PRIVACY NOTICE / PRIVACY POLICY — SONUS

Version: v1.0 · Last updated: 06/23/2026 · Effective date: 06/23/2026

0. How to read this notice

This document has two parts:

A global core (sections 1–18) describing what data Sonus processes and why. It applies to everyone.
Regional annexes with your specific rights and how to exercise them depending on where you live: Annex A — European Union / EEA (and United Kingdom), Annex B — United States, Annex C — Latin America.

If the core and an annex conflict, the annex for your region prevails.

1. Data controller (identity and contact details)


Controller	Artecnology LLC
Address	Artecnology LLC, Delaware, United States
Tax/registration ID	EIN on file (Artecnology LLC)
Privacy contact	privacy@sonus.media
Data Protection Officer (DPO)	[NAME AND EMAIL — required if you process special categories at scale]
EU representative (Art. 27 GDPR)	[If you have no EU establishment but process EU residents' data]
UK representative	[If applicable]

2. Privacy at a glance

In plain language, here is the essence:

What Sonus does: it analyzes music across eight dimensions and adapts it to you. To "calibrate," it may read, for a few seconds, your facial expression (camera), a heart-rate signal derived from the image (rPPG/HRV), and your voice (microphone), and from this it infers your arousal level and an orientative personality profile.
It is optional: camera- and microphone-based calibration occurs only if you start it and grant the permissions.
On-device: per the current implementation, biometric processing happens locally on your device; [state precisely what does and does not leave the device — see section 4].
We do not sell your personal data. [Confirm — see Annex B.]
It is not a medical service: Sonus does not diagnose, treat, or replace professional health care (physical or mental).
It is an emotion-recognition system: for transparency, we inform you of this (see section 8).

3. What data we process, for what purpose, and on what basis

⚠️ Complete each row against your real implementation. Delete anything you don't do. The legal bases by region are detailed in the annexes.

3.1 Biometric and physiological calibration data (special category / sensitive data)

Data	Source	Purpose	Retention
Facial image/video	Device camera	Estimate your expressive range and arousal	[Ephemeral — processed in memory and discarded after computation; not stored / or the applicable period]
rPPG signal / heart rate / HRV	Color variations in the image	Estimate your arousal	[Same as above]
Voice / audio sample	Microphone	Estimate your vocal expressive range (baseline)	[Same as above]

3.2 Derived inferences (profiling + emotion recognition)

Data	How it is generated	Purpose	Retention
Arousal / emotional state	From 3.1	Adapt the tempo, brightness, and consonance of the music	[On-device / as applicable]
Trait profile (Big Five / OCEAN), orientative	From 3.1 and your interaction	Bias which dimensions are prioritized when regulating you	[On-device / as applicable]
Personalized "stimulus → response" mapping (closed loop)	Your real reactivity, session by session	Improve personalization for you	[On-device / as applicable]

3.3 Account, device, and usage data (if applicable)

Data	Purpose	Retention
[Name, email, account identifier]	Create and manage your account	[Duration of account + X]
[Device/app identifiers, operating system, version]	Operation, security, compatibility	[Period]
[Usage data, preferences, library/listening history]	Service personalization	[Period]
[Diagnostics / crash reports]	Stability and improvement	[Period]
[Payment / subscription data]	Process payments (via —)	[Legal accounting period]

If Sonus runs 100% without an account and without telemetry, state it here and delete 3.3.

4. The "on-device" principle — and exactly what it means

This is the most important statement in the notice and must be literally true.

State precisely what happens locally (e.g., camera/microphone processing and arousal inference) and therefore which biometric data never leave your device or reach our servers.
State which data, if any, are transmitted to or stored off-device (e.g., account, diagnostics, aggregated and anonymous metrics) and where.
If anything derived from calibration is ever uploaded, say so explicitly here: failing to do so could constitute a deceptive practice (e.g., before the FTC in the U.S.) and a transparency violation (EU/Latin America).

⚠️ Consistency with the app. The Sonus interface states "everything runs locally; nothing is uploaded or stored" and "real rPPG/HRV runs on-device." This notice cannot contradict that promise. If reality differs, fix the app, not just the legal text.

5. Legal bases / lawful grounds (overview)

Processing of biometric data and of emotion/personality inferences is based, as a general rule, on your explicit, specific consent, which you give when you start calibration. You may withdraw it at any time, without affecting the lawfulness of prior processing. Account data and basic functionality may be processed for performance of the contract (to provide the service) or our legitimate interest in maintaining security and improving the product, depending on the region. Per-jurisdiction detail is in the annexes.

6. Special categories / sensitive data — explicit consent

Biometric data and data revealing physiological or emotional states (heart rate, arousal) are sensitive / special-category data. Therefore:

We process them only with your explicit, informed consent, collected separately and unambiguously before calibration.
You have the right not to give it: Sonus must continue to offer you the features that do not require biometric calibration.
You may withdraw consent at any time from [SETTINGS > PRIVACY] or by writing to —.

