Privacy policy

Who we are

Sofia is a service of Arkhe B.V., Jaap Speyerstraat 48, 1087 MK Amsterdam, the Netherlands (Chamber of Commerce 51507188). Arkhe B.V. is the controller for the processing of personal data described in this policy.

What data

When you visit the website

• No cookies and no third-party scripts or services on the website.
• Our server keeps a technical log and an anonymous, cookieless campaign counter: time, requested page, status code and any campaign parameters in the link (such as utm_*) with a temporary session code to measure which ad led to a WhatsApp conversation or waitlist signup. Your IP address and browser details are not stored in it.

When you join the waitlist

• Your email address, and if you fill it in your business name, the language of the page and the time you signed up.

When you use Sofia on WhatsApp

• Your phone number, your name as shown in WhatsApp and the messages you exchange with Sofia. Voice messages are not transcribed or listened to.
• The data of the Google Business Profile that Sofia manages for you: business name, address, opening hours, photos, posts, reviews and the replies to them.
• Google reviews contain the name the reviewer made public there. We do not send that name to the AI model; Sofia writes a reply without the name and the name is only filled in when the reply is posted.
• Payment and invoice data: business name, address and VAT number if you provide them, and the status of your payments.

What for

• Waitlist: to email you as soon as Sofia is available for you. Legal basis: your consent, which you can withdraw at any time.
• The Sofia service: to answer your messages and manage your Google Business Profile as you ask. Legal basis: performance of the contract.
• Payments and invoices: to invoice you and keep our accounts. Legal basis: legal obligation.
• Security: to prevent abuse of the website and the service, for example by limiting the number of requests. Legal basis: legitimate interest.

We do not sell your data or use it for advertising. AI models are not trained on your data.

Data from Google

When you connect your Google Business Profile — via Google's consent screen (scope business.manage) or by adding sofia@tellsofia.com as a manager on your profile — you give Sofia access to manage that business profile. Sofia gets no access to your Gmail, Drive or contacts.

• What we use: the data of your business profile: business name, address, opening hours, photos, posts, reviews and the replies to them, and the profile's statistics.
• What for: only to provide the features you ask for on WhatsApp: reading and replying to reviews, updating your profile, posting photos and updates and preparing the monthly report. Sofia posts nothing without your OK and never deletes anything.
• AI: to suggest a reply, the text of a review, without the reviewer's name, is sent to the AI model in the EU (Amazon Bedrock, Frankfurt). Data from Google is not used to train AI models.
• No selling or advertising: we do not sell data from Google, share it only with the processors on this page and do not use it for advertising.
• People: our team looks at your Google data only when you ask us to, for security, or when the law requires it.
• Revoking: you can revoke access at any time at myaccount.google.com/permissions or by removing sofia@tellsofia.com as a manager under People and access in your Google Business Profile. After that Sofia can no longer use your profile; stored data follows the retention periods below.

Sofia's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

• Technical website log: 14 days.
• Waitlist: until you are invited and at most 12 months after signing up, or sooner if you ask.
• Service data: as long as you use Sofia and up to 30 days after you cancel.
• Invoices and payment records: 7 years (statutory tax retention).

Processors

We work with the following parties. Our servers and the AI model are located within the European Union.

• Hetzner Online GmbH (Germany): servers and storage, in Germany.
• Amazon Web Services EMEA SARL (Luxembourg): the AI model, via Amazon Bedrock in the EU region (Frankfurt). Requests stay within the EU and are not logged.
• Meta Platforms Ireland Ltd. (Ireland): WhatsApp Business Platform. WhatsApp messages are processed by Meta and may be stored outside the EU (in the United States). This transfer takes place lawfully under the EU-US Data Privacy Framework.

We also work with parties that are themselves responsible for the data they process: Google Ireland Ltd., to manage your Google Business Profile through the Google API, and our bank bunq B.V., for iDEAL payments.

Arkhe Teknoloji Yatırımları A.Ş. (Turkey) develops and operates the software that runs Sofia. This is done from Turkey; your data remains stored on our servers in Germany. This access from outside the EU is covered by the European Commission's standard contractual clauses.

Meta and Google belong to groups outside the EU. Any transfer outside the EU is covered by GDPR safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You have the right to access, correct or delete your data, to restrict processing, to object and to data portability. You can withdraw consent at any time. Just send us an email; we respond within one month.

If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

Contact

Arkhe B.V., Jaap Speyerstraat 48, 1087 MK Amsterdam, the Netherlands (Chamber of Commerce 51507188)
info@tellsofia.com