Skip to content

Privacy Policy

Last updated: June 14, 2026

This Privacy Policy explains how Agent Sonic collects, uses, and protects information when you interact with our assistant over WhatsApp and when you visit our website. The data controller is Agent Sonic, Tel Aviv, Israel ("we", "us", "our"). For any privacy question, contact us at tryagentsonic@gmail.com.

Information we collect

  • WhatsApp messages & metadata — the content of messages you send to the assistant, your phone number, display name, and message timestamps, so we can understand and respond to you.
  • Voice notes — if you send a voice message, its audio is transcribed to text so it flows through the same pipeline as a typed message, and replies may be sent back as spoken audio.
  • Images & documents — photos and files you send for analysis, and, if you ask the assistant to create or edit an image, the prompt and any source photo used.
  • Conversation context — recent message history, a durable "memory" note the assistant maintains for your chat, any reminders you schedule, and contacts you share with the assistant.
  • Group messages — where the assistant is a member of a WhatsApp group, it may log messages in that group (sender name/number and content) to provide group features. Media bytes are not stored.
  • Outreach to third parties — if a user asks the assistant to contact another person on their behalf, we process that person's phone number, name, and the resulting conversation in order to carry out the request (see "Messaging third parties" below).
  • Google account data (only if you connect) — when you connect your Google account, we access your Google Calendar, Sheets and Docs on your behalf to fulfill your requests. We store only an encrypted OAuth refresh token, never your Google password.
  • Website & contact-form data — if you submit our website contact form, we collect your email and any name, phone, company, message, and marketing-attribution (UTM/referrer) you provide. Our website also uses analytics — see "Cookies & analytics" below.
  • Payments — if you buy a paid feature, your payment is processed by PayPal. We do not collect or store your payment-card or bank details; we only receive confirmation of payment (such as a transaction status) from PayPal. See "Payments" below.

How we use information & legal basis

We use the information to provide the assistant's features: replying to your messages, transcribing voice, analyzing images/documents, maintaining context and reminders, carrying out requested actions and outreach, and — if connected — reading your calendar and reading/writing your spreadsheets and documents when you ask. We use contact-form data to respond to your enquiry and follow up.

Where the EU/UK GDPR applies, our legal bases are: performance of a contract with you (providing the service you request); your consent (e.g. connecting your Google account, or website analytics); and our legitimate interests in operating, securing, and improving the service. We do not use your message content or Google data to train AI models. Some messages may reveal sensitive information; we process it only to carry out your request and rely on your consent or your provision of that data to us.

Messaging third parties

When a user directs the assistant to contact another person, that person did not necessarily agree to be contacted by us. The requesting user is responsible for having a lawful basis and any required consent, and for complying with anti-spam law (including section 30A of the Israeli Communications Law and equivalents elsewhere) — see our Terms of Service. If you received a message from the assistant and want your data removed or to object, contact us at tryagentsonic@gmail.com.

Google user data — Limited Use

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • Google user data is used only to provide or improve user-facing features that are prominent in the assistant's experience.
  • We do not sell Google user data, and we do not use it for advertising.
  • We do not allow humans to read your Google user data, except: with your explicit consent, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized.

Categories of recipients

We share your data only as needed to run the service, with the following categories of providers acting on our behalf under contract:

  • AI providers — to generate responses, transcribe voice notes, and create images you request, from your message content, audio, and prompts.
  • Google — Google APIs, called on your behalf only if you connect your Google account (see "Google user data" below).
  • Infrastructure providers — cloud hosting and database storage for the data described above.
  • Analytics providers — website-only usage analytics (see "Cookies & analytics" below).
  • PayPal — our payment processor, if you buy a paid feature (see "Payments" below).

These providers act as our processors under contract and may not use your data for their own purposes. We do not sell your personal data. We otherwise disclose data only where required by law or to protect our rights. To request the specific list of providers, contact us at tryagentsonic@gmail.com.

Storage, security & international transfers

Data is stored in our database. OAuth refresh tokens are encrypted at rest (AES-256-GCM). Google data is retrieved on demand to answer your requests and is not retained beyond what is needed to respond. Some of our providers are located outside your country, including in the United States; where we transfer personal data from the EU/EEA, UK, or Israel, we rely on an appropriate transfer mechanism (such as the EU Standard Contractual Clauses or an adequacy decision).

Data retention & deletion

We keep your data for as long as you use the assistant and as needed to provide the service, then delete or anonymize it when it is no longer needed or on your request, unless we must keep it to comply with a legal obligation or resolve disputes. You can disconnect your Google account at any time by sending /disconnect in your chat, which deletes the stored token immediately. To request deletion of your other data, contact us at tryagentsonic@gmail.com.

Your rights

Subject to applicable law (including the EU/UK GDPR and Israel's Protection of Privacy Law), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email tryagentsonic@gmail.com. You also have the right to lodge a complaint with a supervisory authority — in Israel, the Privacy Protection Authority; in the EU/UK, your local data-protection authority.

Cookies & analytics

Our website uses a third-party web analytics service and browser storage to understand traffic and remember marketing attribution (UTM/referrer) so we can attribute a contact-form submission to its source. This is separate from the WhatsApp assistant, which does not use advertising cookies.

Payments

Paid features are billed through PayPal. Your card or bank details are entered with and held by PayPal — they do not pass through or get stored on our systems; we only receive a payment confirmation. PayPal processes your payment data as an independent controller under its own privacy policy, which we encourage you to review.

Data breaches

If a data breach occurs that is likely to pose a risk to your rights, we will notify the relevant authority and, where required, affected individuals, in line with applicable law.

Children

The assistant is not directed to children under 16 (or the minimum age for valid consent in your jurisdiction), and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Contact

Questions about this policy? Email tryagentsonic@gmail.com.