Privacy Policy

1. Introduction

СБ-Инфотек ЕООД (SB-Infotek EOOD), trading as Soundsense AI (“we”, “our”, or “us”), is a company registered in Bulgaria (UIC 207735823) with its registered office at str. Shipka No. 25, fl. 2, ap. 5, Oborishte, Sofia 1504, Bulgaria.

This privacy policy explains how we collect, use, share, and protect personal data when you use the Contact Search application (the “Service”). Contact Search allows you to connect your LinkedIn account and search your professional network using natural language queries.

We are committed to processing personal data lawfully, fairly, and transparently in accordance with Regulation (EU) 2016/679 (the “EU GDPR”). Where we process personal data of individuals located in the United Kingdom, we also comply with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

2. Scope

This policy governs all personal data processed through our mobile applications, web applications, browser extensions, and related services (collectively, the “Service”). It applies to data relating to:

• Searchers — individuals who authenticate with LinkedIn and use the Service to search their own professional network.
• Contacts — LinkedIn connections whose publicly available profile data is accessed through the LinkedIn API at a Searcher's request.

This policy does not cover data processing carried out by LinkedIn itself. Please refer to LinkedIn's own privacy policy for information about how LinkedIn handles your data.

3. Data Controller and UK Representative

3.1 Data Controller

The data controller responsible for the processing described in this policy is:

3.2 UK Representative

In accordance with Article 27 of the UK GDPR, we have appointed the following representative in the United Kingdom for data subjects and the Information Commissioner's Office (ICO) to contact in relation to data protection matters:

4. Personal Data We Collect

4.1 Data You Provide Directly

4.2 Data We Access From LinkedIn

4.3 Data We Collect Automatically

4.4 Data We Do Not Collect

We want to be explicit about boundaries. We do not collect:

• Private LinkedIn messages or InMail content
• Email addresses or phone numbers from LinkedIn profiles
• Contact notes or tags you maintain on LinkedIn
• Advertising identifiers or cross-app tracking data
• Financial or payment information (the Service is currently free)

5. Lawful Bases for Processing

We rely on the following lawful bases under Article 6(1) of the EU GDPR (and, for UK data subjects, the UK GDPR):

6. How We Use Your Data

6.1 On-Device Indexing

By default, we build and store the semantic index of your LinkedIn connections locally on your device or in encrypted personal cloud storage that you control. Your network data does not pass through our servers unless you explicitly enable cloud synchronisation.

6.2 Ephemeral Query Processing

When you execute a search query, it is processed in volatile memory. Results are discarded immediately after delivery unless you choose to save them. We do not retain a history of your queries unless you opt in to this feature.

6.3 No Hidden Enrichment

We never combine your data with third-party datasets for profiling, marketing, lead generation, or any purpose beyond delivering the Service as described in this policy.

6.4 Support Diagnostics

If you choose to share a diagnostic bundle for support purposes, all LinkedIn identifiers and search terms are automatically scrubbed before the bundle leaves your device. Support staff access only anonymised technical data.

7. Data Sharing and Disclosure

We do not sell, rent, licence, or otherwise monetise your personal data. We share data only in the following limited circumstances:

7.1 LinkedIn

We transmit OAuth tokens and API requests to LinkedIn over TLS-encrypted connections, strictly as required to fetch your connection data. No other third party receives your network information.

7.2 Service Providers (Sub-processors)

If you enable cloud synchronisation, encrypted data may be stored by our infrastructure sub-processors. These providers:

• Process data only on our documented instructions
• Cannot access plaintext content (zero-knowledge encryption)
• Are bound by data processing agreements compliant with Article 28 of the EU GDPR

A current list of sub-processors is available on our sub-processors page, or on request by emailing privacy@soundsenseai.com.

7.3 Legal Disclosure

We will disclose personal data only where legally compelled to do so by a court order, regulatory requirement, or other enforceable legal process. In such cases, we will:

• Exhaust all reasonable options to notify you before disclosure
• Challenge requests we believe to be overbroad or unjustified
• Disclose the minimum data necessary to comply

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. We will notify you in advance and provide the opportunity to delete your data before the transfer takes effect.

8. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfil the purposes described in this policy:

Account deletion: You may delete your account and all associated data at any time through the Service settings. Deletion is immediate for on-device data and completed within 30 days for any cloud-stored data.

9. International Data Transfers

Our company is established in Bulgaria, a member state of the European Union. Personal data processed within the EU/EEA is subject to the protections of the EU GDPR without the need for additional transfer mechanisms.

If you enable cloud backup or synchronisation, encrypted data may be stored on servers located outside the European Economic Area or the United Kingdom. Where personal data is transferred internationally, we ensure an adequate level of protection through one or more of the following safeguards:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission, and/or the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, as approved by the ICO
• Adequacy decisions — transfers to countries recognised by the European Commission or the UK Secretary of State as providing adequate data protection
• Supplementary measures — including end-to-end encryption with zero-knowledge architecture, ensuring that data remains unintelligible to any party other than you

Details of the specific transfer mechanisms in use are available on request.

10. Security Measures

We implement technical and organisational measures appropriate to the risk, including:

• Encryption in transit and at rest: AES-256-GCM encryption for any data leaving your device; TLS 1.2+ for all network communications
• Zero-knowledge architecture: Only you hold the decryption key for your indexed data. We cannot access plaintext content even if compelled
• Hardware-backed key storage: Secure Enclave (iOS/macOS) and TPM/StrongBox (Android/Windows) on supported devices
• Access controls: Role-based access for internal staff; principle of least privilege enforced across all systems
• Monitoring and testing: Regular penetration testing, vulnerability scanning, and code review
• Incident response: Documented incident response plan with commitment to notify affected users and the relevant supervisory authority within 72 hours of becoming aware of a qualifying personal data breach, in accordance with Article 33 of the EU GDPR

11. Your Rights

Under the EU GDPR (and, for UK data subjects, the UK GDPR), you have the following rights in relation to your personal data:

We will respond to all rights requests within 30 calendar days of receipt. Where a request is complex or we receive a high volume of requests, we may extend this period by a further 60 days and will notify you accordingly.

Complaints

If you are unsatisfied with our response to a rights request, you have the right to lodge a complaint with a supervisory authority:

• Bulgaria (lead authority): Commission for Personal Data Protection (CPDP) — https://www.cpdp.bg
• United Kingdom: Information Commissioner's Office (ICO) — https://ico.org.uk/make-a-complaint/
• Other EU/EEA member states: You may also lodge a complaint with the supervisory authority in the EU/EEA member state where you reside or work.

12. Automated Decision-Making

The Service uses automated processing (semantic search and natural language processing) to rank and return search results. This processing does not produce legal effects or similarly significant effects on any individual. No decisions with legal or significant impact are made solely on the basis of automated processing.

13. Children's Privacy

The Service is not directed at, and is not intended for use by, individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that we have inadvertently processed data relating to a child, please contact us immediately at privacy@soundsenseai.com and we will take steps to delete it.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in the Service, applicable law, or our data practices. We commit to the following:

• No downgrade: We will never reduce the level of privacy protection without your explicit consent.
• Advance notice: Material changes will be communicated at least 30 days before they take effect, via in-app notification and email (where we hold a contact address).
• Right to exit: You will always have the option to export or delete your data before material changes take effect.

Non-material changes (such as clarifications, formatting, or contact details) may be made without advance notice but will be reflected in the “Last Updated” date above.

15. Contact Us

For any questions, concerns, or requests relating to this privacy policy or our data practices: