be transmitted to AI service providers to generate responses or derive insights. Customers must ensure that they have an appropriate legal basis for information they submit or collect through their assistant.

Customers should not intentionally submit special-category data, payment-card information, government identifiers, medical records or other highly sensitive information unless Sohobyte has expressly agreed to process it under a separate Enterprise agreement.

6. Service providers and international transfers

We use specialist service providers to operate Sohobyte AI. These may include Vercel for hosting, Google Firebase and Google Cloud for authentication and databases, Stripe for billing, Resend for transactional email and OpenAI for AI processing.

Some providers may process information outside the United Kingdom or European Economic Area. Where required, we rely on recognised safeguards such as adequacy regulations, approved contractual clauses or other lawful transfer mechanisms.

7. Retention

• Account and workspace information is retained while an account remains active and for a reasonable period afterwards for security, dispute resolution and legal compliance.
• Billing and transaction records may be retained for the periods required by tax, accounting and company law.
• Contact enquiries and support communications may normally be retained for up to 24 months after the last meaningful interaction.
• Technical and security logs may be retained for shorter operational periods unless needed to investigate abuse or an incident.
• Conversation and analytics retention may depend on the customer plan, configuration and contractual requirements.

8. Sharing information

We do not sell personal information. We may share information with service providers, professional advisers, authorities where legally required, or a purchaser or successor in connection with a genuine corporate transaction.

Service providers are authorised to process information only for the purposes required to provide their services to Sohobyte.

9. Your rights

• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion in circumstances where the law provides that right.
• Request restriction of processing.
• Object to certain processing based on legitimate interests.
• Request portability of information where applicable.
• Withdraw consent where processing relies on consent.
• Complain to the UK Information Commissioner's Office or another competent supervisory authority.

10. Security

We use technical and organisational safeguards intended to protect information, including access controls, authentication, encrypted transport, restricted administrative access, domain controls and security monitoring.

No internet service can guarantee absolute security. Customers are responsible for protecting their login credentials and configuring their assistants appropriately.

11. Children

Sohobyte AI is intended for businesses and professionals. Users must be at least 18 years old and legally capable of entering into a contract. We do not knowingly offer accounts directly to children.

12. Changes to this policy

We may update this policy as the service, law or our processing activities change. Material changes will be communicated through the service, by email or by an updated notice on this page.