Privacy Policy

Sofia is operated by ALY CONSULTORIA E GESTAO EM TECNOLOGIA LTDA (Aly Studios), a company registered in Brazil under CNPJ 49.885.334/0001-89, with its registered office at Rua Santa Cruz, 2187, Sala 10, Vila Mariana, São Paulo – SP, 04121-002, Brazil. We are the controller of the personal data described in this policy.

For any privacy question or request, including to reach the person responsible for data protection, email [email protected].

We collect only what the product needs to work:

• Account data: your name, email address, and a hashed password. If you sign in with Google, we receive your name, email address, and profile picture from Google instead of a password.
• Workspace content: what you create or upload in Sofia: brands and brand assets, images and videos, prompts and chat conversations, posts, articles, captions, templates, and calendar entries.
• Connected account data: when you connect Instagram, TikTok, YouTube, or X, we receive access tokens and the account's ID, username, display name, and profile picture, plus the IDs and links of posts Sofia publishes for you. Details for each platform are in section 5.
• Billing data: your plan, subscription status, and invoices. Card details are collected and held by our payment provider; Sofia never sees or stores them.
• Usage and device data: pages you visit, features you use, your browser and device type, approximate location derived from your IP address, and the page that referred you. In the app we also record sessions to find bugs and confusing screens, with text you type into forms masked. See section 7.
• Technical logs: server, job, and error logs, which include IP addresses and request details, used to keep Sofia running and secure.
• Messages to us: the content of emails and support requests you send.

We use personal data for the purposes below. Where the law requires a legal basis (including under Brazil's LGPD and the EU/UK GDPR), it is shown in brackets.

• To provide Sofia: run your workspace, generate the content you ask for, and publish or schedule posts to the accounts you connect (performance of our contract with you).
• To bill you and keep financial records (contract and legal obligation).
• To keep Sofia secure and fair: verify email addresses, prevent abuse and fraud, and enforce usage limits (legitimate interests).
• To understand how Sofia is used, fix errors, and improve the product (legitimate interests).
• To send service emails such as verification links, password resets, and important account or policy notices (contract). We do not send marketing email without your consent.
• To comply with the law and respond to lawful requests (legal obligation).

We do not sell or rent personal data, we do not run advertising, and we do not use your content to train AI models of our own.

Sofia generates and edits content with AI models. When you use these features, the request (your prompt, the relevant brand guidelines, any images you attach, and the generated result) is sent through the Vercel AI Gateway to the model provider that handles it. We currently use models from Anthropic, OpenAI, Google, xAI, Meta, and Black Forest Labs. Each provider processes requests under its own API terms and privacy policy.

We send only what a request needs. Data from your connected social accounts is not used to train AI models. If you ask Sofia's assistant to schedule or publish a post, the name of the destination account may be included so the assistant can carry out your instruction.

You choose which accounts to connect, and Sofia acts on them only to do what you ask: publish or schedule your posts and show you which account is connected. We never post without your instruction, and we do not use this data for advertising, profiling, or resale.

Instagram

• instagram_business_basic: to identify the connected account and show its handle, name, and avatar in your workspace.
• instagram_business_content_publish: to publish or schedule the posts you create in Sofia.

TikTok

• user.info.basic and user.info.profile: to identify the connected account and show its name and avatar.
• video.publish: to publish the posts and videos you choose.

X

• users.read and tweet.read: to identify the connected account and confirm what was posted.
• tweet.write and media.write: to publish the posts and media you choose. offline.access keeps the connection active between sessions.

YouTube

See section 6 below.

Sofia uses YouTube API Services to connect your YouTube channel and upload finished videos you choose to publish or schedule. By using these features you are also subject to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

• Channel details: the youtube.readonly permission lets us read your channel ID, handle, name, and avatar so you can see which channel is connected. We store these with your connection and refresh them at least every 30 days.
• Video uploads: the youtube.upload permission lets us send the video you selected, with the title, description, visibility, and audience settings you chose, to your channel when you publish or at the time you scheduled. We keep the resulting video ID and link so you can see where each post went. Sofia cannot and does not edit or delete your existing videos, comments, playlists, or channel settings.
• Authorization tokens: we store encrypted access and refresh tokens so uploads can run at the time you scheduled. We never see your Google password.

Google and YouTube user data is used only to provide these features. It is not sold, used for advertising, or used to train AI models. It is shared only with the infrastructure providers in section 8 that host Sofia, and with YouTube itself to complete your upload. Sofia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This includes the name, email address, and profile picture we receive if you sign in with Google.

