Legal

Privacy Policy

Last updated July 20, 2026

This policy explains what personal data we collect when you visit sovnexai.com, create an account or run a licensed Sovnex deployment — and, just as importantly, what we deliberately do not collect. It is written to be read rather than skimmed past: there is no analytics script, no tracking pixel and no advertising cookie anywhere on this site.

1. Who is responsible for your data

The controller for the processing described below is:

Controller: [LEGAL ENTITY — to be completed]
Registered address: [REGISTERED ADDRESS — to be completed]
Servers located in: Paris, France
Contact: contact@sovnexai.com

If you have a question about this policy, or want to exercise any of the rights in section 10, write to the address above. A person reads it.

2. What this policy covers — and what it does not

It covers two things: this website, sovnexai.com, and the Sovnex licence service that sits behind your account, your subscription and the licences issued to you.

It does not cover the Sovnex AI software itself, because that software does not run on our infrastructure. Sovnex is self-hosted: it runs on your own servers, and your documents, embeddings, prompts, questions and generated answers stay inside your own network. They are never transmitted to us and we have no technical means of reading them. The only thing your deployment sends us is the licence heartbeat described in the next section.

It follows that when you use Sovnex to process your customers' or your employees' data, you are the controller of that data and we play no part in it.

3. What we collect

The following list is exhaustive — there is no category of data we hold that is not named here.

Account data: Your email address, a cryptographic hash of your password (never the password itself), whether the address has been verified, your marketing preference, and the date you registered.
Subscription and licence data: Your Stripe customer and subscription identifiers, the plan you are on, the number of seats, the billing period, and the licences we have issued together with their expiry dates.
Installation identifier: A random identifier generated by your own Sovnex deployment, which ties a licence to one installation. It says nothing about you or your machine — it is a random value.
Licence heartbeat: Your deployment contacts the licence service periodically to renew its licence. Each contact records the installation identifier, a random value for the running process, how many seats are in use, and the first and last time we saw it. It contains no document, no file name, no query, and no identity of anyone using your system.
Anti-abuse records: When you register, sign in, start a trial or open the billing portal, we briefly store the IP address the request came from and the email address used, so that repeated attempts can be rate-limited. These records are deleted after at most one hour.
Email delivery records: For each message we send you — address verification, licence activation, a billing portal link, or a promotional message if you have not opted out — we keep the recipient address, which message it was, when it was sent and whether delivery succeeded.
Server logs: Our servers write one line per request, which includes the IP address it came from. These are operational logs for troubleshooting, not an analytics system: they are not indexed, not aggregated into profiles and not shared with anyone.

4. What we do not collect

Several of these are unusual enough in 2026 that they are worth stating explicitly rather than leaving to inference.

No analytics, of any kind. There is no Google Analytics, no Plausible, no PostHog, no Matomo, no Sentry — no measurement or session-replay tool, first-party or third-party.
No tracking cookies, advertising cookies, tracking pixels, fingerprinting, ad networks or data brokers. We have never sold or rented personal data and we will not.
No third-party fonts or CDNs. Every font, script, style sheet and image on this site is served from our own server, so reading a page here discloses your IP address to us and to nobody else.
No card details. Payment is handled entirely on Stripe's own hosted page; your card number, expiry date and security code never touch a Sovnex server.
No name, postal address, telephone number or company details — we do not ask for them, beyond whatever you choose to write in an email to us.
Nothing from inside your Sovnex deployment: no documents, no embeddings, no prompts, no answers, no end-user identities, no usage statistics beyond the seat count in the heartbeat.

5. Why we process it, and on what legal basis

Under the GDPR every processing operation needs a legal basis. Ours are:

Performance of a contract: Creating and maintaining your account, issuing and renewing licences, taking payment and providing support. Without this data there is no way to give you a working licence.
Legitimate interest: Keeping the service available and secure: rate-limiting abusive requests, keeping server logs, and enforcing the terms of the licence you bought — the heartbeat is what tells us whether more copies are running than the plan allows. We have weighed this against your interests and kept it to the minimum that works.
Consent: Sending you promotional email. You can withdraw that consent at any moment, and doing so changes nothing else about your account.
Legal obligation: Keeping billing and accounting records for the period that tax law requires.

6. Cookies and local storage

We set no analytics and no advertising cookies, which is why this site shows you no consent banner: everything below is either strictly necessary to operate the service or a preference you chose yourself.

You can delete all of it at any time from your browser. Deleting the session cookies signs you out; deleting the others simply resets the corresponding preference.

Name	Where	What it does	How long
`sovnex_session`	Cookie	Keeps you signed in to your account. It is readable only by our server, never by scripts running in your browser.	24 hours, or until you sign out.
`sovnex_admin`	Cookie	The same, for our internal administration console. It is never set for ordinary visitors.	24 hours, or until sign-out.
`pending_install_id`	Cookie	Carries the installation identifier from your Sovnex deployment through registration and checkout, so the licence you buy is bound to the right installation.	1 hour, and cleared as soon as the licence is issued.
`NEXT_LOCALE`	Cookie	Remembers which of the six site languages you chose.	1 year.
`theme`	Local storage	Remembers whether you chose the light or the dark appearance. It never leaves your browser and is never sent to us.	Until you clear your browser storage.

8. Data leaving the European Union

Our own server is in France and the data we hold stays there. Our providers may, for their own operations — support teams, backups, fraud prevention — process some data outside the European Economic Area. Where that happens the transfer relies on the European Commission's Standard Contractual Clauses, which each of those providers publishes in its own privacy documentation.

9. How long we keep it

Account, subscription and licence records: For as long as you have an account with us. After it is closed we keep only what accounting and tax law obliges us to keep, and no longer than those rules require.
Licence heartbeat records: For as long as the subscription they belong to is active, and for a limited period afterwards so that a licence dispute can still be investigated.
Anti-abuse records, including IP addresses: One hour at most.
Email delivery records: For as long as we need them to demonstrate that we had your consent and that we honoured your unsubscribe request.
Server logs: They live on the server only, and are discarded whenever the service is redeployed.

10. Your rights

If you are in the European Union you have the rights below — and in practice we apply them to everyone, wherever they live.

Ask what data we hold about you, and receive a copy of it.
Have inaccurate data corrected.
Have your data erased.
Restrict or object to certain processing.
Receive your data in a portable, machine-readable format.
Withdraw your consent to marketing email at any time.

There is no self-service delete button yet, so erasure is handled by hand: we confirm that the request comes from the owner of the account, delete the account and the data attached to it — keeping only the billing records that accounting law obliges us to retain — and confirm to you when it is done. We answer every request within one month.

If you believe we have mishandled your data, you may lodge a complaint with the data protection authority of your country. In France that is the CNIL (cnil.fr).

To exercise any of these rights, write to us at contact@sovnexai.com

11. Marketing email

We send few messages, and only about Sovnex. Every one of them carries an unsubscribe link and the header your mail client reads to offer you a one-click unsubscribe. Unsubscribing takes effect immediately.

It never affects the operational messages you actually need — licence activation, expiry warnings, billing receipts. Those are part of the service rather than marketing, and they continue as long as you have an account.

12. How we protect your data

All traffic to sovnexai.com and to the licence service is encrypted with TLS, and the certificates renew automatically.
Passwords are stored as PBKDF2-HMAC-SHA256 hashes with 600,000 iterations and a unique salt per account. We cannot read them, and a copy of the database would not reveal them.
Session cookies are HTTP-only and marked Secure, so no script can read them.
The private key used to sign licences is held outside the application, on the server's file system, readable only by the licence service.
The database is not reachable from the internet; only the licence service can talk to it.

No system is perfect. If you find a security problem, please write to us before disclosing it publicly — we will answer.

13. Children

Sovnex is sold to organisations. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and we will remove it.

14. Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we use your data, we will tell account holders by email before it takes effect, rather than relying on you to notice.