1. Who we are
SoKKoS AI — eenmanszaak (sole proprietorship in the Netherlands), KvK 42029374, BTW-id NL005441743B74, Beuningen, Gelderland, NL. Contact: [email protected]. We're the data controller for everything described below.
2. What we collect
The smallest amount that lets us run an agent for you and send you a receipt.
- Withdrawal or cancellation declarations — if you use the withdrawal form or the cancellation page, we record the email address you gave, any contract reference and note, and the date and time your declaration reached us. We need this to act on it, and the law requires us to confirm receipt to you stating exactly that content and that timestamp — so the record is also our proof that we did. Legal basis: performance of the contract and our legal obligation.
- Email address — required for authentication (magic-link, email + password, or Google OAuth) and billing notifications. Stored in Azure Table Storage (West Europe).
- Password — only if you set one. If you choose email + password sign-in, we store your password solely as a salted bcrypt one-way hash (cost factor 12). Your plaintext password travels over TLS each time you set, change, reset or sign in with it, is processed in memory only to hash or verify, and is never stored or logged; we can't recover it — a reset issues a new single-use link. Magic-link and Google sign-in remain available if you prefer no password at all.
- Telegram chat / user ID and bot token — only if you link Telegram (e.g. to reach support via @sokkosai_bot or to run your agent's own Telegram bot). If you connect your own bot, its bot token is stored encrypted at rest (shown to you only as “set”, never displayed again) so your agent can send on your behalf. Used to route messages. Clearing the token removes it from storage; a running agent may keep using its current token until its next restart, when the disconnect takes effect.
- Google profile basics (name, picture) — only if you choose “Sign in with Google”. Used to greet you in the dashboard. Disconnect any time and we delete the cached copy.
- LinkedIn publisher data — operator account only. Our internal admin publisher stores the LinkedIn member/Page identifier, granted scopes, token expiry and OAuth access/refresh tokens needed to publish SoKKoS posts. Tokens are encrypted before storage and never shown in the browser or logs. This integration is not offered to customer accounts; disconnecting it deletes the stored authorization.
- IP address — logged for rate-limiting and fraud prevention. Rate-limit counters are keyed to short time windows and are not used once their window passes; the IP recorded at signup stays with your account record. We also record the IP and time of each successful sign-in so our administrators can see when accounts use the same address. A shared IP alone does not trigger an account block. These sign-in records are deleted with your account.
- Payment metadata — transaction IDs, amount, currency, method (SEPA / iDEAL / card / PayPal). Processed by Mollie B.V. in Amsterdam. We never see your card number or bank credentials — only the receipt.
- Server logs — request paths, response codes, timing. No request bodies. Retained 30 days for debugging, then rotated.
- “Report a problem” submissions — only if you use the bug-report button: your description, the page URL, and the most recent browser console logs (with API keys and tokens automatically masked) so we can debug the issue.
- Site-chat conversations, sent to our Telegram working channel — once a conversation with the site assistant has been quiet for about 20 minutes, a report of it is sent to our internal Telegram working channel (access limited to Konstantin, the operator) so that a request made in chat does not get lost. The report contains the transcript (shortened if the conversation is very long; passwords, API keys and tokens we recognise are replaced by a placeholder), an AI-written summary (Microsoft Azure OpenAI, see §4), which part of the site you chatted from, the language, the times and, if you left one, your contact details. Your IP address is not included. A message that shows you want a human to follow up (you include an email or phone number, or ask about pricing or setup) is also forwarded straight away. Telegram processes it outside the EU (§8). The conversation itself is stored separately on our servers (§2b).
- The chat conversation itself — since 7 August 2026 we keep what you write to the site assistant, and what it answers, for up to 24 months, or until you ask us to delete it, so a real person can read what people actually ask and fix bad answers (more in §2b). Kept against your account if you are signed in, otherwise against the first-party cookie described below; your IP address, browser and ad identifiers are not part of it. Once the window closes the turns are deleted from our storage by a scheduled job, not merely hidden — and you can ask us to erase yours sooner (§6). Please do not type card numbers or passwords into the chat; you never need to.
- A short note, so the assistant remembers you next time — separately
from the turns above. After a real exchange (roughly four messages or
more) the assistant writes a few sentences summarising what you were after, and
keeps that — not the messages — for up to 30 days after your
last visit, so you do not start from scratch if you come back. Each new
conversation rewrites the note rather than adding to it, so it stays a few
sentences however often you visit. If you stop coming back it lapses on its own,
and is deleted from our storage, not merely hidden.
