This Privacy Policy explains how Sociably (operated by Themelio Studio, Athens, Greece) collects, uses and protects your data. We are committed to GDPR compliance as a company operating within the European Union.

1. Who we are

Sociably is a product of Themelio Studio, a digital agency based in Athens, Greece. Our data controller contact is support@sociably.media.

2. What data we collect

Data	Why we collect it	Legal basis
Name and email address	Account creation and communication	Contract performance
Company name, VAT, address	Invoice generation	Legal obligation
CRM domain	License domain-locking and security	Contract performance
Usage logs (credits used, timestamps)	Billing and abuse prevention	Legitimate interest
Payment information	Processed by Stripe — we never store card details	Contract performance
Session tokens	Keeping you signed in to the dashboard	Legitimate interest

3. CRM data processing

When you use the Sociably AI module, your Perfex CRM data (client names, invoice amounts, contract dates) is sent to our API to generate AI responses. This data is:

• Processed only to generate the requested AI response
• Not stored permanently on our servers
• Not used for training AI models
• Not shared with third parties except the AI model provider (Anthropic) under their privacy terms
• Transmitted over encrypted HTTPS connections only

4. Cookies

We use only essential cookies and localStorage to:

• Keep you signed in to your dashboard (session token)
• Remember your cookie consent preference

We do not use advertising cookies, tracking pixels or analytics that identify you personally.

5. Data retention

• Account data: retained for the lifetime of your account plus 2 years
• Usage logs: retained for 12 months for billing purposes
• Session tokens: expire after 7 days
• Email verification tokens: expire after 24 hours
• Invoices: retained for 7 years as required by Greek tax law

6. Your rights under GDPR

As an EU resident you have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data via your account settings
• Erasure — request deletion of your account and associated data
• Portability — receive your data in a machine-readable format
• Object — object to processing based on legitimate interest
• Withdraw consent — where processing is based on consent

To exercise any of these rights, email support@sociably.media. We will respond within 30 days.

7. Third-party services

• Stripe — payment processing. Subject to Stripe's Privacy Policy
• Anthropic — AI model provider. Subject to Anthropic's Privacy Policy
• Cloudflare — DNS and DDoS protection. Subject to Cloudflare's Privacy Policy

8. Data security

We implement appropriate technical and organisational measures to protect your data including encrypted connections (HTTPS/TLS), bcrypt password hashing, domain-locked API keys, rate limiting and regular security audits.

9. Data transfers

Our servers are located in the EU (Germany). AI processing may involve data transfer to Anthropic (USA) under Standard Contractual Clauses.

10. Changes to this policy

We may update this policy periodically. We will notify you of material changes via email. The date at the top of this page reflects the most recent update.

11. Contact and complaints

For privacy questions or to exercise your rights: support@sociably.media

If you are unsatisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.