Privacy Policy

1. Information We Actually Collect

SopAI collects only the specific data points required to deliver our core compliance drafting and administrative organization service:

• Account Credentials: Name, work email address, organization name, and authentication tokens (via our secure email login and password-based system).
• Employee & Compliance Records: Name, active status, certifications, expiration dates, and metadata.
• Compliance Documents: PDFs or image files of training logs, occupational certifications, standard operating procedures, and related workplace compliance material uploaded by the user.
• Usage & Technical Data: IP address, browser type, device information, session cookies, and action logs detailing when you upload files, view pages, or execute drafting tools.

2. Legitimate Purposes of Processing

We process this collected information solely for clear, legitimate operational purposes in delivering the SopAI application:

• Providing user authentication and secure profile separation between organizations;
• Extracting text data from uploaded certification documents to populate tracking panels;
• Sending automated alert notifications to designated administrators when certifications are nearing expiration;
• Generating drafted standard operating procedures or safety plans via secure, sandboxed external AI integrations;
• Answering user support tickets and diagnosing system bugs or service stability issues; and
• Maintaining audit logs for security, platform abuse prevention, and legal reliability.

3. Customer Responsibility for Employee Data

SopAI acts as a data processor on behalf of our customer organizations. The Customer is solely responsible for ensuring they have obtained all legally required permissions, authorizations, and consents from their individual employees prior to uploading any employee-identifiable details or certification sheets into SopAI.

4. Third-Party AI Data Processing

SopAI integrates with secure third-party AI infrastructure providers, including OpenAI and Anthropic, to analyze uploaded file text and generate drafted procedures. Only the raw document text and explicit prompts required to run these functions are transmitted. These external providers do not use SopAI data to train their models under our standard developer agreements. No other unsupported privacy or training claims are made.

5. Realistic Security Measures

We are committed to securing your data through realistic, standard commercial practices. We utilize Transport Layer Security (TLS/HTTPS) for all transit connections and store persistent customer information in secure, encrypted cloud-hosted databases provided by established vendors.

Note: SopAI has not obtained formal external SOC 2, ISO 27001, or third-party cybersecurity audits or certifications at this time. We represent our data protection procedures honestly and do not claim unverified certifications.

6. Retention & Cookies

Retention: We retain account records, certification data, and files as long as the Customer maintains an active account with us. Upon request or termination of service, we will permanently delete or anonymize all associated data within 30 days.

Cookies & Tracking: We use strictly necessary session cookies to maintain your login state, remember site preferences, and gather basic anonymized usage analytics. We do not engage in invasive cross-site marketing tracking or behavioral advertising.

7. Privacy Requests & Support

If you wish to view, modify, restrict, or request complete deletion of any of your organization's or employees' personal data collected by our systems, you may submit an email inquiry directly to our support team at support.sopai@gmail.com.

8. Policy Changes

We may occasionally update this Privacy Policy. If we make material modifications, we will post notice of the changes directly on this page and revise the Last Updated date at the top of the policy. Continued use of the service following these updates constitutes acceptance of the new terms.