If you are signed in, the note is kept with your account. Otherwise, it is kept with a small first-party cookie that identifies the browser, not you. Since browsers can be shared, the assistant uses the note quietly for context and never claims to recognise you. Signing in later joins the note to your account. We do not use your IP address to identify you for this note: a household, office or mobile network may share one address. Successful sign-in IPs are recorded separately for administrator observation as described in §2; a shared IP alone does not block an account.
Legal basis: our legitimate interest in giving continuous, useful answers to someone who contacted us (GDPR Art. 6(1)(f)). The note is used for nothing else, shared with no one, and never used to train models. You can have it deleted at any time — ask by email or WhatsApp, no reason needed.
2a. Privacy-first measurement
We measure how the site is doing — which pages people open, when a buy button is clicked — with a small, first-party setup that stays entirely on our own infrastructure: no Google Analytics, no Hotjar, no advertising or cross-site trackers (see §3 and §5). Two narrow additions to that baseline: Cloudflare Web Analytics — a cookieless, aggregate traffic beacon served by Cloudflare, the CDN already in front of this site (§4); it sets no cookies, stores nothing on your device and builds no visitor profiles — and the Meta Pixel, which loads only after you explicitly opt in via the cookie banner (see the third item below).
- Anonymous funnel events. When you open the “payment opening soon” popup or click a buy / register button, your browser sends us a tiny event — the event name, the package it referred to, and the page path. We store these in our own Azure database. No IP address, no email, no name, no cookie, and no raw browser fingerprint are attached. We create a random first-party identifier in your browser and immediately transform it into a keyed, one-way value on our server. That lets us count the same browser once across a selected reporting period without learning who uses it. Clearing site storage creates a new identifier; one browser is not necessarily one person.
- Advertising click-ids. If you reach us from an online ad, the link may
carry a Google click identifier (
gclid) or a Meta click identifier (fbclid) and campaign tags (utm_*). We keep these in your browser's local storage (first-party, up to 90 days) so that, if you later sign up or send a brief, we can tell which ad worked. We do not share this data with third parties for their own purposes; we only use it ourselves, and — if you convert — may upload the click-id back to the ad platform it came from (Google Ads or Meta) to mark that one conversion (“offline / enhanced conversions”). You can clear it any time by clearing site data in your browser. - Meta Pixel — opt-in only. To measure how well our ads on Meta platforms (Facebook / Instagram) perform and to build ad audiences, the site may load the Meta Pixel, a measurement script from Meta Platforms Ireland Ltd. It loads strictly after you click “Accept” in the cookie banner. If you decline — or simply ignore the banner — no pixel code runs and no request to Meta is made. You can withdraw consent at any time via the “Cookie preferences” link in the footer; the pixel then stops loading from your next page view. How Meta handles this data: facebook.com/privacy/policy.
The first-party measurement needs no cookie banner: the funnel events are anonymous and the click-id is stored only when you arrived from an ad you already clicked. The Meta Pixel is exactly why the banner exists — it never runs unless you've agreed. If you prefer not to be measured at all, decline the banner and browse with local storage disabled — the site works exactly the same.
2b. Conversations: what we keep, per channel
When you talk or write to us, we keep a record of the conversation. This is what is stored on each channel; purpose, retention and deletion are stated below the list.
- Site chat — what you write to the site assistant and what it answers, kept as a transcript (see §2 for how it is linked to you). Your IP address, browser and ad identifiers are not part of it. A report of each conversation is also sent to our internal Telegram working channel (§2).
- Voice agent on this site — your conversation is transcribed by AI. We keep the transcript of the session, an AI-written summary of it and the IP address your browser connected from. The audio is not recorded.
- Phone calls — calls to our published number are answered by an AI voice agent and transcribed by AI. We keep the transcript of the call, an AI-written summary and the calling number. Calls are not audio-recorded.
- Telegram, WhatsApp and email — messages you send us on these channels are kept as we receive them, together with the sender details that come with them (such as your username, phone number or email address). Messages to our Telegram support bot are kept in Telegram and partly in the bot's own database.
- Our Telegram support bot — when you write to @sokkosai_bot in your own words, an AI model (Microsoft Azure OpenAI, see §4) may answer you; it sees your message and the last few messages of the conversation. We then keep your message and the AI's answer as a transcript, with your Telegram user ID, the language and the time, for up to 24 months, or until you ask us to delete it (as for any conversation, see below). Passwords, API keys, tokens and similar credentials that we recognise in your messages are automatically replaced with a placeholder before your message is sent to the AI model for an answer and before it is stored in this transcript. This filter applies to AI answers only: Telegram and the bot itself receive the message as you sent it, and when your message is translated for the person who replies to you, only some API keys are removed first. So please do not send credentials there.
