Privacy Policy

Welcome to Sociaity. This Privacy Policy explains how Sociaity Inc. ("Sociaity," "we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our website (sociaity.com), mobile applications (iOS and Android), and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

We collect information you provide directly, information generated through your use of the Service, and information from third-party sources.

1. Information You Provide Directly

Account Information

• Email address (required)
• Full name
• Username
• Password (encrypted)
• Profile picture (optional)
• About/bio text (optional)
• Phone number (optional)
• Interests and group preferences

Group and Community Content

• Posts, comments, and messages
• Notes and documents you create
• Tasks and team information
• Files you upload (images, documents, media)
• Group descriptions and settings
• Content you post (e.g., text, images, videos) within groups or on your profile

AI Interactions

• Messages and prompts you send to AI agents
• Documents and context you share with AI
• AI conversation history
• Feedback you provide on AI responses

Communications

• Messages you send to us (support, feedback)
• Survey responses
• Email communications preferences

Payment Information (if applicable)

• Payment method details (processed by third-party payment processors)
• Billing address
• Transaction history

2. Information Collected Automatically

Usage Data

• Pages and features you access
• Time spent on the Service
• Clicks, scrolls, and interactions
• Search queries
• Device information (type, OS, browser)
• IP address and approximate location (city/country level)
• Referral source (how you found us)
• The pages of our Service that you visit
• The time and date of your visit
• The time spent on those pages
• Unique device identifiers and other diagnostic data

Technical Data

• Log files and error reports
• Performance metrics
• Session duration and frequency
• App crashes and diagnostics
• Your device's Internet Protocol address (e.g. IP address)
• Browser type and version
• Mobile device unique ID
• Mobile operating system
• Type of mobile Internet browser you use

Cookies and Similar Technologies

• Authentication cookies
• Analytics cookies (with your consent)
• Preference cookies

See the "Cookies and Tracking Technologies" section for details.

3. Information from Third Parties

Social Login (Optional)

If you sign up using Facebook Login, we receive:

• Name
• Email address
• Profile picture
• Public profile information
• Birthday (optional)
• Friends list (only friends who also use our app)
• Profile URL

We do NOT collect:

• Your Facebook friends list (beyond those using our app)
• Private messages
• Posts on your timeline
• Any information beyond what's listed above

4. Information While Using the Application

While using our mobile application, in order to provide features of our Service, we may collect, with your prior permission:

• Information regarding your location
• Information from your device's phone book (contacts list)
• Pictures and other information from your device's camera and photo library

We use this information to provide features of our Service, to improve and customize our Service, and to facilitate group interactions such as suggesting nearby groups or helping you invite contacts.

You can enable or disable access to this information at any time through your device settings.

How We Use Your Information

We use your information for the following purposes:

1. Provide and Improve the Service

• Create and maintain your account
• Enable group collaboration features (chat, tasks, notes, drive)
• Power AI agents and assistants
• Process your requests and transactions
• Provide customer support
• Fix bugs and improve performance
• Develop new features
• Monitor the usage of our Service
• Enable your participation in groups

Legal Basis (GDPR): Contract performance (Art. 6(1)(b))

2. Personalization and Recommendations

• Customize your experience
• Suggest relevant groups and content
• Provide AI-powered assistance based on your context
• Remember your preferences and settings

Legal Basis (GDPR): Legitimate interest (Art. 6(1)(f))

3. Analytics and Research

• Understand how users interact with the Service
• Measure feature adoption and engagement
• Conduct product research and testing
• Analyze usage patterns and trends
• Improve AI model performance (aggregated, anonymized data only)
• Determine the effectiveness of our promotional campaigns
• Evaluate and improve our Service, products, services, marketing and your experience
• Understand group engagement and user interests to enhance the platform

Legal Basis (GDPR): Legitimate interest (Art. 6(1)(f)) or Consent (Art. 6(1)(a)) for analytics cookies

