Privacy policy

Person in charge of personal information

Sonivation’s person in charge of the protection of personal information can be reached for any question or request: support@sonivation.ca · 508-3400 boul. Saint-Elzéar O, Laval (QC) H7P 0K3.

What we process

Your account: your name, email, country and region, language and time zone; if you give them, your date of birth, phone, postal address and up to two more verified emails; and the proof of your consent to Sonivation’s emails (text of the checked box, date, IP address, browser).

What you entrust to Haly: your instructions, what you write about yourself so Haly knows you (your background, your résumé, your preferences), your answers to Haly’s questions and your approvals or refusals.

Your conversations with the Assistant: your messages and the files you attach, the facts you say about yourself that the Assistant keeps to help you better (you can read them in your data export), and what it produces for you: images, videos, documents and code projects. When you listen to an answer read aloud, only the text goes to speech synthesis; nothing is recorded.

Haly’s work: the plan of each task, its steps, what each step produced (searches, written texts, lists), the saved documents (résumés, letters, reports) and the log of what Haly did.

Your connected accounts, only if you connect them, and only for the tasks you launch: Gmail (the emails a task searches, the drafts it prepares, the sends you approve), Google Calendar (the events it creates), and the apps connected through Composio, such as Google Drive, Outlook, OneDrive, Word, Canva, Notion or LinkedIn (what the requested tool reads or writes), and your X, TikTok and Snapchat accounts, connected through bundle.social (what you approve posting there).

Google data: Sonivation’s use and transfer to any other app of information received from Google APIs (Gmail, Google Calendar) will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. This data is used only for the tasks you request: it is never sold, never used for advertising, never read by a person without your explicit consent except for security or legal obligations, and never used to train an AI model, ours or a provider’s. The AI providers that process a task commit not to keep it to train their models.

Your bank account, if you connect it: our banking gateway — Plaid in the countries it covers, Salt Edge elsewhere in the world — sends us the list of your accounts (name, type, last four digits), their balances, and at most the last 90 days of transactions when a task asks for them. It is read-only: no transfer or payment is possible. You enter your banking credentials with the gateway; Sonivation never sees them.

Your computer, if you link the Chrome extension: for a task you launched, the extension sends the text and elements of the pages it opens in your Chrome. When you ask a question from the extension, the page you choose to share goes with it. The value of password, card or code fields is never read or sent.

The Sonivation computer in the cloud, if you turn it on: a browser hosted by Browserbase, in the United States, where you sign in to sites yourself (PayPal…). It keeps those sign-ins so Haly can act there, until you turn it off. The text you send to it from your phone goes straight to the site, without being stored.

Your computer, if you install the Sonivation app: for a task you launched, the app sends the names, sizes and dates of the files and folders it goes through, and the text of the text files it reads for the task. It only acts inside your home folder, never in your apps’ settings; it moves things to the recycle bin without erasing anything, and waits for your go-ahead before throwing away or moving anything. Your files themselves are not copied to us.

Other people’s information: the emails Haly reads or sends, the job postings or pages Haly visits may contain information about other people. We process it only to carry out your task.

Billing and credits: your plan, your invoices and your credit movements. Payments are processed by Stripe; we never store card numbers.

Notifications: the technical address your browser gives us to receive Haly’s alerts and, twice a day, ideas from Sonivation, if you turn them on. Ideas can be turned off with one tap, using the notification’s “Stop these” button.

What Haly learns about you: to help you without making you repeat everything, Haly remembers, one sentence at a time, your tastes, your habits, the people and places in your life, your projects and deadlines, drawn from your conversations with the Assistant, the tasks you hand it and, if you let it watch your accounts, your recent emails, your calendar and your notable bank transactions (never the amounts). It writes a short portrait that the Assistant reads before answering you. To offer to connect the apps you use in one go, Haly counts the emails you receive from known services (Spotify, Notion, Canva…) without reading any of them, and the desktop app recognizes those services among your programs without sending their list. You ask Haly to remember or forget whatever you want (“forget that…”), your data export contains every fact, you can turn learning and watching off under You › Haly, and everything goes with your space.

