Privacy Policy

This Privacy Policy describes how SonnaLabs ("we", "us", or "the Service") collects, uses, stores, and protects your information when you use the SonnaLabs Android application or the web platform at sonnalabs.app. By using the Service, you agree to the practices described below.

SonnaLabs is an AI-powered creative platform that provides text-to-speech, image, video, and music generation services. To deliver these services, the Service processes certain personal data. SonnaLabs is committed to being transparent about what data is collected, why it is collected, and how it is protected.

This policy applies to all users of the Service, regardless of the platform (Android or web) or plan (Free, Pro, Max, or PAYG).

Only data necessary to operate the Service is collected. The following categories describe what is collected and why.

Account Information

When you sign in using Google Sign-In, the Service receives and stores:

• Your full name from your Google account.
• Your email address from your Google account.
• Your profile picture URL (the URL of your Google avatar, not the image file itself).
• A unique internal user ID generated by the Service.

SonnaLabs does not store your Google password, phone number, date of birth, or any other Google account data beyond the above.

Usage & Generation Data

When you use the Service, the system stores:

• Input text submitted for text-to-speech generation, as part of your project history.
• Prompts submitted for image, video, and music generation.
• Reference files you upload as input (reference images, audio samples), stored temporarily to process your generation request.
• Generated outputs (audio files, images, videos, music tracks) and associated metadata (title, voice used, model used, settings).
• Credit balance and transaction history (credits deducted, credits granted, purchase events).
• Subscription and plan data (current plan, expiry date, monthly allocation).

Technical & Operational Data

• Usage logs: Records of which features were used, which AI model was called, how many credits were deducted, and when. Retained for 90 days, then automatically deleted.
• Generation job records: Status and lifecycle of each generation request. Retained for 90 days, then automatically deleted.
• Error and diagnostic data: Internal server-side error logs used to identify and fix bugs. Provider-level error logs retained for 30 days, then automatically deleted.

Payment & Purchase Data

• For web purchases, Midtrans processes your payment. SonnaLabs stores: your email, a purchase record (package ID, amount in IDR, transaction status), and a reference token. SonnaLabs does not store credit or debit card numbers.
• For Android purchases, Google Play Billing processes your payment. SonnaLabs stores a verification record (product ID, purchase token, grant status). Payment details are managed entirely by Google.

Advertising Data (Android, Free plan)

Ads are shown only to users on the Free plan of the Android application, before a generated text-to-speech result. Users with a paid plan (Pro or Max) or a PAYG credit balance see no ads. Ads are provided by Google AdMob.

• Google AdMob automatically collects and uses the Android advertising ID, IP address, device and app-interaction data (such as app launches, taps and ad views) and diagnostic data to show ads, measure their performance and prevent ad fraud. SonnaLabs does not send your input text, prompts or generated outputs to the ad provider.
• Where required by law (for example in the European Economic Area and the United Kingdom), a consent form from Google's User Messaging Platform is shown before ads load, and your choice is honored. It can be changed at any time under Ad privacy settings in the app menu.
• The advertising ID can be reset or deleted, and personalized ads can be turned off, at any time in the Android settings (Settings, then Privacy, then Ads).

The collected data is used for the following purposes:

• Providing the Service: Processing your generation requests, storing your output history, and managing your credit balance.
• Account management: Authenticating your identity, maintaining your session, and managing plan eligibility.
• Billing and subscription management: Processing payments, verifying purchase receipts, granting credits, and managing subscription renewals and expirations.
• Service reliability and fraud prevention: Detecting and preventing unauthorized access, credit abuse, and policy violations.
• Operational monitoring: Understanding aggregated (anonymized) usage patterns to improve performance and stability.
• Legal compliance: Retaining purchase and ledger records as required by applicable law.
• Advertising (Android, Free plan): Showing ads through Google AdMob and measuring their performance. Paid-plan users see no ads.

SonnaLabs does not use your input text, prompts, images, audio, or generated outputs to train any AI model operated by SonnaLabs.

To provide its features, SonnaLabs transmits certain data to the following third-party AI and infrastructure providers. Each provider processes data only as necessary to fulfill the specific generation request. SonnaLabs does not sell your data to these providers — the relationship is strictly service-delivery.

When your prompts or media files are submitted to these providers, they are processed under those providers' own terms of service and privacy policies. SonnaLabs selects providers that maintain professional-grade data handling standards, but users are encouraged to review their policies if they have concerns about specific providers.

SonnaLabs does not sell your personal data to third parties or data brokers.

Data is shared with third parties only in the following circumstances:

• Service delivery — with the providers listed above, strictly as necessary to process your generation requests and maintain your account.
• Legal obligations — if required by applicable Indonesian law, regulation, or a valid court order.
• Protection of rights — to investigate or prevent suspected fraud, security threats, or violations of the Terms of Service.
• Advertising — with Google AdMob on the Android Free plan, as described in Advertising Data above.

SonnaLabs does not share your data with unaffiliated third parties for marketing purposes, other than the advertising data sent to Google AdMob described above.

• Account and usage data is stored in an encrypted cloud database (Turso, hosted on Cloudflare infrastructure) in the Asia Pacific region.
• Generated output files (audio, images, videos, music) are stored in Cloudflare R2 object storage, accessible via cdn.sonnalabs.app.
• Sessions and tokens on the web are managed using cookies with appropriate security attributes. Authentication tokens on the Android app are stored using Android's encrypted storage.
• All network communication between your device and SonnaLabs' servers uses HTTPS/TLS encryption.
• Payment data: Card numbers and full payment credentials are processed entirely by Midtrans or Google Play and are never transmitted to or stored on SonnaLabs' servers.

SonnaLabs implements reasonable technical and organizational measures to protect your data. However, no system is completely immune to unauthorized access. You are responsible for keeping your account credentials secure.

The following retention periods apply:

Account deletion: When you delete your account, all personal data (profile, projects, generated files, and associated storage) is permanently removed. Purchase records and credit ledger entries are retained as required by applicable financial regulations. Account deletion is irreversible.

Under applicable law, including Indonesia's Personal Data Protection Law (UU No. 27 Tahun 2022) and international standards, you have the following rights:

• Right to access: You may request information about the personal data held about you.
• Right to deletion: You may permanently delete your account and all associated personal data at any time via Account Settings in the app or on the web.
• Right to correction: You may update your display name and profile picture at any time via your account settings.
• Right to data portability: You may download your generated output files at any time using the download feature in the app or web.
• Right to object: You may object to any data processing that is not strictly necessary for service delivery by contacting us.
• Right to complain: You may lodge a complaint with the relevant data protection authority in your jurisdiction.

To exercise any of these rights (other than those available through the app/web interface), contact support@sonnalabs.app. A response will be provided within 14 business days.

The Service is not directed to children under the age of 13. SonnaLabs does not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has created an account or provided data to SonnaLabs, please contact support@sonnalabs.app. The developer will promptly investigate and delete any such data.

This Privacy Policy may be updated as practices evolve or as required by applicable law. When material changes are made, the "Last updated" date at the top of this page will be updated and, where appropriate, a notification will be provided via in-app notification or email.

Continued use of the Service after the updated policy is published constitutes acceptance of the updated terms. If you do not accept the changes, you should stop using the Service and delete your account.

For questions, concerns, or requests related to this Privacy Policy or data practices:

• Email: support@sonnalabs.app
• Website: sonnalabs.app

We aim to respond to all privacy-related requests within 14 business days.