4. Communications

• Send transactional emails (account verification, password resets)
• Notify you of important Service updates
• Respond to your inquiries
• Send marketing communications (with your consent, opt-out available)
• Contact you by email, telephone calls, SMS, or other equivalent forms of electronic communication, such as push notifications regarding updates or informative communications related to the functionalities, products or contracted services, including security updates
• Provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information

Legal Basis (GDPR): Contract performance (Art. 6(1)(b)) for transactional; Consent (Art. 6(1)(a)) for marketing

5. Security and Fraud Prevention

• Detect and prevent abuse, spam, and fraud
• Enforce our Terms of Service
• Protect against security threats
• Comply with legal obligations

Legal Basis (GDPR): Legal obligation (Art. 6(1)(c)) and Legitimate interest (Art. 6(1)(f))

6. Legal Compliance

• Respond to legal requests and court orders
• Comply with applicable laws and regulations
• Protect our rights and property
• Resolve disputes

Legal Basis (GDPR): Legal obligation (Art. 6(1)(c))

7. Business Transfers

We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our Service users is among the assets transferred.

8. Other Purposes

We may use your information for other purposes, such as data analysis, identifying usage trends, determining the effectiveness of our promotional campaigns and to evaluate and improve our Service, products, services, marketing and your experience.

Artificial Intelligence (AI) Features

Sociaity uses AI-powered agents to help you organize, plan, and collaborate within groups. This section explains how AI processes your data.

What AI Features We Offer

• AI Agents: Personal and group assistants for productivity
• Smart Suggestions: Automated content and task recommendations
• Document Analysis: Note summarization and document processing
• Intelligent Search: Context-aware search and retrieval
• Action Proposals: Team structures, channels, tasks, and workflows

How AI Processes Your Data

1. Operational Processing

• AI agents process your messages, notes, tasks, and group content to provide contextual assistance
• Processing happens in real-time to respond to your requests
• Data is processed through our AI service provider (AWS Bedrock using Anthropic Claude models)

2. Data We Share with AI Providers

• Your prompts and questions to AI agents
• Group context (teams, roles, tasks, notes, channels) when relevant to your request
• Documents and files you explicitly share with AI agents
• Conversation history within AI chat threads

3. What We Share with AWS Bedrock

4. Training and Model Improvement

What we DO:

• Use aggregated, anonymized interaction data to improve our AI features
• Analyze usage patterns (e.g., "users ask about tasks 30% of the time")
• Measure AI response quality and accuracy

What we DON'T do:

• Use your specific content to train third-party AI models
• Share your prompts or documents with Anthropic for training
• Sell your data to AI companies
• Use your private conversations for commercial purposes

5. Your Control

You can opt out of anonymized data analysis by contacting privacy@sociaity.com. This will not affect your ability to use AI features.

Your AI Rights

Automated Decision-Making

We do NOT use AI for automated decisions that significantly affect you, such as:

• Account suspension or termination (human review required)
• Payment processing or billing disputes
• Legal or compliance matters

AI is used for:

• Content suggestions and recommendations (you can ignore)
• Task and team structure proposals (you must approve)
• Document summarization (you control what to share)

Third-Party AI Provider Details

AWS Bedrock (Anthropic Claude)

• Purpose: Power AI agent functionality
• Data Processing Agreement: Yes, in place
• Data Retention: Zero retention mode — data is not stored after processing
• Training: Your data is NOT used for model training
• Provider Access: Anthropic does NOT have access to your data
• Privacy Policy: https://aws.amazon.com/privacy/
• Location: EU (Frankfurt) and US regions

Important note on AWS Bedrock data policy:

AWS Bedrock operates in "zero data retention" mode for Sociaity. This means:

• Your prompts and AI responses are processed in real-time
• Data is immediately discarded after the inference request completes
• AWS does not store your content for any purpose
• Model providers (Anthropic) have no access to your data

Exception: To help prevent child sexual abuse material (CSAM), AWS Bedrock uses automated mechanisms to identify CSAM in model input/output. Flagged content may be stored and reviewed for reporting purposes, even in zero retention mode.

