Privacy Policy

Last updated: 23 October 2025

SOPHIE ("we", "us", "our") is committed to protecting your privacy and ensuring transparency in how we use your personal data. This Privacy Policy explains how we collect, use, and share your personal information when you interact with our advertising and marketing, including through social media platforms (e.g., LinkedIn, Meta), search engines (e.g., Google), and landing pages promoting our CRM automation solutions.

1. Who We Are

SOPHIE is a company headquartered in the United Kingdom.

  • Company Name: Sophie Datagen Ltd
  • Registered Address: 128 City Road, London, GB
  • Company Number: 16157376
  • Contact: hello@sophiedoc.ai

2. What Personal Data We Collect

We may collect the following types of personal data through our advertising efforts:

  • Identifiers: Name, email address, job title, company name, country/region
  • Device and Usage Data: IP address, browser type, device type, and interaction data (e.g., clicks on our ads or time spent on our landing pages)
  • CRM Data: If you submit a form (e.g., to request a demo), we store your information in our CRM (e.g., HubSpot or Salesforce)
  • Marketing Data: Responses to ads, open/click rates on email campaigns, LinkedIn Lead Gen Forms, and cookies or tracking pixels from platforms like Google Ads, LinkedIn, and Meta

3. How We Use Your Data

We use your data for the following purposes:

  • To serve and personalize ads (retargeting, lookalike audiences, etc.)
  • To analyze ad performance and optimize campaigns
  • To contact you (with your consent) about SOPHIE's products or offers
  • To manage your demo or inquiry request via our CRM system
  • To ensure compliance with applicable laws and regulations

4. Legal Basis for Processing

Under the UK GDPR / EU GDPR, our lawful bases for processing include:

  • Consent: For marketing communications and cookies
  • Legitimate Interests: To promote SOPHIE's CRM automation tools to relevant professionals
  • Contract: To follow up on demo requests or inquiries

For California Residents (under the CCPA/CPRA), we do not sell personal data, but we may share data with advertising platforms for targeted ads, which may qualify as a "sale" or "sharing" under California law. You may opt out at any time (see Section 8).

5. Who We Share Data With

We may share your data with:

  • Advertising platforms: LinkedIn, Meta, Google Ads
  • CRM providers: HubSpot, Salesforce
  • Marketing partners: Agencies or freelancers helping manage campaigns
  • Analytics tools: Google Analytics, LinkedIn Insights Tag
  • Legal authorities: If required by law or to protect our legal interests

All service providers are bound by data protection agreements.

6. Data Retention

We keep your personal data only as long as necessary for the purposes stated above, or as required by law. This usually means:

  • Up to 12 months for ad engagement data
  • Up to 24 months for CRM and lead gen data (unless you become a customer)
  • Indefinitely for anonymized analytics data

You can request deletion at any time (see Section 7).

Data Deletion Service Level Agreement

Upon receipt of a verified data deletion request, we will delete your personal data within 30 days and provide written confirmation of completion. In cases where data is stored across multiple systems or with third-party processors, deletion may take up to 60 days. We will keep you informed of our progress throughout this process.

7. Your Data Protection Rights

Depending on your location, you have the following rights under data protection law:

Your Rights Include:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate or incomplete information
  • Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
  • Right to Restrict Processing: Request that we limit how we use your data
  • Right to Object: Object to processing based on legitimate interests or for direct marketing
  • Right to Data Portability: Receive your data in a structured, commonly used format
  • Right to Withdraw Consent: Withdraw consent at any time (e.g., unsubscribe from marketing)
  • Right to Lodge a Complaint: File a complaint with your local data protection authority (for UK: Information Commissioner's Office at ico.org.uk)

How to Exercise Your Rights

To exercise any of your data protection rights:

  • Send an email to: hello@sophiedoc.ai
  • Use a clear subject line specifying your request type: "Data Access Request", "Data Deletion Request", "Data Correction Request", or "Object to Processing"
  • Include the following information: your full name, email address associated with our services, company name (if applicable), and a detailed description of your request

Identity Verification: We will verify your identity before processing your request to protect your personal data from unauthorized access. We may ask for additional information to confirm your identity.

Response Time: We will acknowledge receipt of your request within 5 business days and provide a full response within 30 days (one month) of verification. If your request is complex or we receive multiple requests, we may extend this by an additional 60 days and will inform you of the extension and reasons.

No Fee: There is no fee for making a data subject request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse the request.

Data Deletion Request Process

If you submit a Data Deletion Request, here's what will happen:

  1. Submit Request: Email hello@sophiedoc.ai with "Data Deletion Request" in the subject line
  2. Identity Verification: We will verify your identity within 5 business days (we may request additional information)
  3. Review: We will review your request to determine if any legal exemptions apply (see below)
  4. Deletion: Once verified, we will delete your personal data from our active systems within 30 days (or up to 60 days if stored across multiple systems)
  5. Confirmation: We will send you written confirmation once deletion is complete, including details of what was deleted
  6. Third Parties: Where applicable, we will notify third-party processors (e.g., HubSpot, advertising platforms) to delete your data from their systems

When We Cannot Delete Your Data

In certain circumstances, we may be unable to delete your personal data if we need to retain it to:

  • Comply with legal obligations (e.g., tax records, accounting requirements, regulatory compliance)
  • Establish, exercise, or defend legal claims
  • Fulfill a contract or legal obligation we have with you
  • Protect the vital interests of you or another person
  • Perform a task in the public interest

If we cannot fully delete your data, we will:

  • Explain the specific legal reason why we must retain certain information
  • Delete all data that we are not legally required to keep
  • Restrict processing of the retained data to only the necessary legal purpose

8. Your Privacy Choices

Email Marketing

You can unsubscribe anytime via the unsubscribe link in our emails or by emailing hello@sophiedoc.ai.

Cookies

Use the cookie banner on our website or adjust your cookie settings. You can also manage cookies through your browser settings.

Targeted Ads

You can opt out of targeted advertising via:

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect, use, disclose, and sell/share
  • Request deletion of your personal information
  • Opt out of the sale/sharing of your personal information
  • Non-discrimination for exercising your privacy rights

To exercise these rights, email hello@sophiedoc.ai with "California Privacy Request" in the subject line.

9. International Transfers

As a UK-based company working with international platforms, we may transfer your data outside the UK or EEA. Where we do, we ensure appropriate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission or UK authorities
  • Adequacy decisions where the destination country has been deemed to provide adequate data protection
  • Binding Corporate Rules where applicable

You can request more information about the safeguards we use for international transfers by contacting hello@sophiedoc.ai.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or damage. These measures include:

  • Encryption of data in transit and at rest
  • Access controls and authentication requirements
  • Regular security assessments and updates
  • Employee training on data protection
  • Contracts with third-party processors requiring equivalent security measures

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we do, we'll:

  • Update the "Effective Date" at the top of this policy
  • Notify you of material changes via email (if we have your email address) or through a prominent notice on our website
  • For significant changes that affect your rights, we may seek your renewed consent where required by law

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

Questions or Concerns?

We're here to help.

UK Data Protection Authority

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

This Privacy Policy is designed to comply with UK GDPR, EU GDPR, CCPA, and other applicable data protection regulations.