Privacy policy

Who is responsible

Altis Koten SRL ([to be completed]) is the controller for the personal data described here. For your customers' data in your account, we are your processor (see the data processing agreement). Write to hello@sotance.com for any request.

What we collect, and why

• Your account: email address, name if you give one, language, the organizations you belong to. To sign you in and run the service (contract). If you sign in with Google, Google tells us your email address and name; we keep no Google password or token.
• Billing: your company's name, address and VAT number, held by Stripe. To invoice you (contract, legal obligation). We never see your card number.
• Free audit: your email address, the brand, sector and market you asked about, and whether you agreed to be contacted again about the audit. To run the audit and show its result and, only if you agreed, to contact you again about it (consent). The brand, sector and market go to Anthropic, which writes the questions, and the questions to DataForSEO and cloro, which ask the assistants (see the list of services below); your email address never does. To limit audits per visitor, we keep a keyed hash of your network address, never the address itself, for as long as we keep the request.
• Weekly digest: each week, usually on Monday, members get an email with their projects' results of the week before, sent to their account's address (legitimate interest). Turn it off in your account settings or with the link at the bottom of every digest; we note which digest went to whom, so none is sent twice.
• API keys (MCP): the key's name, its first characters, a cryptographic fingerprint (the key itself is never kept), who created it, and when it was created, last used and revoked. Each call from an assistant is logged with the tool called, the project and the time, never the content of the request. For security, support and proof (legitimate interest).
• Activity log: who did what in an account, for your questions, security and incident review (legitimate interest).

What we don't do

No advertising trackers and no sale of data. The questions we put to AI assistants contain no personal data: no names, no emails, nothing from your account.

How long we keep it

• Activity log, assistants' calls included: 395 days (13 months).
• A revoked API key: 365 days after it was revoked.
• Collected answers, with their sources and raw technical data: as long as the project exists, so each day compares with the first. They go when you delete the project or the account.
• A free-audit request without consent: 30 days.
• A free-audit request with consent: until you unsubscribe, at most 730 days.
• After an account is deleted: 30 days, then erased, backups included. Invoices are kept as accounting law requires.

Where it is, and who helps us

Your data is stored in the European Union. These providers process it for us, each under a data processing agreement:

Your rights

You may access, correct, erase or export your data, object to its use or withdraw consent, by writing to hello@sotance.com. We answer within a month. You may also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Measuring visits

On the public site we count page views and measure how fast pages load, with Vercel Web Analytics and Speed Insights. They set no cookie and build no profile: your IP address is only used, without being stored, to tell one visit from another for a day. We record the page's path, without its query, and never the identifier in an audit result's or an invitation's address. Our legitimate interest is to know which pages help visitors and to keep them fast.

Cookies

We only set the cookies the site needs: your session once signed in, and your language. No consent banner is needed for these, and there are no others.