Changes to AI Features

When we add new AI features that process personal data in materially different ways, we will:

• Update this Privacy Policy
• Notify you via email and in-app notification
• Provide a 30-day notice period before the change takes effect
• Give you the option to opt out or delete your data

Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files placed on your device (computer, phone, tablet) when you visit our website or use our app. They help us provide and improve the Service by remembering your preferences, keeping you logged in, and understanding how you use Sociaity.

Types of Cookies We Use

1. Essential Cookies (Always Active)

These cookies are necessary for the Service to function. You cannot opt out of these cookies.

Impact of blocking: If you block essential cookies, you will not be able to log in or use the Service.

2. Analytics Cookies (Optional — Requires Your Consent)

These cookies help us understand how you use the Service so we can improve it. You can opt out of these cookies.

Legal Basis (GDPR): Consent (Art. 6(1)(a))

What We Track with Analytics

We DO track:

• Which features you use (e.g., "user created a task")
• How often you use the Service
• Which pages you visit
• Time spent on different features
• Device type and operating system
• Approximate location (city/country level)
• Referral source (how you found us)

We DON'T track:

• Your exact GPS location
• The content of your messages, notes, or documents
• Your passwords or payment information
• Your activity on other websites (no cross-site tracking)
• Your personal conversations or private data

Your Cookie Choices

On the Website

When you first visit sociaity.com, you'll see a cookie consent banner with these options:

• Accept All — Allow all cookies including analytics
• Reject Non-Essential — Only essential cookies (no analytics)
• Customize — Choose which analytics providers to allow

To change your preferences, click "Cookie Settings" in the website footer anytime, update your choices and save.

In the Mobile App

• Open the app
• Go to Settings → Privacy
• Toggle Analytics on/off
• Changes take effect immediately

Browser Controls

Most browsers allow you to control cookies:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Edge: Settings → Cookies and site permissions → Cookies and site data

Note: Blocking all cookies will prevent you from logging in to Sociaity.

Do Not Track (DNT)

Some browsers offer a "Do Not Track" (DNT) signal. Currently, there is no industry standard for how to respond to DNT signals, so we do not respond to them. However, you can control tracking through the cookie settings described above.

Third-Party Analytics and Advertising

We do NOT:

• Use advertising cookies
• Sell your data to advertisers
• Allow third-party ad networks to track you on our Service
• Use retargeting or remarketing pixels

We DO:

• Use analytics services (Google Analytics, Firebase, Amplitude, App Radar) to understand usage
• Share anonymized, aggregated data with these providers
• Ensure these providers are contractually bound to protect your data

Mobile App Identifiers

iOS:

• We may collect your IDFA (Identifier for Advertisers) only if you grant permission
• Used solely for analytics, never for advertising
• You can reset or disable IDFA in iOS Settings → Privacy → Tracking

Android:

• We may collect your Advertising ID only if you grant permission
• Used solely for analytics, never for advertising
• You can reset or opt out in Android Settings → Google → Ads

Updates to Cookie Policy

We may update this Cookies section as we add or remove analytics providers. Check the "Last Updated" date at the top of this Privacy Policy. Material changes will be communicated via email and in-app notification.

How We Share Your Information

We do not sell your personal information to third parties. We only share your information in the following limited circumstances:

1. With Other Users (By Your Choice)

Within groups:

When you join a group, other group members can see:

• Your profile information (name, username, profile picture, about text)
• Content you post (messages, notes, tasks, files)
• Your activity in the group (posts, comments, task assignments)

Public groups:

• If you join a public group, your participation may be visible to non-members
• Group creators control group visibility settings

You control:

• What you share in groups
• Which groups you join
• Your profile visibility settings

2. With Service Providers

We share data with trusted third-party companies that help us operate the Service. These providers are contractually obligated to:

• Process data only per our instructions
• Implement appropriate security measures
• Comply with GDPR, CCPA, and applicable laws
• Delete or return data upon request

See the "Third-Party Service Providers and Data Processors" section for the complete list.

