Privacy Notice

Effective: 11 October 2026 · Controller: SONAMAK LLC, a Delaware limited liability company · Privacy contact: [email protected] · Legal notices: [email protected]

1) Scope and who controls your information

SONAMAK LLC ("Sonamak AI," "we," "us") controls the personal information described here when you visit sonamak.ai, ask about a project, place an order, pay, provide a creative brief or assets, or communicate with us. Stripe independently controls some payment and billing information under its own privacy notice.

Our registered agent and registered office are the details on file for SONAMAK LLC with the Delaware Secretary of State. Our complete business postal address and, if legally required, our EU representative's details must be added to this notice before consumer sales are actively offered in the relevant European market.

2) Notice at collection: what we collect

• Identifiers and contact details: name, email, selected email or WhatsApp channel, telephone number, IP address, and device/browser information.
• Business and order details: business or brand name, website, project category and summary, package, delivery choice, order reference, payment status, billing country/address supplied to Stripe, and customer-support messages.
• Creative materials: briefs, copy, logos, photos, videos, audio, brand assets, reference links, claims, feedback, releases, and final deliverables.
• Payment records: amount, currency, Stripe customer/session/payment references, tax and refund status. Stripe receives card and full billing details; we do not receive or store full card numbers.
• Compliance records: versions and timestamps for terms, privacy notices, authority, claims, early-performance requests, withdrawal, likeness/voice permission, and related evidence.
• Usage and advertising data: page, device, event, cookie and campaign data only when the relevant optional category is enabled.
• Sensitive or biometric-related information: collection through this website is currently disabled. If a future project genuinely requires identity, age, likeness or voice verification, we will first provide a separate notice, obtain any legally required written consent, and provide a secure intake method as described in our Biometric Policy. Do not send government IDs by ordinary email or WhatsApp.

We collect information from you, the person or organization ordering the service, Stripe and other service providers, and—where you direct us to use third-party materials—from the source you identify.

3) Why we use it and our legal bases

• Contract: assess the requested project, create checkout, take payment, produce and deliver the videos, provide revisions, process refunds, and communicate about the order.
• Legal obligations: tax, accounting, sanctions, consumer-rights, records, lawful requests, and establishing that required permissions were obtained.
• Legitimate interests: secure the site, prevent duplicate or fraudulent orders, troubleshoot, defend legal claims, administer the service, and improve non-marketing operations. We consider the effect on individuals before relying on this basis.
• Consent: optional analytics; optional advertising measurement or cross-context sharing; portfolio publicity; and any consent legally required for a real person's likeness, voice or biometric-related data. Consent can be withdrawn prospectively.

Order contact details and the project information marked required are needed to enter or perform the service contract. If they are not provided, we cannot process the order. Optional website URLs, analytics, advertising and marketing choices are not required to buy.

We do not make decisions producing legal or similarly significant effects solely by automated means. Automated security checks may flag a request, but material eligibility decisions are reviewed by a person.

4) Who receives information

We disclose only what is reasonably needed to service providers acting for us or as independent controllers, including:

• Stripe: checkout, billing address, payment, fraud, tax and refunds.
• Hosting, database, storage, email and communications providers: operating the site and communicating about orders.
• AI generation, editing and media providers: only the project content or assets needed to produce the requested work. Do not send unnecessary personal or confidential information in a creative brief.
• Google Analytics and Microsoft Clarity: website analytics only after analytics consent.
• Meta: advertising measurement only after advertising consent and when Global Privacy Control is not active.
• Professional advisers, authorities or transaction parties: where reasonably necessary for legal obligations, claims, safety, financing, restructuring or a sale of the business, subject to appropriate safeguards.

We do not sell personal information for money. Enabling an advertising pixel can be considered "sharing" or targeted advertising under some U.S. privacy laws; you can opt out at any time through Your Privacy Choices or a supported Global Privacy Control signal.

5) Cookies and similar technologies

Strictly necessary cookies support security, sessions, language and privacy preferences. Analytics and advertising technologies are off until the corresponding choice is enabled. Choices are separate, and withdrawing consent is as easy as giving it. See our Cookies Notice and privacy controls.

A classic browser "Do Not Track" setting does not have one legally standardized meaning and does not change the site by itself. We separately recognize supported Global Privacy Control signals as an opt-out of advertising, sale and cross-context sharing.

6) International transfers

We are based in the United States, and our providers may process information in the United States and other countries. Where European law requires a transfer safeguard, we use an available lawful mechanism such as an adequacy decision, the European Commission's Standard Contractual Clauses with supplementary measures, or another legally recognized mechanism. You may request information about the safeguard relevant to your data by emailing us.

7) Retention

We retain information only for the period reasonably necessary for the purpose collected, including the following operational targets, unless a longer period is required for law, tax, fraud investigation, disputes or legal claims:

• Order, invoice, payment, refund and tax records: generally up to seven years after the transaction.
• Uncompleted checkout and fraud/security records: generally up to twelve months.
• Project briefs, working assets and communications: for production and support, then according to the documented project-retention schedule and backup cycle.
• Contract, consent, withdrawal, release and claims evidence: for the contract term and applicable limitation period.
• Identity images and biometric-related data: we do not currently accept these through the website, ordinary email or WhatsApp. Before any future collection, the project-specific notice will state and operationally enforce a deletion schedule that satisfies applicable law.
• Cookie and analytics data: as listed in the Cookies Notice or the provider settings, whichever is shorter.

When a period ends, we delete, anonymize or securely isolate the information, subject to reasonable backup cycles. A data category is not enabled for collection until its published retention period can be operationally enforced.

8) Your privacy rights

Depending on where you live, you may have rights to know or access, correct, delete, obtain a portable copy, restrict processing, object to legitimate-interest processing, withdraw consent, opt out of sale/sharing or targeted advertising, limit certain sensitive-data uses, and appeal a denied request. European residents may also complain to the data-protection authority where they live or work or where an alleged infringement occurred.

Use our online privacy-request form or email [email protected] with "Privacy Request" or "Privacy Appeal" in the subject. We may verify you using the email or order reference already associated with the request. An authorized agent may act where law permits, subject to proof of authority. Do not send identity documents by ordinary email; if extra verification is legally necessary, we will provide a separate secure method. We will not discriminate against you for exercising a right.

We respond within the period required by applicable law. Under GDPR this is generally one month, subject to a permitted extension; under many U.S. state laws it is generally 45 days, subject to a permitted extension.

9) California and other U.S. state notices

The categories collected and their purposes are listed in sections 2 and 3, and retention is described in section 7. In the preceding 12 months, we may have disclosed identifiers, commercial/order information, internet activity and project content to the provider categories in section 4 for business purposes. We do not knowingly sell or share personal information of people under 16.

State consumer-privacy rights apply only when the relevant law covers SONAMAK LLC and the request. Even where a statutory threshold is not met, we will make reasonable efforts to honor verified privacy requests.

10) Security and incidents

We use safeguards appropriate to the nature of the information and risk, including access restriction, transport encryption and security monitoring where available. No system is completely secure. If an incident occurs, we will investigate, contain it and provide legally required notifications.

11) Children

The website and ordering service are not directed to children under 13, and orders may be placed only by people who are at least 18. We do not knowingly collect personal information from a child through checkout. A project depicting a minor requires verified authorization from a parent or legal guardian before production.

12) Changes and contact

We post changes here and update the effective date. We will provide additional notice when law requires it. Questions and requests can be sent to [email protected] or [email protected].