Privacy Policy
Sophia AI Sales
Effective date: 28 October 2026
One company, SOPHIA GENESIS LLC, operates both our public website sofia777-ai.com and the Sophia AI Sales platform. This one policy covers both.
This Privacy Policy explains what personal data we process on the website and in Sophia AI Sales, why we process it, how long we keep it, and what rights you have. We wrote it in plain language. If something is unclear, write to us at privacy@sofia777-ai.com.
Summary
- Sophia AI Sales is an AI sales assistant. Businesses use it to answer their customers in messengers.
- When you message a business that uses our service, that business decides how your conversation is used. We process the conversation on its behalf.
- An AI model (from OpenAI or Anthropic) helps to write replies. A human manager of the business can take over the conversation at any time.
- We do not sell personal data. We do not use it for advertising. We do not use it to train AI models.
- We keep conversations for 12 months after the last message. Then we delete them automatically.
- You can ask us to delete your data at any time. See Data Deletion Instructions.
1. Who we are
The service is operated by:
SOPHIA GENESIS LLC (ТОВ «СОФІЯ ГЕНЕЗИС»)
EDRPOU code: 46166724
Address: 26 Mykhaila Boichuka St., office 202, Kyiv, 01103, Ukraine
Phone: +38 (067) 508-52-30
Email for privacy questions and requests: privacy@sofia777-ai.com
In this policy, "we", "us" and "Sophia Genesis" mean SOPHIA GENESIS LLC.
Our websites:
- sofia777-ai.com — public website;
- ai-sales.sofia777-ai.com — platform where business staff work with conversations;
- admin.sofia777-ai.com — administration panel.
2. Who this policy is for
This policy applies to three groups of people:
- End customers — people who send messages to a business that uses Sophia AI Sales (for example, through Telegram, Instagram or Facebook Messenger).
- Business clients and their staff — companies that use Sophia AI Sales, and their owners, managers and other users.
- Website visitors — people who visit sofia777-ai.com.
3. Our role: controller and processor
Conversations between a business and its customers. The business that uses Sophia AI Sales is the controller of these conversations. It decides why and how they are used. Sophia Genesis is a processor: we process the conversations only on the business's behalf and on its instructions, to provide the service.
For these conversations, the business is responsible for the legal basis and for informing its customers. The business's own privacy notice also applies.
Our own data. Sophia Genesis is the controller for:
- our public website and its visitors;
- the accounts of our business clients and their staff;
- our own communication with you, including privacy requests.
You can always contact us. Even if a business is the controller of your conversation, you can write to us at privacy@sofia777-ai.com. We will tell the business about your request, help it to answer, and carry out its instructions. We act on deletion requests within 30 days (see Data Deletion Instructions).
4. What data we process
4.1 End customers (people who message a business)
From the messaging platform:
- Telegram: user ID, username, first and last name, language setting, profile picture.
- Instagram (when a business connects it): name, username, profile picture, number of followers, whether you follow the business account and whether it follows you, verified status.
- Facebook Messenger (when a business connects it): first and last name, profile picture.
We store a copy of your profile picture.
What you send: text messages, photos, voice messages and files.
What the service creates:
- a text transcript of each voice message;
- a short text description of each photo;
- replies written with the help of AI, and reply suggestions for managers;
- conversation details: times of messages, status, labels, and the reason the conversation was passed to a manager.
What we do not collect from end customers: we do not collect your IP address, location, device or browser data, and we do not set cookies on your device. We do not ask for your phone number, email or address. If you type them in a message, they become part of the conversation. We do not process payments. If you pay a business, you pay it directly, outside our systems.
Please do not send sensitive data (for example, about health) in a conversation unless it is necessary.
4.2 Business clients and their staff
- Platform accounts: name, email, password (stored only as a secure hash).
- Administration panel: email, password (as a hash), two-factor authentication secret, login tokens, and the IP address and browser type used for logins and recorded in the security log.
- Managers who receive hand-off notifications in Telegram: Telegram ID, username, first and last name.
- Business content: business description, knowledge files, questions and answers. We convert this content into search vectors so that the AI can find the right information.
- Usage records: which AI model was used, how many tokens, and the cost. These records do not contain message text.
- Communication with us: emails and support requests.
4.3 Website visitors
The website has no forms and does not ask you for any data.