We use these records to answer you, to follow up on your enquiry, and to improve our answers and our service.
We keep them for up to 24 months from the conversation, or until you ask us to delete them, whichever comes first.
To have your conversation records deleted, email [email protected] and tell us which channel it was and, for a call or a voice session, when it took place. If you have an account, you can also request its deletion in the dashboard (Settings); the site-chat records kept against it are erased with it.
3. What we never collect
- Plaintext passwords. If you set a password we keep only a salted bcrypt hash (see §2); the plaintext is never stored, logged or recoverable. You can also sign in with a magic link or Google and set no password at all.
- Your AI API keys in plaintext. Your model-provider keys (Google Gemini, OpenAI, Anthropic, OpenRouter, Groq and others) are encrypted before they are stored (EU Azure storage) and decrypted server-side only to inject into your container's environment (at launch, and when you apply or rotate keys). They are never logged, never shared with third parties, and deleted with your account.
- Audio recordings. Whether you use the voice agent on this site or call our published number, the audio itself is streamed in real time to the AI model provider that runs the voice agent (§4) so that it can answer, and we keep no audio files. At Google, which runs the voice agent, we have switched off the optional data caching; under its own terms a provider may still keep inputs, for example to detect abuse. We do, however, keep a written transcript and a short note — see “If you call our number, or use the voice agent” below, because that is the part people usually mean when they ask what we store.
If you call our number, or use the voice agent
The phone number published on this site is answered by an AI voice agent, not by a person. The voice orb on the homepage is the same kind of agent. In both cases, this is what actually happens to your data — stated plainly, because “we don't record calls” on its own would give you the wrong idea:
- No audio is stored. Nothing is written to disk as sound.
- A written transcript of the conversation is produced by AI — and sent to our internal Telegram working channel (access limited to Konstantin, the operator) so a request made by voice does not get lost. The transcript is also kept on our servers, with an AI-written summary: for the site's voice orb together with the IP address of your browser, for phone calls together with the calling number (retention: §2b). Either is deleted on request, any time.
- For phone calls, a short note is kept against your phone number — a few sentences summarising what you wanted — for up to 30 days after your last call, so the agent has context if you call back. If you keep calling, the note keeps being refreshed; if you stop, it lapses on its own. It is used for nothing else and shared with no one.
- You can have it deleted at any time. Ask on WhatsApp or by email and it is removed — you do not have to give a reason.
Legal basis: our legitimate interest in answering and following up on enquiries (GDPR Art. 6(1)(f)). You are told at the start of the call that you are speaking to an AI and that a short note is kept, which is also what the EU AI Act requires.
- Tracking / analytics cookies — none without consent. No Google Analytics, no Hotjar, no analytics cookie of our own. The only third-party measurement script we use at all is the Meta Pixel, and it loads strictly after you opt in via the cookie banner (§2a) — decline or ignore the banner and nothing fires. Our baseline measurement is the first-party, cookieless setup described in §2a. See §5.
- Phone numbers you type into this site. There is no phone field in any form here. (Separately: if you call our published number, that call is handled by an AI voice agent — see "If you call our number" below.)
4. Sub-processors
To run the service we rely on a small set of named processors. Each has its own privacy policy you can read.
- Google LLC — Sign in with Google (OAuth) & Gemini API. policies.google.com/privacy
- LinkedIn Corporation — operator-only OAuth and publication of SoKKoS posts to our personal profile and company Page. LinkedIn receives only the post and destination chosen by the operator. linkedin.com/legal/privacy-policy
- Your chosen model provider(s) — when you connect a BYO API key (e.g. OpenAI, Anthropic, OpenRouter, Groq, NVIDIA, DeepSeek, or a custom OpenAI-compatible endpoint), your agent sends prompts directly to that provider under your own account and the provider's terms. You choose this processor; disconnect its key to stop the flow.
- Mollie B.V. (Amsterdam, NL) — payment processing. mollie.com/privacy
- Resend — transactional email (magic-link, billing receipts). resend.com/legal/privacy-policy
- Microsoft Azure — hosting for the public site and customer database (region: West Europe / Sweden Central).
