Last updated: 6 August 2026
Controller: Sofias Tech, S.L. — Spanish tax ID B-75.897.645
Registered office: Paseo Miramón 170, 3rd floor, Gipuzkoa Science and Technology Park, 20014 Donostia – San Sebastián (Gipuzkoa), Spain
Commercial Registry: Registro Mercantil de Gipuzkoa, Sheet SS-47905, entry 1
Contact: support@sofias.ai
No Data Protection Officer has been appointed, as none of the circumstances set out in Article 37 GDPR apply.
We process your IP address, technical browser data and the pages you visit in order to keep the site running and secure, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
With your consent (Art. 6(1)(a) GDPR), collected through the cookie notice, we analyse site usage statistically using Google Analytics 4. Without consent, the tool is not activated.
We process the content of your messages, a technical conversation identifier and any name and email address you choose to provide, in order to handle your enquiry and, where appropriate, route it to the relevant team. The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f)) and pre-contractual steps where the enquiry concerns purchasing the service (Art. 6(1)(b)).
Content is processed by artificial intelligence systems on infrastructure located in the European Union and stored encrypted. It is never used to train AI models.
We process your email address to send you informational and commercial communications, on the basis of your consent, which you may withdraw at any time.
We process your name, email, CV and any information you provide in order to manage the selection process, on the basis of your consent and pre-contractual measures.
To deliver the service we process the contact details of the users designated by the client organisation, on the basis of performance of the contract (Art. 6(1)(b)).
As regards personal data that the client organisation enters or makes accessible through the platform, Sofias acts as a processor, not as controller. That processing is governed by the data processing clause of the General Terms and Conditions, which constitutes the binding legal act required by Article 28(3) GDPR.
We process identification, tax and billing data to run the programme and pay commissions, on the basis of performance of the contract (Art. 6(1)(b)) and compliance with legal, tax and accounting obligations (Art. 6(1)(c)).
Sofias infrastructure — both the website and the platform — is hosted in Hetzner Online GmbH data centres located in Germany. AI agent processing runs on providers located in the European Union.
Some auxiliary website services are provided by companies headquartered in the United States, as detailed below. In those cases the international transfer relies on the applicable adequacy decisions and, failing that, on standard contractual clauses approved by the European Commission.
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the website and the platform | Germany |
| Lyceum | AI agent processing (model inference) | European Union |
| Regolo | AI agent processing (model inference) | European Union |
| Scaleway | AI agent processing (model inference) | France |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 and reCAPTCHA | Ireland / USA |
| Salesforce, Inc. | Newsletter form and commercial contact management | USA |
| Stripe Payments Europe, Ltd. | Payment processing and partner commission payouts | Ireland / USA |
| Microsoft Ireland Operations Ltd. | Corporate email and, with the user's authorisation, connectors to their own mail and documents | European Union |
Your data may also be disclosed to public authorities where required by law.
You may exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent given, without affecting the lawfulness of prior processing.
Simply write to support@sofias.ai stating the right you wish to exercise and enclosing proof of identity. We will respond within one month.
If you believe your request has not been properly handled, you may lodge a complaint with the Spanish Data Protection Agency.
We apply technical and organisational measures appropriate to the risk: encryption of communications and of stored conversation content, role-based access control, activity logging, and separation of each client organisation's data.
The assistant generates responses automatically, but does not make decisions producing legal effects on individuals or otherwise significantly affecting them. Any decision with contractual effect requires human intervention.
We may amend this policy to reflect regulatory or service changes. The version in force is the one published on this page, with its update date.