3. For Legal Reasons

We may disclose your information if required by law or in good faith belief that such action is necessary to:

• Comply with legal obligations (court orders, subpoenas, warrants)
• Enforce our Terms of Service and other agreements
• Protect the rights, property, or safety of Sociaity, our users, or the public
• Detect, prevent, or address fraud, security, or technical issues
• Respond to claims of illegal content or violations of third-party rights
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Legal process: We will notify you of legal requests for your data unless prohibited by law or court order.

4. Business Transfers

If Sociaity is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity. We will:

• Notify you via email and prominent notice on our website
• Give you the option to delete your account before the transfer
• Ensure the acquiring entity honors this Privacy Policy

5. With Your Consent

We may share your information for purposes not described in this Privacy Policy with your explicit consent. We will:

• Clearly explain what data will be shared and why
• Ask for your permission before sharing
• Allow you to withdraw consent at any time

6. With Affiliates

We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company and any other subsidiaries, joint venture partners or other companies that we control or that are under common control with us.

7. With Business Partners

We may share your information with our business partners to offer you certain products, services or promotions.

8. With Other Users and Within Groups

When you share personal information or otherwise interact in the public areas or within groups with other users, such information may be viewed by all users in that group and may be publicly distributed within the group or, if explicitly shared publicly, outside the Service.

What We Never Do

We do NOT:

• Sell your personal information to data brokers or advertisers
• Share your private messages or documents with third parties for marketing
• Use your content to train third-party AI models without your consent
• Share your data with social media platforms (except when you use social login)
• Provide your email address to partners for spam or unsolicited marketing

Third-Party Service Providers and Data Processors

We work with trusted third-party service providers who process data on our behalf. All providers are bound by Data Processing Agreements (DPAs) and comply with GDPR, CCPA, and applicable privacy laws.

Infrastructure & Hosting

AI & Machine Learning

Analytics

Email & Communications

Authentication

Note: We do NOT access your Facebook friends (beyond those using our app), posts, or private messages.

By utilizing Facebook Login on Sociaity, you consent to the collection and use of this information for the specified purposes outlined in our privacy policy. We prioritize the security and privacy of your data and ensure that any collected data is handled responsibly and in compliance with relevant regulations.

Payment Processing (Future)

When we launch paid features, we will use:

• Stripe or similar PCI-compliant payment processor
• We will NOT store your credit card details on our servers
• Payment data is encrypted and processed directly by the payment provider

Data Processing Safeguards

All service providers must:

• Sign a Data Processing Agreement (DPA)
• Implement appropriate technical and organizational security measures
• Process data only per our instructions
• Not use your data for their own purposes
• Delete or return data upon request
• Notify us of any data breaches within 24 hours
• Comply with GDPR (for EU users) and CCPA (for California users)
• Use Standard Contractual Clauses (SCCs) for international transfers

Subprocessors

Some providers may use subprocessors (e.g., AWS uses data center operators). We ensure:

• All subprocessors meet the same privacy and security standards
• We maintain a list of subprocessors (available upon request)
• You can object to new subprocessors before they are engaged

Changes to Service Providers

If we add or change service providers in a way that affects your data, we will:

• Update this section
• Notify you via email (for material changes)
• Give you 30 days to object or delete your data

Data Retention Periods

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy, or as required by law.

Account Deletion Timeline

When you delete your account:

Exceptions:

• Financial records: Retained for 7 years (legal requirement)
• Security logs: Retained for 12 months (security and fraud prevention)
• Legal hold: Data subject to legal proceedings may be retained longer

Group Content After You Leave

If you leave a group:

• Your profile information is removed from the group member list
• Content you created (posts, notes, tasks) remains in the group
• Your username is replaced with "Former Member" on old content
• You can request deletion of your content by contacting privacy@sociaity.com

If a group is deleted:

• All group content is deleted within 90 days
• Group members are notified before deletion
• Members can export their data before the group is deleted

Data Minimization

We regularly review our data retention practices to ensure we:

• Only keep data as long as necessary
• Delete data when it's no longer needed
• Anonymize data when possible
• Comply with legal retention requirements