- Server logs: our web server records the IP address, browser type (user agent), date and time, and the page requested. This applies to every page of the website and to the one technical address under /api/ that payment notifications use. The logs are rotated automatically and deleted after 14 days.
- Language cookie:
sg_langremembers the language you chose. It is kept for 1 year. This is the only cookie on the website, and the website saves nothing else in your browser. See the Cookie Policy. - Links to Telegram: when you click a link to our Telegram bot, Telegram opens. What happens there is covered by Telegram's terms and the terms of the bot itself.
We do not use analytics, advertising or social media tracking tools on our website. Fonts are hosted on our own server, so your browser does not contact font providers.
5. How we use AI
Sophia AI Sales uses AI models from OpenAI (by default) and Anthropic (if a business chooses it). Here is what goes to them:
- To write a reply: up to the last 30 messages of the conversation, plus the business's settings and knowledge.
- Voice messages: the audio goes to OpenAI for transcription. We keep the transcript, not the audio, in our AI component. The original voice message stays in the conversation.
- Photos: the image goes to the AI provider to get a short text description. We keep the description. The original photo stays in the conversation.
- Search in the business's knowledge: recent customer messages are turned into search vectors by OpenAI. We do not store these vectors.
- Suggestions for managers: the conversation history goes to OpenAI to suggest a reply.
No training on your data. We do not use conversations to train AI models. Under the API terms of OpenAI and Anthropic, these providers do not use data sent through their API to train their models by default. They may keep it for a limited time for safety and abuse monitoring, as described in their terms.
Humans stay in control. AI can make mistakes. A manager of the business can read the conversation and take over at any time. The conversation is passed to a manager when you ask for a person, or when the business's rules require it. The service does not make decisions about you that have legal or similarly significant effects.
6. Data from Meta (Instagram, Facebook Messenger) and Telegram
When a business connects its Instagram or Facebook Page account to Sophia AI Sales, we receive data from Meta Platforms (the profile data in section 4.1 and the messages you send to that business).
We use this data only to receive, show and answer messages for that business, and to pass the conversation to its staff. We:
- do not sell this data or give it to data brokers;
- do not use it for advertising, marketing to you, or building profiles;
- do not share it with anyone except the business you wrote to and the service providers in section 8 that are needed to run the service;
- delete it on request and after the retention periods in section 10.
We follow Meta's Platform Terms and Telegram's terms when we use their data.
7. Why we process data and on what legal basis
We process personal data under the Law of Ukraine "On Personal Data Protection" and, for people in the European Union and European Economic Area (EU/EEA), under the General Data Protection Regulation (GDPR).
Where the business is the controller (end-customer conversations), the business chooses the legal basis. Usually this is the performance of a contract or steps before a contract with its customer, or its legitimate interest in answering customer messages. We process this data only on the business's instructions.
Where we are the controller:
| Purpose | Data | Legal basis |
|---|---|---|
| Provide the service to business clients: accounts, logins, settings, knowledge base, hand-off notifications | Account and staff data, business content | Contract with the business client (GDPR Art. 6(1)(b)); for staff of the client, our legitimate interest in running the service the client ordered (GDPR Art. 6(1)(f)) |
| Keep the service secure: two-factor login, security log, server logs | Email, IP address, browser type, login times | Legitimate interest in security and preventing misuse (GDPR Art. 6(1)(f)) |
| Count AI usage and costs | Usage records (no message text) | Contract and legitimate interest in correct billing and cost control |
| Send security codes and service emails | Contract | |
| Show the website in your language | sg_lang cookie | Legitimate interest in a working website; the cookie is strictly necessary |
| Answer questions and privacy requests | Contact details, request content | Legal obligation (GDPR Art. 6(1)(c)) and legitimate interest |
| Keep accounting and other records required by law | Contract and payment documents | Legal obligation |
The same grounds exist in Article 11 of the Law of Ukraine "On Personal Data Protection": performance of a contract, a legal obligation of the owner of personal data, and the legitimate interest of the owner. Where we need consent, we ask for it, and you can withdraw it at any time.
