Privacy Policy

1. Who is responsible for your data

For your account, billing and platform usage data, the controller is SOCIOS A.I USA LLC, with its registered office at 7550 Futures Drive, Suite 204, Orlando, FL 32819, United States.

Contact channel for any privacy matter: socio@sociosai.com.

For your leads' data (name, phone, email and the content of conversations), you, the customer, are the controller: you decide the purposes and means of the processing. The platform acts as processor and handles that data strictly on your instructions.

It is your responsibility to have a valid legal basis to contact your leads and to instruct us to process their data, including when you import lists or connect campaigns.

2. Data we process

We process only what is needed to run the AI sales agent, charge for the service and meet legal obligations.

• Customer account data: name, email, access credentials, language, time zone and, for companies, legal name and tax identification.
• Billing data: plan, invoice history and the transaction identifiers issued by the payment processor. We do not store full card numbers.
• Lead data, processed on behalf of the customer: name, phone, email, source and campaign, lead score, tags and the full content of conversations across WhatsApp, email and SMS, including WhatsApp voice messages (transcribed) and payment receipts sent by the lead.
• Knowledge base materials: PDFs, spreadsheets, presentations and images the customer uploads to guide the agent, processed with text recognition (OCR).
• Usage data: access logs, IP address, session identifier, browser and actions taken in the dashboard.
• Support data: messages, attachments and ticket history.

3. Why we use data and on what legal basis

Each processing activity has a specific purpose and a matching legal basis among those recognised by applicable data protection law.

For lead data, the purposes are defined by you, the customer, within the limits of the service: answering, qualifying, following up and scheduling.

• Performance of the contract: creating and maintaining your account, running the AI agent that answers, qualifies and follows up with your leads, scheduling meetings, handing conversations over to a human with a summary, processing payments and providing support.
• Legal or regulatory obligation: tax documents, retention of access logs for the period required by applicable law and responses to competent authorities.
• Legitimate interest: platform security, fraud and abuse prevention, aggregate product metrics and usability improvements.
• Consent: non-essential cookies and marketing communications. Consent can be withdrawn at any time.

4. Artificial intelligence features

The AI agent is the core of the service: it answers leads on WhatsApp, email and SMS on the customer's behalf, qualifies them, performs up to 10 follow-ups per funnel, schedules meetings and hands the conversation over to a human with a summary of what was discussed.

To generate responses, the conversation content and the necessary context are sent to the model providers Anthropic and OpenAI only at the moment an AI feature runs. These providers are contractually barred from using the content to train models.

Voice messages received on WhatsApp are transcribed so the agent can understand and answer them.

Materials uploaded to the knowledge base feed only your account's AI: they are not used to train our own models and are not shared with other customers.

5. Connected channels and integrations

The agent operates through the channels you connect, always with your own credentials: WhatsApp via QR pairing with your own number, SMS through your own Twilio credentials and email through the credentials you configure.

The Google Calendar and Meta Lead Ads integrations use the official OAuth flows. We receive only the data you authorise and use it solely to deliver the contracted features: creating calendar events on your behalf and receiving the leads generated by your campaigns.

Oliv.IA's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained through Meta APIs is handled in accordance with the Meta Platform Terms and Developer Policies. We do not use it for advertising, external profiling or resale.

You can revoke access at any time by disconnecting the channel or integration in the dashboard or in the provider's own settings.

6. Who we share data with

We do not sell personal data. We share only what is necessary and always under a data protection agreement.

The complete and current list of subprocessors, with each one's purpose and our advance notice of changes, is published on this site's Subprocessors page.

• Infrastructure, message delivery, storage and payment processors.
• AI providers (Anthropic and OpenAI), only when an AI feature runs, as described in section 4.
• Providers of the channels and integrations you connect (WhatsApp, Twilio, Google and Meta), to the extent needed to send and receive messages, calendar events and leads.
• Public authorities, when there is a substantiated legal request.
• Third parties in a corporate transaction, with prior notice and the same safeguards maintained.

7. International transfers

Our infrastructure and AI providers may operate in a country other than yours. In those cases we apply appropriate contractual safeguards, including the European Commission's Standard Contractual Clauses where the GDPR applies.

8. How long we keep data

We keep data for as long as the purposes above and legal deadlines require.

• Account data: while the account is active and for up to 30 days after closure, to allow recovery.
• Lead data and conversations: for as long as you, the customer, determine. You can export your leads to CSV at any time and request the deletion of specific leads or of the entire base; when the account is closed, this data is deleted with it.
• Knowledge base materials: for as long as you keep them on the platform; deleted when you remove them or close the account.
• Access logs: 6 months, or the longer period required by applicable law.
• Tax and billing documents: for the period required by applicable tax law.
• Channel and integration credentials and tokens: revoked immediately on disconnection.

9. Your rights

As a data subject you have the rights below, recognised by the GDPR and equivalent laws. Write to socio@sociosai.com and we will respond within 15 days.

If you are a lead served by a customer of the platform, please direct your request first to that customer, who is the controller of your data; we will support the handling of the request according to their instructions and applicable law.

• Confirmation that processing exists, and access to the data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymisation, blocking or deletion of unnecessary or non-compliant data.
• Portability of your data to another provider.
• Deletion of data processed on the basis of consent.
• Information about data sharing and about your option to refuse consent.
• Withdrawal of consent and objection to processing based on legitimate interest.

To delete your account and data, follow the Data Deletion Instructions. You may also lodge a complaint with the competent data protection authority in your country.

10. Security

We apply technical and organisational measures proportionate to the risk: encryption in transit (TLS), encryption of credentials and tokens at rest, role-based access control, data isolation between accounts, audit logging and regular backups.

In the event of a security incident involving relevant risk, we will notify you and the competent authority within the deadlines required by applicable law.

11. Children and teenagers

The platform is not intended for people under 18 and we do not knowingly collect data about children or teenagers. Where identified, such data will be deleted.

12. Cookies

We use strictly necessary cookies for authentication and session, preference cookies (theme and language) and first-party attribution cookies for the partner programme. Details and controls are on the Cookie Policy page.

13. Updates to this policy

We may update this Policy. Material changes are announced by email or through a dashboard notice before they take effect. The last update date is shown at the top of this page.