Your Right to Deletion

You can request deletion of your data at any time:

• Account deletion: Settings → Account → Delete Account
• Specific data: Contact privacy@sociaity.com
• AI conversations: AI chat settings → Delete conversation

We will respond to deletion requests within:

• GDPR (EU): 30 days (may extend to 60 days with notice)
• CCPA (California): 45 days (may extend to 90 days with notice)

Legal Retention Requirements

In some cases, we are required by law to retain data longer than our standard periods:

• Tax records: 7 years (IRS requirement)
• Employment records: 7 years (if applicable)
• Legal disputes: Duration of litigation + statute of limitations
• Regulatory investigations: As required by authorities

We will notify you if your data is subject to legal retention requirements.

Your Privacy Rights and Choices

Depending on your location, you have specific rights regarding your personal data. We honor these rights globally, regardless of where you live.

Rights Under GDPR (EU/EEA/UK)

If you are in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

Response time: We will respond within 30 days (may extend to 60 days for complex requests, with notice).

Rights Under CCPA/CPRA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Response time: We will respond within 45 days (may extend to 90 days for complex requests, with notice).

Verification: We may ask you to verify your identity before processing requests (e.g., confirm your email address).

Rights in Other Jurisdictions

Canada (PIPEDA):

• Right to access, correct, and delete personal information
• Right to withdraw consent
• Right to file a complaint with the Privacy Commissioner

Brazil (LGPD):

• Similar rights to GDPR (access, correction, deletion, portability)
• Right to information about data sharing
• Right to revoke consent

Other countries:

• We honor data protection rights recognized in your jurisdiction
• Contact privacy@sociaity.com to exercise your rights

How to Exercise Your Rights

Online (fastest):

• Log in to your account
• Go to Settings → Privacy
• Choose: Download My Data (access, portability), Delete Account (erasure), or Analytics Settings (opt-out)

Email:

• Send requests to privacy@sociaity.com
• Include your name and email address, a description of your request, and proof of identity (if needed)

Response time:

• Simple requests: 5-10 business days
• Complex requests: 30-45 days (depending on jurisdiction)
• We will confirm receipt within 48 hours

Verification Process

To protect your privacy, we may ask you to verify your identity before processing certain requests:

• Confirm your email address (verification code sent)
• Answer security questions
• Provide additional identification (for sensitive requests)

Fees

We do not charge fees for most privacy requests. However, we may charge a reasonable fee if:

• Your request is clearly unfounded or excessive
• You request multiple copies of the same data within a short period

We will notify you of any fees before processing your request.

Limitations

In some cases, we may not be able to fully comply with your request if:

• It would compromise others' privacy
• It conflicts with legal obligations
• It's necessary for legal claims or defense
• It's technically impossible

We will explain any limitations and provide partial compliance where possible.

Children's Privacy

Age Restrictions

Minimum age to use Sociaity:

• European Union (EU/EEA): 16 years old
• United States: 13 years old
• Other countries: 13-16 years old (depending on local laws)

Parental consent:

• Users under 18 may require parental or guardian consent in some jurisdictions
• We recommend parents review this Privacy Policy with their children

Our Commitment

We do NOT knowingly collect personal information from children under the minimum age.

If we discover that we have collected personal information from a child under the minimum age without proper parental consent, we will:

• Delete the account immediately
• Permanently remove all associated data
• Notify the parent or guardian (if contact information is available)

For Parents and Guardians

If you believe your child has created an account without your permission:

• Contact us immediately at privacy@sociaity.com
• Provide your child's username or email, your relationship to the child, and proof of guardianship (if requested)
• We will delete the account within 48 hours

Your parental rights:

• Right to review: Request a copy of your child's personal data
• Right to delete: Request deletion of your child's account and data
• Right to refuse: Refuse further collection or use of your child's data
• Right to consent: Provide or withdraw consent for data processing

COPPA Compliance (US)

For users under 13 in the United States, we comply with the Children's Online Privacy Protection Act (COPPA):

• We do not knowingly collect personal information from children under 13
• We do not allow children under 13 to create accounts
• We do not target advertising to children
• We do not share children's information with third parties for marketing

Age Verification

We do not currently use age verification technology. We rely on:

• User-provided date of birth during registration (if collected)
• Terms of Service acceptance (user attests they meet minimum age)
• Parental reports of underage accounts

If we implement age verification in the future, we will update this Privacy Policy.

Educational Use

For schools and educational institutions:

• If your school uses Sociaity for educational purposes, different rules may apply
• Schools may act as the parent/guardian for consent purposes
• Contact us at education@sociaity.com for institutional agreements

Changes to Children's Privacy Practices

If we make changes to how we collect or use children's information, we will:

• Update this Privacy Policy
• Notify parents/guardians via email (if we have contact information)
• Obtain new parental consent if required by law

Child Safety & Protection

At Sociaity, we are deeply committed to protecting the safety and well-being of minors on our platform. We strictly prohibit any content or behavior that exploits or endangers children, including but not limited to Child Sexual Abuse or Exploitation (CSAE) in any form.

We do not allow:

• Uploading, sharing, or promoting any sexual or suggestive content involving minors
• Requesting or distributing images, videos, or other material that depicts or implies the sexualization of minors
• Engaging in grooming, harassment, or inappropriate communication with minors

Any content or account involved in such behavior will be immediately removed and reported to the relevant authorities where legally required.

We also take active measures to:

• Detect and prevent child endangerment through manual and automated moderation
• Restrict features or interactions that may expose minors to risk
• Encourage our community to report suspicious or harmful behavior directly to our team via support@sociaity.com

Sociaity maintains a zero-tolerance policy toward any form of child sexual abuse, exploitation, or endangerment.

If you believe a child is in immediate danger, please contact your local law enforcement first.

International Data Transfers

Sociaity is based in the United States, and we use service providers located around the world. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not have the same data protection laws as your country.

Where Your Data is Stored

Primary storage locations:

• European Union: Frankfurt, Germany (AWS EU-Central-1)
• United States: US East (AWS US-East-1) and US West (AWS US-West-2)

Data routing:

• EU users: Data is primarily stored and processed in the EU
• US users: Data may be stored in US or EU regions
• Other regions: Data is stored in the nearest available region (typically EU or US)

Safeguards for International Transfers

When we transfer personal data from the EU/EEA/UK to other countries, we use the following safeguards to ensure your data remains protected:

1. Standard Contractual Clauses (SCCs)

We use EU Commission-approved Standard Contractual Clauses with all service providers that process EU personal data outside the EU/EEA.

What are SCCs?

• Legally binding contracts that require data importers to protect EU data
• Approved by the European Commission under GDPR Article 46(2)(c)
• Provide enforceable rights for data subjects

To request a copy, email privacy@sociaity.com.

2. Adequacy Decisions

We transfer data to countries recognized by the EU Commission as providing adequate data protection:

• United Kingdom: Adequacy decision in place
• Switzerland: Adequacy decision in place

3. Data Processing Agreements (DPAs)

All service providers that process personal data on our behalf have signed DPAs that include:

• Commitment to GDPR compliance
• Standard Contractual Clauses (where applicable)
• Security and confidentiality obligations
• Data breach notification requirements
• Audit rights

4. Additional Safeguards

For transfers to the United States, we implement additional safeguards:

• Encryption in transit: All data is encrypted using TLS 1.3
• Encryption at rest: Data is encrypted in storage using AES-256
• Access controls: Strict access controls and authentication
• Regular audits: Annual security and compliance audits
• Incident response: 24-hour breach notification protocol

EU-US Data Privacy Framework

We are monitoring the EU-US Data Privacy Framework (DPF) and will participate if and when our service providers are certified. AWS and other providers are evaluating DPF certification. We will update this Privacy Policy when certifications are in place.

