1. Data Controller
BioSonic AB
Org.nr: 559472-8056
Bergsundsgatan 7, 117 37 Stockholm, Sweden
Email: support@biosonic.se
BioSonic AB ("BioSonic", "we", "us") is the data controller for personal data processed through the BioSonic platform at biosonic.io and bat.biosonic.se.
2. Data We Collect
Account data
When you register, we collect your name, email address, organisation name, and password (hashed). If you sign in via Microsoft Azure SSO, we receive your name and email from your identity provider.
Uploaded data
Audio recordings (WAV files) you upload for analysis, along with associated metadata (dates, coordinates, detector model). Audio files may contain incidental environmental sounds but are not expected to contain personal data.
Usage data
We collect information about how you use the platform, including pages visited, features used, and classification results viewed. This is collected via PostHog Cloud EU.
Communication data
If you contact us by email, we store the correspondence to respond to your inquiry.
3. Legal Basis for Processing
We process your personal data under the following legal bases (GDPR Art. 6(1)):
- Contract performance (Art. 6(1)(b)) — to provide the BioSonic platform, process your uploads, and deliver classification results.
- Legitimate interests (Art. 6(1)(f)) — to improve our service, maintain security, and train our AI models (see Section 5). Our legitimate interest is balanced against your rights through data minimisation, aggregation, and opt-out mechanisms.
- Consent (Art. 6(1)(a)) — for analytics and advertising cookies on our website, and for reporting a sign-up from a Google ad click back to Google Ads (see Section 10).
- Legal obligation (Art. 6(1)(c)) — to comply with applicable law, including tax and accounting requirements.
4. How We Use Your Data
- Provide and maintain the BioSonic platform
- Process and classify your bat audio recordings
- Authenticate your account and manage access
- Send service-related communications (not marketing)
- Improve classification accuracy and develop new features
- Monitor platform security and prevent abuse
- Comply with legal obligations
5. AI Model Training
By default, uploaded audio data may be used to train and improve BioSonic's bat classification models, as described in our Terms of Service (Section 6). This processing is based on our legitimate interest (Art. 6(1)(f)) in improving classification accuracy for all users.
Opt-out: You may opt out of AI training at any time by emailing support@biosonic.se. We action opt-out requests promptly, normally within 14 days. After opt-out we cease using your data in future training runs. Data already incorporated into existing model weights cannot be isolated and removed, but will not be used in retraining. Enterprise customers may override this default via a Data Processing Agreement (DPA).
6. Data Sharing & Sub-processors
We do not sell your personal data. We use the service providers below to run the service and the company. We update this list before a new provider starts to process customer data. If you object to a change, email support@biosonic.se.
Running the service
| Provider | What for | Where the data is |
|---|---|---|
| Amazon Web Services | Storage, servers, email and security logs | Sweden, Ireland and the United Kingdom (some security logs) |
| Supabase | Database and sign-in | Sweden |
| ClickHouse | Analytics on detections | Ireland |
| Amazon Bedrock | Writing report text | Sweden |
| Vercel | Hosting the web app and this website | Sweden, with a global content network |
| PostHog | Product analytics | Germany |
| ActiveCampaign | Product emails | EU |
| Swedish colocation provider | Storage | Sweden |
Running the company
| Provider | What for | Where the data is |
|---|---|---|
| Google Workspace | Email and documents | Europe |
| Oneflow | Contract signing | Sweden and Ireland |
| Kleer | Invoicing | Sweden |
| Cloudvisor | AWS management partner | EU |
Each provider processes data under a data processing agreement. Where a provider, or a member of our team supporting the service, may access data from outside the EU/EEA, this is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
Not on this list
- Storage that you or a partner control (for example your own S3 bucket). We read from it on your instruction.
- Content networks and font services receive browser request data, including IP addresses (see section 10).
Changes to this list: 9 October 2026, updated provider list.
7. International Transfers
The service and customer data are hosted in the EU and the United Kingdom. Uploaded recordings, analysis results, reports and the database are stored and processed in Sweden and Ireland, and some security logs are kept in the United Kingdom, which has an EU adequacy decision. Any access from outside the EU/EEA is covered by the safeguards described in section 6.
8. Data Retention
We keep uploaded recordings, results and project data for the storage period in your contract (nine years from upload in our standard agreement), also after the contract ends, so you can still access and export them. On request, we delete or return personal data as the GDPR requires, except where retention is required by law (e.g., accounting records under the Swedish Bookkeeping Act, Bokföringslagen).
Anonymised and aggregated data used in trained model weights is not considered personal data and may be retained indefinitely.
9. Your Rights
Under GDPR and UK GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, where consent is the legal basis
To exercise any of these rights, email support@biosonic.se. We will respond within 30 days.
Supervisory authorities: You have the right to lodge a complaint with:
- IMY (Integritetsskyddsmyndigheten) — Swedish Authority for Privacy Protection (primary)
- ICO (Information Commissioner's Office) — UK supervisory authority (secondary, for UK-based data subjects)
10. Cookies & Analytics
When you first visit our website we ask for your choice with a banner that has two equal buttons: Accept and Decline.
- Before you choose, and if you decline: no analytics or advertising cookies are set and nothing is stored in your browser for those purposes. We still count visits anonymously: PostHog keeps its visitor ID in memory only for the current page, and Google Analytics and Google Ads run in Google Consent Mode with storage denied, which sends cookie-free signals without any identifier stored on your device. Ad-click identifiers are not stored and are not passed on to our app.
- If you accept: PostHog, Google Analytics and Google Ads may set the cookies listed below, and if you arrived from a Google ad and then sign up, we report that sign-up to Google Ads together with the ad-click identifier (gclid) so we can tell which ads lead to sign-ups.
| Cookie / Technology | Provider | Purpose | Type |
|---|---|---|---|
PostHog (ph_* cookie / local storage) | PostHog Cloud EU | Product analytics — page views and feature usage. Before consent the ID lives in memory only. | Non-essential (analytics), set only after Accept |
Google Analytics 4 (_ga, _ga_*) | Website analytics. Without consent: cookie-free signals only. | Non-essential (analytics), set only after Accept | |
Google Ads (_gcl_au, _gcl_aw) and biosonic.marketing_attribution.v1 | Google / BioSonic (first-party) | Measures which ad clicks lead to sign-ups. Without consent: cookie-free signals only, and the click ID is not stored or forwarded. | Non-essential (marketing), set only after Accept |
| Google Fonts | Font delivery — no cookies set, but browser connects to Google servers | Functional | |
| biosonic_cookie_consent | BioSonic (first-party) | Remembers your Accept/Decline choice for 6 months | Strictly necessary |
| biosonic_theme | BioSonic (first-party) | Remembers your light/dark theme preference | Functional |
With your consent, Google Ads cookies are used only to measure which of our ads lead to sign-ups. We do not use them, or the sign-up reports we send to Google Ads, to personalise ads (ad personalisation is always switched off). No data is sold to third parties.
How to change or withdraw consent: Open cookie settings and choose Decline (this also removes the analytics and advertising cookies already set), clear your browser storage for biosonic.io, or email support@biosonic.se.
11. Children
BioSonic is not directed at children under 13 (the digital-consent age in Sweden). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@biosonic.se.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via email to registered users. The "Last updated" date at the top of this page indicates when the policy was last revised.