7. Automated decisions and profiling

Sonus uses automated processing to infer your arousal and an orientative personality profile, and to personalize the music offered to you. This personalization does not produce legal effects or similarly significantly affect you (it does not determine access to credit, employment, insurance, etc.). Even so, you have the right to obtain information about the logic involved, to express your point of view, and, where applicable, to request human intervention or to object (see annexes).

8. Emotion recognition — transparency notice (EU AI Act)

Sonus is an emotion-recognition system: it infers arousal/emotional states from biometric data. We inform you of its operation at the time of first use of calibration, in accordance with Article 50(3) of Regulation (EU) 2024/1689 (the AI Act). Important:

Sonus must not be used in workplace or educational settings to infer emotions, because emotion recognition in those contexts is prohibited by Article 5 of the AI Act (with very narrow exceptions).
The inferences are approximations, not clinical measurements, and they do not detect lies or diagnose health conditions.

9. Recipients / processors (third parties)

[If you share with no one, state it and delete the table. If you use providers, list them:]

Provider category	Example / purpose	Location
Infrastructure / hosting	[AWS / GCP / Azure — account data only, not biometric]	—
Analytics / diagnostics	[PROVIDER — aggregated data]	—
Payment processor	—	—
Support / messaging	—	—

We do not sell or rent your personal data to third parties for advertising purposes. [Confirm — see Annex B on "sale/sharing."]

10. International data transfers

When we process data outside your country/region, we do so with appropriate safeguards: [EU Standard Contractual Clauses / adequacy decisions / local standard clauses / consent]. You may request a copy of the safeguards by writing to —.

11. Retention periods

Biometric calibration data: [ephemeral — not stored / or the minimum period necessary]. We do not retain raw images or audio beyond the real-time computation. (Adjust to reality.)
Inferences / personalized mapping: [for as long as you use Sonus or until you delete it].
Account data: [duration of the account + legal period].
At the end of the period, data is securely deleted or anonymized.

12. Security

We apply reasonable technical and organizational measures proportionate to the risk: [encryption in transit and at rest, minimization, local processing, access controls, pseudonymization, etc.]. No system is 100% infallible; we will notify you of any breach affecting you as required by applicable law.

13. Minors

Sonus is not directed to minors under [16 / 18 / 13, depending on jurisdiction], and we do not knowingly collect data from minors under that age. Biometric and emotion-recognition processing of minors is especially sensitive; if you believe a minor has provided us data, contact us at — to delete it. (In the EU the consent age is 16, reducible to 13 by each Member State; in the U.S., COPPA applies to children under 13.)

14. Your rights (overview)

Depending on your region, you may have the right to: access your data, rectify it, erase/cancel it, restrict or object to its processing, data portability, withdraw consent, not be subject to solely automated decisions, and lodge a complaint with the competent authority. The exact scope and procedure are in your region's annex.

15. How to exercise your rights

Write to us at privacy@sonus.media or use [SETTINGS > PRIVACY]. We may ask you to verify your identity. We will respond within the legal timeframes for your region (see annexes). Exercising your rights is free, except for manifestly unfounded or excessive requests.

16. Cookies and similar technologies (if you have a website)

[Describe cookies/SDKs: strictly necessary, preference, analytics. Link your consent manager. Delete if Sonus is a native app with no website.]

17. Changes to this notice

We may update this notice. If changes are substantial, we will inform you via [EMAIL / in-app notice] before they take effect and, where the law requires, we will ask for renewed consent. The "last updated" date indicates the current version.

18. Contact and complaints

Privacy questions: privacy@sonus.media. If you are not satisfied, you may contact your region's data-protection authority (see annexes).

ANNEX A — EUROPEAN UNION / EEA (and UNITED KINGDOM)

Regulation (EU) 2016/679 (GDPR), the UK GDPR for the United Kingdom, and Regulation (EU) 2024/1689 (AI Act) apply.

Legal bases (Arts. 6 and 9 GDPR).

Biometric data and emotion/personality inferences → Art. 9(2)(a): explicit consent. (We do not rely on legitimate interest for special categories.)
Account and provision of the service → Art. 6(1)(b) (contract).
Security and product improvement → Art. 6(1)(f) (legitimate interest), balanced against your rights.

Your rights (Arts. 15–22). Access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and the right not to be subject to solely automated decisions with significant effects (Art. 22). You may withdraw your consent at any time (Art. 7(3)).

AI Act. Sonus is an emotion-recognition system; we comply with the information duty in Art. 50(3) (we inform you at first use). We do not deploy it in workplace or educational contexts (the Art. 5 prohibition). The Article 50 transparency obligations apply from August 2, 2026.

Impact assessment (DPIA). Given the large-scale processing of biometric data, we [have carried out / will carry out] a Data Protection Impact Assessment (Art. 35).

Timeframes. We respond to your requests within one month (extendable by two months for complex cases).

Complaints. You may lodge a complaint with your country's supervisory authority (e.g., the AEPD in Spain, CNIL in France, the Garante in Italy; the ICO in the United Kingdom) and with our lead authority: —.