- Microsoft Azure OpenAI — the model behind our own chat, the automatic backup of the voice orb and the phone line when Google is unavailable, and the model behind the agent we host for you when you have not connected your own model key. In that case the text of your prompts and your agent's replies is processed on our account. Our Azure resource is in the EU (Sweden Central) and holds data at rest there, but the deployments run on Azure's global standard tier, so the inference itself may be performed in a Microsoft datacentre outside the EU. We would rather tell you that than imply a guarantee our configuration does not give. Connect your own model key and your prompts go to your provider instead — but if your agent started without a key, our included endpoint stays configured for its memory search (embeddings) until you ask us to remove it. Messages you write to our Telegram support bot are also processed through Microsoft Azure OpenAI on our account: it may answer them (§2b), translate them for the person who replies to you, or suggest a draft of that reply.
- Google Cloud (Vertex AI, Gemini) — the model behind the voice orb on this site and the phone line. Your voice is streamed to it in real time and it answers in speech; after a phone call it also writes the short summary. We use Google's EU regional endpoint, we have switched off Google's optional data caching, and no conversation is stored at Google to be resumed later. Google does not document that this model processes only inside the EU, so the processing may take place outside the EU under Google's Cloud Data Processing Addendum. If Google is unavailable when a conversation starts, Microsoft Azure OpenAI (above) takes it instead.
- Simyo and Zadarma — only if you call our published phone number. That number is a Dutch mobile line (Simyo), and a call to it is forwarded to our telephony provider (Zadarma) before it reaches the AI. Both carriers see your number and the call audio, as any carrier does — we name both because the chain, not just its last link, is what your call actually crosses. zadarma.com/legal/privacy
- Cloudflare, Inc. — DNS, edge proxy, DDoS mitigation.
- Hetzner Online GmbH — per-customer VPS hosting (region: Germany or Finland, your choice or auto-selected by proximity).
- Telegram FZ-LLC — in three cases. If you link Telegram: support chat via @sokkosai_bot and/or your agent's own Telegram bot. And, whether or not you link anything, what you write in our website chat: a report of each conversation, and straight away any message that shows you want a human to follow up (see §2), is sent to our internal Telegram working channel (access limited to Konstantin) so we can reply. telegram.org/privacy
If we add or change a sub-processor that materially affects what data is processed, we'll update this page and notify active customers by email at least 30 days before the change takes effect (see Terms §11).
6. Your rights (GDPR Articles 15–22)
If you're in the EU/EEA, you have the right to:
- Access — ask what data we hold about you.
- Rectify — correct anything that's wrong.
- Erase (“right to be forgotten”) — delete your account and associated data.
- Restrict — pause processing while a question is unresolved.
- Port — receive a machine-readable copy of your data.
- Object — object to processing based on legitimate interest.
Most of these are self-service in your dashboard. For anything that isn't, email [email protected] and we'll respond within 30 days. See the GDPR rights page for the exact request format and how each right maps to a self-service action.
7. Retention periods
- Account record — until you delete your account.
- Session cookie — 90 days, sliding (resets on each visit).
- Magic-link & password-reset tokens — single-use, and rejected once used or after 15 minutes.
- LinkedIn OAuth tokens — until the operator disconnects or replaces the authorization. Expired tokens remain encrypted only so the console can report connection status and cannot be used without reauthorization; publisher drafts and delivery receipts remain in the internal queue until administratively removed.
- Payment records — 7 years (mandatory under Dutch tax law, Art. 52 AWR).
- Server logs — 30 days raw, then aggregated.
- IP addresses — signup IP and successful sign-in IP records are kept with the account and deleted with it; rate-limit counters only serve their short time window.
- Anonymous funnel events & ad click-ids (§2a) — up to 12 months, then deleted or aggregated. The click-id (
gclid/fbclid) in your browser's local storage expires after 90 days. - Cookie-consent choice (§5) — kept in your browser's local storage until you change it via “Cookie preferences” or clear site data.
- Site-chat conversation — what you typed and what the assistant answered, up to 24 months from the message, then deleted by a scheduled job (§2, §2b). Erased earlier on request, and with your account if you delete it.
- Site-assistant note — a few sentences summarising what you were after, 30 days sliding from your last visit, then deleted from storage. Kept against your account if you are signed in, otherwise against a first-party cookie identifying the browser. The conversation itself is kept separately for up to 24 months (see §2b).
- A chat message or conversation report forwarded to our internal Telegram working channel (§2, access limited to Konstantin) — we do not delete it on a schedule: it is how we know to reply to you. Ask us to remove it (“GDPR: erase”) and we do, within 30 days.