You can remove Sofia's access at any time:

• In Sofia: open Integrations and click Disconnect. We revoke the token with Google immediately and delete the stored tokens and channel details.
• In your Google Account: remove Sofia on the Google security settings page. Sofia detects this the next time it renews access, normally within an hour, and deletes the stored tokens and channel details.
• By email: ask us at [email protected] to delete your YouTube data. We complete these requests within 7 days.

Your post history keeps a record of which channel each post was sent to and its YouTube link until you delete that post or your account. Removing Sofia's access does not delete videos already on YouTube; you can manage those in YouTube Studio.

Sofia stores a small amount of information in your browser using cookies and local storage. We use two kinds:

• Strictly necessary: keep you signed in, protect forms and sign-in flows against forgery, and remember basic preferences. Sofia does not work without them.
• Analytics: set and read by PostHog, our product analytics provider, on sofiapilot.com and app.sofiapilot.com. They tell us which pages and features are used, record app sessions with form input masked, and link errors to the session where they happened so we can fix them.

We do not use advertising cookies or tracking pixels, and no third party serves ads or other content inside Sofia. You can block or delete cookies in your browser settings; blocking analytics cookies does not affect how Sofia works, but blocking strictly necessary cookies will sign you out.

We share personal data only with the service providers below, each limited to what its job requires and bound to protect the data:

• netcup: servers that run Sofia and its database (United States).
• Backblaze: file storage for uploads, renders, and videos (European Union).
• Cloudflare: DNS and delivery of media that a platform fetches when you publish.
• Polar: subscription checkout, billing, and invoicing, as our payment provider.
• Vercel (AI Gateway) and the AI model providers in section 4: generating and editing the content you request.
• PostHog: product analytics, session recordings, and error tracking.
• Resend: transactional email such as verification links and password resets.
• Zoho: hosts the mailbox that receives your emails to us.
• Google: sign-in, if you choose to sign in with Google.

When you publish, your content goes to the platform you chose, whether Instagram (Meta), TikTok, YouTube (Google), or X, under that platform's own terms and privacy policy. We may also disclose data when the law requires it, to protect the rights and safety of our users or others, or to a successor if Aly Studios is involved in a merger or acquisition, in which case this policy continues to apply.

Aly Studios is based in Brazil. Sofia's servers are in the United States, files are stored in the European Union, and some providers process data in other countries. When data leaves Brazil, the EU, or the UK, we rely on the safeguards those laws provide, such as standard contractual clauses or the provider's adequacy or certification status.

We keep personal data only as long as we need it:

• Account and workspace content: while your account is active. When you delete a post or video, we delete it and the files we stored for it.
• Connected accounts: until you disconnect the account, remove Sofia's access on the platform, or close your Sofia account.
• Upload staging: temporary copies made while processing an upload are deleted within a day.
• Billing records: kept for as long as tax and accounting law requires, generally five years in Brazil.
• Analytics and logs: kept only as long as needed to run, secure, and improve Sofia, and deleted on a rolling basis. Backups are replaced on a rolling 30-day cycle.

To close your account and delete your data, email [email protected] from the address on your account. We delete your workspaces, content, and connected accounts within 30 days, except records we must keep by law. If you removed Sofia through Instagram, Instagram notifies us and we delete that connection's tokens; deletion requests made through Instagram return a confirmation code you can check at the status link provided.

Depending on where you live (including under Brazil's LGPD and the EU/UK GDPR), you can ask us to confirm whether we process your data and give you a copy, correct it, export it, anonymise or delete it, restrict or object to some processing, or withdraw consent you gave. You can also ask which companies we share it with.

Email [email protected]. We may need to verify your identity, and we will reply within 15 days. You can also complain to your local data protection authority (in Brazil, the ANPD).

All connections to Sofia use HTTPS. Social account tokens are encrypted at rest with AES-256-GCM, passwords are stored only as salted hashes, and uploaded files are private by default and shared through short-lived links. Access to production systems is limited to the people who operate Sofia. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

Sofia is not directed at children and is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact [email protected] and we will delete it.

When this policy changes we update the date at the top. For material changes we email account holders before they take effect.

ALY CONSULTORIA E GESTAO EM TECNOLOGIA LTDA (Aly Studios)
CNPJ 49.885.334/0001-89
Rua Santa Cruz, 2187, Sala 10, Vila Mariana
São Paulo – SP, 04121-002, Brazil
[email protected]