Privacy policy
This policy is a template based on Sophia's system architecture. It should be reviewed by a qualified legal adviser and adapted to your deployment, hosting providers and jurisdiction before being relied on.
1. Who we are
Sophia is an autonomous AI project-management assistant, a PMIA product operated by Ali Vakilzadeh, Chicago, USA ("we", "us"). For any privacy question, contact ali.vakilzadeh@gmail.com or +1-202-xxx 2772.
When an organisation deploys Sophia for its own team, that organisation usually decides what data goes into Sophia and acts as the data controller; we act on its behalf as a processor. Where Sophia runs on an organisation's own cloud or servers, that organisation also controls where the data is stored.
2. This website (pmia.app)
This website is a static information site. It has no user accounts, contact forms, advertising or analytics trackers, and sets no cookies of its own.
- Server logs. Our web host may automatically record standard request data (IP address, browser type, pages requested, time) for security and troubleshooting.
- Fonts. Pages load the Inter and JetBrains Mono typefaces from Google Fonts, which means your browser contacts Google's servers and shares your IP address with Google.
- Email. If you email us, we use your message and address only to reply.
3. Information the Sophia application processes
| Category | What it includes | Why |
|---|---|---|
| Account data | Username, a one-way (bcrypt) hash of your password — never the password itself — administrator status and feature permissions. | To sign you in and decide what you may do. |
| Project membership | Projects you belong to and your access level (0–9) on each. | To enforce who can see which project data. |
| Prompts and responses | Questions and instructions you send to Sophia, the project they relate to, Sophia's replies and timestamps. | To answer you, keep project context and provide an audit trail. |
| Uploaded files and reports | Documents you upload and reports Sophia generates, each tagged with an access level. | To answer questions from your own material and deliver outputs. |
| Derived knowledge | Text embeddings (numeric representations) of your content and a knowledge graph of project entities such as tasks and their relationships. | To give Sophia long-term project memory and accurate retrieval. |
| Workflows | Scheduled and on-demand workflows, their steps, parameters, results and any errors. | To run automated work and show you what happened. |
| Notifications | Recipient addresses, subjects and message bodies for emails or webhooks a workflow sends. | To deliver notifications you or your team set up. |
| Security and system logs | Sign-in tokens, request metadata, rate-limit counters and system/error logs. | To keep the service secure, reliable and fair to use. |
Please don't upload special-category data (for example health information) or personal data about others unless you have a lawful basis to do so.
4. How Sophia uses AI
Sophia's planning component ("the Thinker") sends your prompt, together with relevant project context retrieved from your data, to a large language model through a model-routing provider (currently OpenRouter) and the model provider it selects. The model returns a plan, which Sophia's worker then executes with its own tools. We do not use your content to train our own models. Model providers process data under their own terms; where available we choose settings that exclude API data from model training. Deployments can be configured to use a different or self-hosted model.
AI output can be wrong. Check important information before relying on it.
5. Where data is stored
- Relational database (PostgreSQL) — accounts, projects, access levels, prompts, workflows and logs.
- Graph database (Neo4j) — project knowledge graphs, one head node per project.
- Vector database (Pinecone) — embeddings, kept in a separate index per project.
- Object storage (S3-compatible) — uploaded files, generated reports and temporary files, organised by project.
Depending on the deployment these services may run on our hosting, on third-party cloud providers, or on your organisation's own infrastructure. Data may therefore be processed in the United States or other countries where those providers operate.
6. Who we share data with
We do not sell personal information or share it for advertising. We share data only with:
- service providers that host or run Sophia (database, vector search, object storage, hosting and email delivery), under contract and only to provide the service;
- AI model-routing and model providers, as described in section 4;
- recipients you or your team configure in a workflow notification;
- authorities, where required by law or to protect rights and safety.
7. How we protect data
- Passwords are stored only as bcrypt hashes; sessions use signed tokens (JWT) that expire after 24 hours.
- Every project is isolated, and every record, file and graph node carries an access level. Sophia checks your level before returning anything.
- Administrative actions are limited to explicitly authorised users.
- Prompts and each workflow step's inputs, outputs and errors are logged, giving a permanent audit trail.
- Rate limits protect the service from abuse.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as the law requires.
8. How long we keep data
Account and project data are kept while the account or project is active. Prompts, workflow results and audit logs are kept for as long as needed for the project's record or as your organisation's retention settings require, then deleted or anonymised. Temporary files are removed routinely. Server logs are normally kept for no more than 90 days.
9. The demo account
The shared "Sophia_test" demo account is visible to every visitor who uses it. Anything you type or upload there may be seen by others and may be deleted when the demo is reset. Please don't enter confidential or personal information.
10. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or US state laws such as the CCPA/CPRA), you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. If your organisation provides your Sophia account, please contact your administrator first; we will support them. You can also contact us directly at ali.vakilzadeh@gmail.com. You have the right to complain to your local data-protection authority.
11. Children
Sophia is a business tool and is not intended for anyone under 16. We do not knowingly collect children's personal information.
12. Changes to this policy
We may update this policy as Sophia evolves. We will change the effective date above and, for significant changes, notify account administrators.
13. Contact
Ali Vakilzadeh · Chicago, USA · +1-202-xxx 2772 · ali.vakilzadeh@gmail.com