What Haly writes to you on its own: depending on your setting (never, mornings, morning and evening, or often), Haly writes you something it noticed in your accounts, a follow-up, a reminder, a good deal found on the web or an idea to hand over, in its Assistant thread and by notification. We keep these messages for six months so it never repeats itself.

“Hey Haly”: if you turn it on for a device, that device’s microphone stays open while the app is on screen, and your browser (Google for Chrome, Apple for Safari) transcribes what it hears to recognize the call. Nothing is recorded or sent to Sonivation before “Hey Haly”; what follows the call opens the voice conversation, as if you had typed it.

Technical: access logs (IP address, date, requested resource) and error diagnostics, without the content of your emails.

Why

To carry out the tasks you entrust to Haly, report back, and ask for your go-ahead before any send, post or payment. This is what the service exists for, and the basis for this processing (performance of the contract).

To email you about your account and Sonivation’s services, with your express consent, which you can withdraw at any time through the unsubscribe link in every email.

To bill, count credits, secure the service, prevent abuse and meet our legal obligations.

We sell no information. We never use your data to serve someone else nor to train AI models, and our AI providers do not keep it for that purpose.

Where and by whom

Our database is hosted in Quebec, by Supabase (Montreal region). Our application servers run at Render and Vercel in Ohio (United States): your information is processed there, and the documents Haly produces are stored there. Access to your connected accounts is encrypted.

Processors: Anthropic (Haly’s reasoning, writing and web searches), OpenAI and Google (other AI models, depending on the step), Composio (Sampark Inc.: connecting your apps), bundle.social (BUNDLE sp. z o.o., Poland: connecting your X, TikTok and Snapchat accounts and their posts, hosted mainly in the European Economic Area), fal.ai (Features & Labels: image and video generation, in the United States; your prompts are not kept there), Browserbase (the Sonivation computer in the cloud, in the United States), Google (also the Assistant’s speech synthesis), Plaid and Salt Edge (the bank connection, depending on your country), Stripe (payments), Clerk (authentication), Resend (transactional email), Hostinger (our mailbox: the messages you send us), Sentry (error diagnostics, no content), Supabase, Render and Vercel (hosting). The services you connect receive what you ask Haly to do there.

Several of these providers process data outside Quebec, notably in the United States. They are bound by contract, and we send them only what the task needs.

How long

Your account, tasks and documents are kept as long as your space exists. When you ask for your account to be deleted, everything is erased within 30 days, including at our processors, except what the law requires us to keep (invoices: 7 years).

Access to your connected accounts disappears as soon as you disconnect them; at Plaid, Salt Edge, Composio and bundle.social, access is revoked at the same moment.

An unsubscribe request is kept on our suppression list so it is honoured.

Your rights

You can access your information, have it corrected, withdraw your consent, ask for portability, de-indexing or deletion.

From the “You” page of your space, you can export all your data in one file and ask for your account to be deleted. For any other request, write to support@sonivation.ca: we answer within 30 days.

You may lodge a complaint with the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

If you live in the European Union

The GDPR also gives you the right to object to processing and to ask for it to be restricted. Our legal bases are the performance of the contract (Haly’s tasks), your consent (our emails), our legal obligations (billing) and our legitimate interest in securing the service.

Your data is transferred to Canada and the United States, to the providers named above, under contractual safeguards. You may lodge a complaint with your country’s data protection authority (the CNIL in France).

Age

Sonivation is for adults. We do not knowingly collect information about children; if you think it happened, write to us and we will delete it.

Cookies

The public website uses no tracking or advertising cookies. Your space uses only the session cookies needed to sign in, and your browser keeps a few preferences, such as the theme.

Incidents and changes

In case of a confidentiality incident presenting a risk of serious injury, we notify the Commission d’accès à l’information and the persons concerned. Any change to this policy is published here with its date; a significant change is announced to you by email or in your space.