8. Who we share data with
We share data only when it is needed to run the service. Our service providers act on our instructions.
| Provider | What they do | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of our servers, databases, files and backups | Data centres in Finland and Germany (EU) |
| OpenAI | AI replies, voice transcription, photo descriptions, search vectors, manager suggestions | USA |
| Anthropic | AI replies, if the business chooses this provider | USA |
| Telegram | Messaging channel; hand-off notifications to the business's managers (customer's Telegram ID and the reason for hand-off) | According to Telegram's terms |
| Meta Platforms (Instagram, Facebook Messenger) | Messaging channel, when a business connects it | According to Meta's terms |
| Resend | Sending security codes by email to administration panel users | USA |
| Google (Gemini) | Help with formatting announcement texts that we send to business clients; no end-customer data | USA |
| Namecheap | Domain name system (DNS) and our email, including messages you send to privacy@sofia777-ai.com | USA |
Staff of the business you wrote to can see your conversation.
We may also disclose data if Ukrainian law or a valid order of a court or public authority requires it.
We do not sell personal data.
9. International transfers
Our servers are in the EU (Finland and Germany). Sophia Genesis is based in Ukraine. Our staff in Ukraine can access the data to run and support the service.
Some providers, including OpenAI and Anthropic, process data in the USA. For these transfers, we rely on the providers' data processing terms, which include the standard contractual clauses approved by the European Commission. You can ask us for more information about these safeguards at privacy@sofia777-ai.com.
10. How long we keep data
| Data | How long |
|---|---|
| Conversations (messages, attachments, transcripts, photo descriptions, AI suggestions, hand-off records) and end-customer profile data | 12 months after the last message in the conversation. Then we delete them automatically. |
| Backups | Rolling backups are kept for 30 days. Data that we delete disappears from backups within 30 days. |
| Server logs (IP address, browser type) | 14 days |
sg_lang cookie (website language) | 1 year |
| Business client accounts and staff data, business content, usage records | For the duration of the contract, and after that as long as Ukrainian law requires (for example, for accounting documents) |
| Privacy requests and our answers | As long as needed to show that we handled the request |
A business can ask us to delete its data earlier. When a contract ends, we delete or return the business's data as agreed with the business. Conversation data is deleted in any case no later than 12 months after the last message.
11. Security
We protect data with these measures:
- encrypted connections (HTTPS) to our websites;
- passwords stored only as secure hashes;
- two-factor authentication for the administration panel;
- access only for staff who need it;
- a security log of logins in the administration panel;
- limited retention and automatic deletion.
No system is completely secure. If a data breach happens, we inform the affected business clients without undue delay. Where required by law, we also inform the supervisory authority and the affected people.
12. Your rights
Under Ukrainian law and, for people in the EU/EEA, under the GDPR, you have the right to:
- access — know whether we process your data and get a copy;
- rectification — correct wrong or incomplete data;
- erasure — ask us to delete your data;
- restriction — ask us to limit how we use your data;
- objection — object to processing based on legitimate interest;
- portability — get your data in a structured, machine-readable format and send it to another company;
- withdraw consent — where processing is based on consent;
- complain to a supervisory authority.
How to use your rights. Write to privacy@sofia777-ai.com. Tell us which messenger you used, your username or ID, and which business you contacted. We may ask for a simple check to confirm that the account is yours. We answer within 30 days. If the request is about a conversation with a business, we inform the business and help it to answer.
Where to complain:
- In Ukraine: the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).
- In the EU/EEA: the data protection authority in the country where you live, work, or where you think the violation happened. The list of authorities is at edpb.europa.eu.
We ask you to contact us first, so that we can try to fix the problem quickly.
13. Children
Sophia AI Sales is a service for businesses. It is not intended for children under 16. Business clients must not use it to target children. If you are under 16 and you sent a message to a business that uses our service, you or your parent can ask us to delete the data (see Data Deletion Instructions). If we learn that we process data of a child under 16 without a proper basis, we delete it.
14. Changes to this policy
We may update this policy when our service or the law changes. We publish the new version on this page with a new effective date. If the changes are important, we inform business clients by email or in the platform before they apply.
15. Contact
SOPHIA GENESIS LLC
26 Mykhaila Boichuka St., office 202, Kyiv, 01103, Ukraine
Phone: +38 (067) 508-52-30
Email: privacy@sofia777-ai.com
Related documents: Terms of Service · Cookie Policy · Data Deletion Instructions