- Voice-conversation records — phone: the transcript and AI-written summary of each call, with the calling number, up to 24 months, plus a short note against the caller's number, 30 days sliding from the last call; site voice orb: the session transcript, an AI-written summary and the IP address, up to 24 months. Either is removed earlier on request; the report copy in our Telegram working channel is removed on request, too.
- Messages on Telegram, WhatsApp and email — up to 24 months from the message, or until you ask us to delete them (§2b).
- VPS container after cancellation — 14 days grace, then destroyed (see Terms §7).
- Withdrawal and cancellation declarations — what you sent through the withdrawal form or the cancellation page: your email address, any contract reference and note, and the date and time it reached us. Kept 7 years, because a declaration that ends a paid contract is part of the accounting record we are required to keep (Art. 52 AWR) — and because it is the evidence that we confirmed receipt to you as the law requires. A weekly job deletes them once that period is over — the period is not a statement of intent, it is what the job runs on.
8. International transfers
Your SoKKoS-hosted data at rest — your agent's environment, config, logs, integrations and key management — is stored inside the EU/EEA: Azure (West Europe / Sweden Central), Hetzner (Germany / Finland), Mollie (Amsterdam). Storage location is not the same as processing location, so the model calls are listed separately below — both the provider you connect and the one we include.
Some processors may transfer data outside the EU under Standard Contractual Clauses (SCCs) approved by the European Commission, or their own published safeguards:
- Google (OAuth login + the Gemini API you choose to use) — the prompts and context needed to generate a response are processed by Google under its terms; some processing may occur in the US.
- Google Cloud Vertex AI (the voice orb and the phone line) — the conversation is sent in real time to Google's EU regional endpoint, but Google does not guarantee that this live voice model is processed only in the EU, so the processing may take place outside the EU under Google's Cloud Data Processing Addendum and the Standard Contractual Clauses.
- LinkedIn (operator-only publishing) — OAuth identifiers and the posts we deliberately publish are processed on LinkedIn's global infrastructure and may be transferred outside the EU under LinkedIn's published safeguards.
- Microsoft Azure OpenAI — our included model. If you have not connected your own model key, your agent's prompts and replies go here (see §4). Our Azure resource is in the EU (Sweden Central) and holds data at rest there, but its deployments run on Azure's global standard tier, which serves inference from Microsoft datacentres worldwide — so the processing itself may take place outside the EU, under Microsoft's published safeguards. Connect your own key and your prompts go to that provider instead. This is the same caveat we give for the provider you choose; we are not claiming a guarantee for ours that we deny for yours.
- Cloudflare — edge proxy with global PoPs; traffic may transit US infrastructure even though your origin is in the EU.
- Telegram — the messages, chat/user IDs and bot API calls you route through Telegram are processed on its global infrastructure and may leave the EU under its own terms. This applies to anything you link (support chat, your agent's own bot) and also to the reports of your website-chat conversations, and to any message of yours that asks for a human, that we send to our internal Telegram working channel (§2). If you need to keep a question inside the EU, email it to us instead — declining to link Telegram does not by itself keep a website-chat message in the EU.
These processors publish their cross-border safeguards. For your account and your own agent you can avoid Google by using magic-link sign-in and bringing an EU-region API key from another provider. The voice orb and the phone line, however, run on Google Cloud Vertex AI, so a conversation with them is processed by Google.
9. Security
- TLS 1.3 for everything in transit (Cloudflare-terminated, modern cipher suites).
- HttpOnly + Secure + SameSite=None cookies; not readable by JavaScript.
- Encryption at rest on Azure Storage (AES-256). Your model keys and bot tokens are encrypted again at the application layer before we store them. Agent state on our hosting node is protected by host access controls and container isolation — not by full-disk encryption.
- No plaintext passwords stored anywhere — when you set a password we keep only a salted bcrypt hash (cost 12).
- Secrets in a KV store, not in code repositories.
- Least-privilege access — a single admin account; destructive admin actions require an explicit type-to-confirm step. Hardware-key step-up (WebAuthn) for admin is on the roadmap.
If you find a security issue, please email [email protected] with “security” in the subject. We acknowledge within 48h.
10. Children
The service is not directed at people under 16. We don't knowingly collect data from minors. If you believe a minor has signed up, email us and we'll delete the account.
11. Contact & complaints
Data-protection questions — [email protected]. We respond within 30 days.
You can also lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens.
SoKKoS AI
KvK 42029374 · BTW NL005441743B74
Beuningen, Gelderland, NL
Last updated 2026-10-14