EU / UK representative: [Art. 27 GDPR — complete if there is no EU/UK establishment].

ANNEX B — UNITED STATES

Fragmented federal framework + state laws. Biometric and health-data laws are the highest-risk area for Sonus.

B.1 California (CCPA/CPRA)

Categories of personal information we process: identifiers, biometric information, internet activity information, inferences, and "sensitive personal information" (SPI) (including biometric data and health data). See section 3.
Your rights: to know/access, delete, correct, opt out of the "sale" or "sharing," and limit the use of your sensitive personal information.
"Sale"/"sharing": we do not sell or share your personal information for consideration or for cross-context behavioral advertising. [Confirm; if you do, you must offer "Do Not Sell or Share My Personal Information."]
No discrimination for exercising your rights. You may use an authorized agent. Requests: [EMAIL / form]. Timeframe: 45 days (extendable).
"Shine the Light" (Cal. Civ. Code §1798.83): [applies only if you share data with third parties for their direct marketing].

B.2 Biometric privacy — Illinois (BIPA) and other states

Illinois's Biometric Information Privacy Act requires, before collecting biometric identifiers:

Written notice of the purpose and retention period.
Obtaining written consent.
Publishing a retention and destruction policy for biometric data.
Not selling or profiting from biometric data. A violation carries a private right of action with statutory damages per person. Analogous laws: Texas (CUBI) and Washington (HB 1493). → If Sonus truly does not store or transmit biometrics, document it; if it processes them in any form, implement written consent and a retention policy before operating in these states.

B.3 Health data — Washington "My Health My Data Act" (and similar)

The MHMDA broadly defines "consumer health data" and may cover biometric and physiological data and inferences about your state. It requires consent to collect them and a separate authorization to share/sell them, and includes a private right of action. Similar health/consumer laws exist in Nevada and Connecticut.

B.4 Other comprehensive state laws

Virginia (VCDPA), Colorado (CPA), Connecticut, Utah, Texas (TDPSA), Oregon, Montana, etc., treat biometric and health data as "sensitive" and generally require opt-in consent to process them. We honor your rights of access, correction, deletion, and opt-out under your state's law.

B.5 Minors

We comply with COPPA (children under 13). [If you target teens, review the state-specific rules for ages 13–17.]

ANNEX C — LATIN AMERICA

C.1 Mexico — Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, in force since March 21, 2025)

Authority: Secretaría Anticorrupción y Buen Gobierno (replacing the now-abolished INAI).
This document constitutes your comprehensive Privacy Notice (Aviso de Privacidad Integral). When data is collected by electronic/visual/audio means, we also make available a simplified notice that points to this comprehensive one.
Sensitive data: biometric and health data are sensitive and are processed with your express consent. The notice identifies the sensitive data processed and distinguishes the purposes that require consent from those that do not.
ARCO rights: Access, Rectification, Cancellation, and Opposition; you may also revoke your consent and limit the use or disclosure of your data. Requests to —; we respond within a maximum of 20 business days.
Transfers: [include a clause indicating whether you accept the transfer of your data, per Art. 35].
We designate — as responsible for handling requests (Art. 29).

⚠️ The 2025 law is recent and its regulations/criteria are still developing. Verify the text in force before publishing.

C.2 Brazil — General Data Protection Law (LGPD, Law 13.709/2018)

Authority: ANPD.
Legal bases (Arts. 7 and 11): biometric and health data are sensitive data; we process them with specific, highlighted consent (Art. 11). Account and provision of the service may rely on performance of the contract.
Data subject rights (Art. 18): confirmation, access, correction, anonymization/blocking/deletion, portability, information about sharing, withdrawal of consent.
Data protection officer (encarregado): —.
Automated decisions: right to request review (Art. 20).

The Brazilian-market version should be localized into Portuguese.

C.3 Colombia — Law 1581 of 2012 (and Decree 1377 of 2013)

Authority: Superintendencia de Industria y Comercio (SIC).
Biometric and health data are sensitive data; they require prior, express, and informed authorization, and you may decline to provide them. We honor your rights to know, update, rectify, revoke the authorization, and delete. [If applicable, we register the database in the RNBD.]

C.4 Argentina — Law 25.326 (Personal Data Protection)

Authority: Agencia de Acceso a la Información Pública (AAIP).
Sensitive data requires consent and reinforced protection. We honor your rights of access, rectification, updating, and deletion. (A modernization bill is pending; verify the text in force.)

C.5 Other countries

For residents of Chile (Law 19.628 and its reform), Peru (Law 29733), Uruguay (Law 18.331), Ecuador (LOPDP), Costa Rica (Law 8968), and others, we honor the rights and consent requirements set out in their local legislation. To exercise them, write to —.

Final reminder. This template informs you of the general framework but does not replace review by specialized counsel. Because of Sonus's biometric and emotion-recognition nature, we strongly recommend: (1) conducting an impact/risk assessment, (2) implementing explicit, separate consent before any capture, (3) verifying that the technical promises ("on-device") are accurate, and (4) localizing/translating the notice for each market.