Privacy Policy

Our Role

Soefia provides its Services to organizations that have entered into an agreement with Soefia (“Customers”). The Services are intended for organizations and for individuals using the Services on behalf of, or at the direction of, those organizations. The Services are not intended as a consumer service, and we do not offer a consumer service.

Customers determine which individuals use the Services, what information is provided to Soefia, which assessments are administered, and how assessment results are used. When Soefia processes information about an employee or other individual provided by or on behalf of a Customer, Soefia processes that information to provide the Services to that Customer.

Soefia’s Services are tools for measurement and analysis that support human decision-making. Soefia does not use the Services to make employment or other personnel decisions about individuals. Customers determine how assessment information is used and remain responsible for decisions they make based on that information.

Information We Process

Soefia limits the personal information it processes to information necessary to provide and operate the Services. Depending on how a Customer uses the Services, this may include:

• an individual’s name
• an individual’s business email address
• an individual’s role, level, department, or job as defined by the user
• responses submitted as part of an assessment
• assessment scores, results, and related scoring information
• information entered or created through interactions with the Services
• system-generated information relating to use of the Services, including audit and activity logs

Soefia receives information about individuals from its Customers or directly from individuals using the Services at the direction of a Customer. Soefia does not independently purchase employee or individual information from data brokers or other outside sources.

How We Use Information

We use personal information and other Customer-provided information as reasonably necessary to:

• provide and operate the Services for our Customers
• create and administer assessments
• score assessment responses
• provide analysis, reporting, and assessment results to the applicable Customer
• provide implementation, support, and related services
• maintain the security and integrity of the Services
• maintain audit and activity records
• comply with applicable law and legal obligations
• enforce our agreements and protect the rights and security of Soefia, our Customers, and users of the Services.

We do not sell personal information, and we do not use personal information for third-party advertising or cross-context behavioral advertising. We also do not use identifiable employee assessment information for advertising or marketing to employees.

We may also disclose information when required by applicable law, regulation, court order, subpoena, or other valid legal process.

Anonymized and Aggregated Information

Soefia may create and retain anonymized or aggregated information derived from use of the Services, when that information does not identify a Customer or an individual user, employee, applicant, or other person. Soefia does not treat information as anonymized if it identifies a Customer or an individual. Such anonymized or aggregated information may be used by Soefia solely for its business purposes, including analyzing, operating, and improving the Services.

Feedback

Customers and users may voluntarily provide suggestions, comments, feature requests, or other feedback regarding the Services. Soefia may use that feedback to develop, improve, or modify its products and services. Soefia does not need to use, and does not use, identifiable employee assessment information in order to use feedback or anonymized and aggregated information to improve the Services.

Artificial Intelligence

Soefia uses artificial intelligence technology in connection with certain functions of the Services, including the creation and verification of assessment materials and the scoring of certain assessment responses.

Assessment, framework, and related information may be processed through AI models provided by others, such as OpenAI, Anthropic, or other commercial providers. Soefia configures such services it uses so that the data provided are not used to train the models of these providers and so that these providers do not retain that data through their model-serving systems.

AI technology may produce inaccurate or unexpected outputs. Soefia’s Services are intended as tools for measurement and analysis to support human decision-making, not as automated decisioning tools. Soefia does not itself make hiring, termination, promotion, compensation, or other employment decisions about individuals. Customers determine whether and how assessment results are considered in their decisions.

Service Providers

Soefia does not disclose Customer information to third parties for their independent use. We use a limited number of service providers as necessary to operate and provide the Services, such as Amazon Web Services, which provides Soefia’s technical hosting and infrastructure, and commercial AI model providers, including OpenAI and Anthropic. Service providers may process information only as necessary to provide services to Soefia and subject to the applicable contractual and technical restrictions governing their services.

Customer Ownership and Control

Customers own the information and content they provide or create within the Services, subject to the terms of their agreements with Soefia.

Customers control the information they provide to Soefia. Each Customer may designate one or more administrators who have permission to manage information within that Customer’s account, including deleting information through the Services. If you are an employee or other individual whose information was provided to Soefia by or on behalf of a Customer and you want to access, correct, or delete that information, you should ordinarily contact that Customer.

Where required by applicable law or its agreement with the Customer, Soefia will assist the Customer in responding to such requests.

Retention and Deletion

Soefia retains Customer information as necessary to provide the Services during the applicable Customer relationship and as otherwise permitted or required by the applicable agreement or law. Customers may delete information through authorized administrator functionality provided within the Services. Upon termination or expiration of a Customer agreement, Soefia will return or destroy Customer information as required by the applicable agreement. Soefia may retain anonymized or aggregated information that does not identify the Customer or any individual.

Security

Soefia uses administrative and technical measures designed to protect information against unauthorized access, use, alteration, or disclosure, with its technical infrastructure hosted on Amazon Web Services. Soefia maintains audit logs and records of activity performed through the Services and interactions with its systems and databases to support security, accountability, and system integrity. No system can guarantee absolute security, and Soefia cannot guarantee that unauthorized access or disclosure will never occur.

California Privacy Rights

California law may provide California residents with certain rights concerning their personal information, including rights to know or access certain information, request correction or deletion, and receive equal treatment for exercising their privacy rights.

Soefia does not sell personal information or share personal information for cross-context behavioral advertising.

Where Soefia processes personal information on behalf of a Customer, individuals should generally submit privacy requests directly to that Customer. If Soefia receives a request concerning information controlled by one of our Customers, we may refer the request to that Customer or work with the Customer to respond, as appropriate. Where applicable law requires Soefia to respond directly to a privacy request, Soefia will process the request in accordance with applicable law. We may need to verify a request before taking action.

Privacy inquiries may be submitted to privacy@soefia.com.

Information About Individuals Outside the United States

Soefia is a United States company and operates its Services from the United States. Soefia does not currently market or operate its Services in the European Union. Nothing in this Privacy Policy is intended to represent that Soefia is certified under or has undertaken to comply generally with the European Union General Data Protection Regulation (“GDPR”) or any other foreign privacy regime. Where privacy or data protection laws apply to Soefia’s processing of particular information, Soefia will comply with its applicable legal obligations.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, practices, or legal obligations. When we make changes, we will post the updated Privacy Policy and revise the effective date above.

Contact Us

Questions about this Privacy Policy or Soefia’s privacy practices may be sent to: privacy@soefia.com.