1. Data Controller
BioSonic AB
Org.nr: 559472-8056
Bergsundsgatan 7, 117 37 Stockholm, Sweden
Email: hello@biosonic.se
BioSonic AB ("BioSonic", "we", "us") is the data controller for personal data processed through the BioSonic platform at biosonic.io and bat.biosonic.se.
2. Data We Collect
Account data
When you register, we collect your name, email address, organisation name, and password (hashed). If you sign in via Microsoft Azure SSO, we receive your name and email from your identity provider.
Uploaded data
Audio recordings (WAV files) you upload for analysis, along with associated metadata (dates, coordinates, detector model). Audio files may contain incidental environmental sounds but are not expected to contain personal data.
Usage data
We collect information about how you use the platform, including pages visited, features used, and classification results viewed. This is collected via PostHog Cloud EU.
Communication data
If you contact us by email, we store the correspondence to respond to your inquiry.
3. Legal Basis for Processing
We process your personal data under the following legal bases (GDPR Art. 6(1)):
- Contract performance (Art. 6(1)(b)) — to provide the BioSonic platform, process your uploads, and deliver classification results.
- Legitimate interests (Art. 6(1)(f)) — to improve our service, maintain security, and train our AI models (see Section 5). Our legitimate interest is balanced against your rights through data minimisation, aggregation, and opt-out mechanisms.
- Consent (Art. 6(1)(a)) — for optional analytics cookies, where applicable.
- Legal obligation (Art. 6(1)(c)) — to comply with applicable law, including tax and accounting requirements.
4. How We Use Your Data
- Provide and maintain the BioSonic platform
- Process and classify your bat audio recordings
- Authenticate your account and manage access
- Send service-related communications (not marketing)
- Improve classification accuracy and develop new features
- Monitor platform security and prevent abuse
- Comply with legal obligations
5. AI Model Training
By default, uploaded audio data may be used to train and improve BioSonic's bat classification models, as described in our Terms of Service (Section 6). This processing is based on our legitimate interest (Art. 6(1)(f)) in improving classification accuracy for all users.
Opt-out: You may opt out of AI training at any time by emailing hello@biosonic.se. We action opt-out requests promptly, normally within 14 days. After opt-out we cease using your data in future training runs. Data already incorporated into existing model weights cannot be isolated and removed, but will not be used in retraining. Enterprise customers may override this default via a Data Processing Agreement (DPA).
6. Data Sharing & Sub-processors
We do not sell your personal data. We share data only with the following sub-processors, each bound by data processing agreements:
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Compute, storage, backups | EU Stockholm (eu-north-1), UK London (eu-west-2) |
| Supabase | Managed PostgreSQL database & authentication | EU |
| Vercel | Frontend hosting & edge delivery | EU edge |
| Google Workspace (Gmail) | Business email | EU data region |
| PostHog Cloud EU | Product analytics | EU (eu.posthog.com) |
| Swedish colocation provider | Encrypted off-site backups | Sweden |
Sub-processors may be updated with 30 days' notice per GDPR Art. 28(2). The current list is maintained in this section of the Privacy Policy.
7. International Transfers
We process and store personal data within the EU/EEA and UK. Where a sub-processor's parent entity is outside the EEA, any onward transfer is governed by Standard Contractual Clauses and the EU-UK adequacy decision.
8. Data Retention
We retain your account data and uploaded recordings for the duration of your contract with BioSonic. When your account is terminated or you request deletion, we delete your personal data and uploaded files within 90 days, except where retention is required by law (e.g., accounting records under Swedish Bokforingslag).
Anonymised and aggregated data used in trained model weights is not considered personal data and may be retained indefinitely.
9. Your Rights
Under GDPR and UK GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where consent is the legal basis
To exercise any of these rights, email hello@biosonic.se. We will respond within 30 days.
Supervisory authorities: You have the right to lodge a complaint with:
- IMY (Integritetsskyddsmyndigheten) — Swedish Authority for Privacy Protection (primary)
- ICO (Information Commissioner's Office) — UK supervisory authority (secondary, for UK-based data subjects)
10. Cookies & Analytics
We use cookies and similar technologies to operate and improve our website. You can manage cookie preferences via the consent banner shown on your first visit. If you decline non-essential cookies, only strictly necessary cookies are set.
| Cookie / Technology | Provider | Purpose | Type |
|---|---|---|---|
| PostHog session & user ID | PostHog Cloud EU | Product analytics — page views, feature usage, session replay | Non-essential (analytics) |
| Vercel Analytics | Vercel | Anonymised page performance metrics (Core Web Vitals) | Non-essential (analytics) |
| Google Ads conversion tag | Measures ad-click conversions on our marketing site | Non-essential (marketing) | |
| Google Fonts | Font delivery — no cookies set, but browser connects to Google servers | Functional | |
| biosonic_cookie_consent | BioSonic (first-party) | Remembers your cookie consent choice for 6 months | Strictly necessary |
| biosonic_theme | BioSonic (first-party) | Remembers your light/dark theme preference | Functional |
We do not use third-party advertising cookies beyond the Google Ads conversion tag listed above. No data is sold to third parties.
How to withdraw consent: Clear your browser cookies for biosonic.io, or email hello@biosonic.se.
11. Children
BioSonic is not directed at children under 13 (the digital-consent age in Sweden). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@biosonic.se.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page indicates when the policy was last revised.