Your Rights Regarding International Transfers

Right to information:

You can request information about:

• Which countries your data is transferred to
• What safeguards are in place
• Copies of relevant transfer mechanisms (SCCs, DPAs)

Right to object:

• You can object to transfers to specific countries
• We will evaluate your objection and respond within 30 days
• If we cannot accommodate your objection, you may delete your account

To exercise these rights, email privacy@sociaity.com with your request.

Data Localization Options

For enterprise customers:

• We can discuss data localization options (e.g., EU-only storage)
• Contact enterprise@sociaity.com for custom arrangements

For individual users:

• Data localization is not currently available
• We store data in the most efficient and secure locations

Changes to Transfer Practices

If we change how or where we transfer your data, we will:

• Update this Privacy Policy
• Notify you via email (for material changes)
• Provide 30 days' notice before changes take effect
• Give you the option to object or delete your data

Data Security

We take the security of your personal data seriously and implement industry-standard technical and organizational measures to protect it.

Technical Security Measures

Encryption:

• In transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security)
• At rest: Data stored in our databases and file storage is encrypted using AES-256 encryption
• Backups: All backups are encrypted and stored securely

Authentication & access control:

• Password security: Passwords are hashed using bcrypt with salt
• Multi-Factor Authentication (MFA): Available for all users (recommended)
• Session management: Secure session tokens with automatic expiration
• Access controls: Role-based access control (RBAC) for internal systems
• Least privilege: Employees have access only to data necessary for their role

Infrastructure security:

• Cloud provider: AWS (ISO 27001, SOC 2, GDPR compliant)
• Firewalls: Network-level and application-level firewalls
• Intrusion detection: Real-time monitoring for suspicious activity
• DDoS protection: AWS Shield and CloudFront protection
• Vulnerability scanning: Regular automated and manual security scans
• Penetration testing: Annual third-party penetration tests

Application security:

• Input validation: All user inputs are validated and sanitized
• SQL injection protection: Parameterized queries and ORM usage
• XSS protection: Content Security Policy (CSP) headers
• CSRF protection: Anti-CSRF tokens on all forms
• Secure APIs: OAuth 2.0 and JWT for API authentication

Organizational Security Measures

Employee training:

• All employees complete security and privacy training
• Annual refresher training on data protection
• Confidentiality agreements signed by all staff

Access management:

• Background checks: Conducted for employees with data access
• Need-to-know basis: Access granted only when necessary
• Access logs: All data access is logged and audited
• Automatic revocation: Access is revoked immediately upon termination

Incident response:

• 24/7 monitoring: Security Operations Center (SOC) monitoring
• Incident response plan: Documented procedures for data breaches
• Breach notification: 72-hour notification to authorities (GDPR requirement)
• User notification: Prompt notification to affected users

Vendor management:

• All vendors undergo security assessments
• Data Processing Agreements (DPAs) with all processors
• Regular vendor audits and reviews

Data Breach Procedures

Our response in the event of a data breach:

• Immediate containment: Stop the breach and secure systems (within hours)
• Investigation: Assess scope, impact, and affected data (within 24 hours)
• Notification:
  • Supervisory authority: Within 72 hours (GDPR requirement)
  • Affected users: Without undue delay (within 5 days)
  • Public disclosure: If required by law or if high risk to users

What we'll tell you:

• Nature of the breach (what happened)
• Types of data affected
• Likely consequences
• Measures we've taken to address the breach
• Steps you should take to protect yourself
• Contact information for questions

Your rights after a breach:

• Request detailed information about the breach
• File a complaint with your data protection authority
• Seek compensation for damages (if applicable under law)

Your Security Responsibilities

To keep your account secure:

• Use a strong, unique password (12+ characters, mix of letters, numbers, symbols)
• Enable Multi-Factor Authentication (MFA)
• Do not share your password with anyone
• Log out of shared or public devices
• Keep your email account secure (password recovery)
• Report suspicious activity immediately
• Review your account activity regularly

Red flags (report immediately):

• Unrecognized login locations or devices
• Emails claiming to be from Sociaity asking for your password
• Unexpected password reset emails
• Unusual activity in your account

Report security issues by email to security@sociaity.com. For vulnerabilities, see our Responsible Disclosure Policy at sociaity.com/security.

Limitations

No security is perfect. While we implement industry-leading security measures, no system is 100% secure. We cannot guarantee absolute security of your data.

Your responsibility. You are responsible for maintaining the security of your device, email account, and password. We are not liable for unauthorized access resulting from your failure to secure your credentials.

Security Certifications & Compliance

Current compliance:

• GDPR (General Data Protection Regulation)
• CCPA/CPRA (California Consumer Privacy Act)
• SOC 2 Type II (via AWS infrastructure)
• ISO 27001 (via AWS infrastructure)

Future certifications:

• We are working toward independent SOC 2 certification
• We will update this Privacy Policy when certifications are achieved

We continuously improve our security practices. Check this Privacy Policy regularly for updates to our security measures.

Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

California Privacy Rights — Additional Sections

Your California Privacy Rights (California's Shine the Light law)

Under California Civil Code Section 1798 (California's Shine the Light law), California residents with an established business relationship with us can request information once a year about sharing their Personal Data with third parties for the third parties' direct marketing purposes.

If you'd like to request more information under the California Shine the Light law, and if you are a California resident, you can contact us using the contact information provided below.

California Privacy Rights for Minor Users (California Business and Professions Code Section 22581)

California Business and Professions Code Section 22581 allows California residents under the age of 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted.

To request removal of such data, and if you are a California resident, you can contact us using the contact information provided below, and include the email address associated with your account.

Be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Material Changes

Material changes are changes that significantly affect your rights or how we use your personal data. Examples:

• New categories of personal data we collect
• New purposes for processing your data
• New third parties we share data with
• Changes to data retention periods
• Reduction of your privacy rights
• New AI features that process personal data in different ways
• Changes to international data transfer practices

How we notify you:

• Email notification: Sent to your registered email address
• In-app notification: Prominent banner when you next log in
• Website banner: Visible notice on sociaity.com
• 30-day notice period: Changes take effect 30 days after notification

Your options:

• Accept: Continue using the Service under the new policy
• Object: Contact us to discuss concerns (privacy@sociaity.com)
• Opt-out: Delete your account before the effective date
• Download data: Export your data before the changes take effect

Non-Material Changes

Non-material changes are minor updates that do not significantly affect your rights. Examples:

• Clarifications of existing practices
• Updated contact information
• Formatting improvements
• Correcting typos or grammatical errors
• Adding examples to existing sections
• Reorganizing content for clarity
• Updated links to third-party privacy policies

For these, we update the "Last Updated" date at the top of this Privacy Policy. No separate notification is required and changes take effect immediately upon posting.

How to Stay Informed

• Check the "Last Updated" date at the top of this Privacy Policy — it is updated every time we make changes
• We recommend reviewing this Privacy Policy every 6 months, especially before providing new types of personal data
• Ensure your email address is up to date in Settings → Profile so we can email you about material changes

Version History

We maintain a version history of this Privacy Policy for transparency. Previous versions, with dates and change summaries, are available at https://www.sociaity.com/privacy-policy/archive.

• Current version: Version 2.0 — Last Updated September 3, 2026, effective immediately
• Version 1.0 — October 28, 2025 (Initial version)

Your Continued Use

By continuing to use the Service after changes take effect, you agree to the updated Privacy Policy.

If you do not agree with the changes:

• Stop using the Service
• Delete your account: Settings → Account → Delete Account
• Contact us with concerns: privacy@sociaity.com

If you have questions about changes to this Privacy Policy, email privacy@sociaity.com. We will respond within 5 business days and explain the changes in plain language.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Supervisory Authorities

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority:

• European Union: Find your supervisory authority at https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom: Information Commissioner's Office (ICO): https://ico.org.uk/
• California: California Privacy Protection Agency: https://cppa.ca.gov/
• Other US states: Contact your state Attorney General's office

Thank you for trusting Sociaity with your personal information. We are committed to protecting your privacy and being transparent about our data practices.