Privacy Policy

1. Overview & Data Controller Identification

At Sophia Platform, privacy and data sovereignty are foundational to our architectural design. This Privacy Policy describes how Four Elements Corp ("Company", "we", "our", or "us") collects, processes, stores, and safeguards personal data when you use our website, Cloudflare Edge API services, and collaborative AI workspaces.

2. Enterprise AI Data Privacy Pledge — Zero Model Training

3. Categories of Data We Collect

We collect only the minimum personal data strictly necessary to provision and maintain your account:

• Identity & Account Data: Name, business email address, company name, workspace profile, and cryptographic password hashes (hashed using Web Crypto PBKDF2 with 100,000 iterations and unique 16-byte salt).
• Financial & Transaction Data: Billing contact details, Stripe customer identifiers, subscription tier, and double-entry credit ledger transaction entries. We never store raw credit card numbers.
• BYOK (Bring Your Own Key) Credentials: When you provide your own provider API keys, they are encrypted using hardware-level AES-256-GCM before storage in our KV namespace.
• Telemetry & Usage Data: Anonymized request counts, token usage statistics, IP address (for rate limiting and DDoS mitigation only, discarded automatically), and response latency.

4. Lawful Bases for Processing under GDPR (Article 6)

Under the European Union General Data Protection Regulation (GDPR), we process your personal data under the following legal bases:

5. Your Data Subject Rights under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you enjoy full statutory rights under GDPR Chapter III:

• Right of Access (Article 15): You have the right to request a complete copy of the personal data we hold about you.
• Right to Rectification (Article 16): You may correct inaccurate or incomplete account and workspace data via your profile settings.
• Right to Erasure / "Right to be Forgotten" (Article 17): You may request the permanent deletion of your account, workspace documents, knowledge base vectors, and API keys.
• Right to Restriction of Processing (Article 18): You may request restriction of data processing during dispute resolution.
• Right to Data Portability (Article 20): You may export your generated documents, CAT translations, and glossary files in standard formats (JSON, TXT, TMX, XLIFF).
• Right to Object (Article 21): You have the right to object to processing based on legitimate interests.

To exercise any of these rights, email our Data Protection Officer at quangle@fourelementscorp.com. We respond to all verified requests within thirty (30) calendar days at zero fee.

6. California Consumer Privacy Rights (CCPA / CPRA)

For residents of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA) grants specific privacy protections:

• Right to Know & Access: Learn categories and specific pieces of personal information collected.
• Right to Delete: Request deletion of personal data collected, subject to legal exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide degraded performance for exercising your CCPA rights.

7. Multi-Tenant Isolation & Hardware-Level Encryption

We employ defense-in-depth security across our edge architecture:

• Encryption in Transit: All HTTP traffic is enforced strictly over TLS 1.3 with automated SSL/TLS certificates and HTTP/3 support via Cloudflare Pages.
• Encryption at Rest: Database records in Cloudflare D1, media assets in Cloudflare R2, and vectors in Cloudflare Vectorize are encrypted using AES-256 at rest.
• BYOK Secrets: User-supplied provider keys are encrypted with authenticated Web Crypto AES-256-GCM using keys stored exclusively in secure environment bindings.

8. International Data Transfers & Standard Contractual Clauses (SCC)

Sophia Platform runs on globally distributed Cloudflare edge workers located across 300+ points of presence. When data crosses national borders, we ensure adequate protection through European Commission-approved Standard Contractual Clauses (SCC) and Cloudflare Data Processing Agreements.

9. Cookie Policies & Analytics

We value digital privacy and maintain minimal client storage:

• Strictly Necessary Storage: We use localStorage solely for language preferences (sophia_lang) and dark/light color themes.
• Privacy-Respecting Analytics: We employ Cloudflare Web Analytics, a privacy-first, cookie-less analytics platform that does not track users across websites or collect invasive fingerprinting data.
• Global Privacy Control (GPC): Our platform automatically honors browser-level GPC and Do Not Track (DNT) signals.

10. Data Protection Officer & Inquiries

If you have questions, comments, or concerns regarding this Privacy Policy or our security measures, please contact our Data Protection Officer: