Privacy Policy

Version: 3.0
Effective date: November 1, 2026

Engage Wisdom is operated by Sonic Zen, Inc., a California corporation doing business as Engage Wisdom. In this policy, "Engage Wisdom," "we," "us," and "our" refer to Sonic Zen, Inc., and "the Service" means the Engage Wisdom platform and related services, as our Terms of Service define it. This policy describes what personal information we handle, why, how long we keep it, the rights you have, and the two roles we play in handling it.

1. Two Roles: Who Is Responsible for What

The roles of data controller and data processor are divided as follows:

• For your account, billing, support, and usage data, and the other information Section 2 lists (information you give us, information your use of the Service creates, and information your organization or our payment processors provide about you), Engage Wisdom is the data controller. The same is true for the processing we do for our own purposes: accounts, billing, support, securing the platform, keeping the Service working reliably, preventing abuse, understanding how the Service is used, meeting our own legal obligations, and the platform learning Section 5 describes. This policy is our statement of how we handle it.
• For the content of hosted collections (recordings, transcripts, photos, metadata, and everything else in a collection, including the personal data inside them), the organization or individual who owns the collection is the data controller, and Engage Wisdom is their data processor. We process that content on their documented instructions, under a Data Processing Addendum that applies automatically as part of our agreement. (Where California privacy law applies to a collection owner, that owner is the "business" and we act as its "service provider" for collection content.)

If your voice, image, name, or story, or anything else about you, appears in a collection's recordings or other content, the collection's owner is responsible for that content and is the right place to send questions and requests about it. You can find their contact details through the About link on that collection's page. We assist collection owners in responding; we do not decide on their behalf. For our own platform-learning processing described in Section 5, we are the controller, and Section 9 tells you how to reach us about it directly. Collection owners are responsible for providing appropriate privacy notices to their members, speakers, contributors, and other people whose personal data they bring to the Service.

2. What We Collect (as Controller)

• Account information: name, email address, username, password (stored hashed), access permissions, the collections you belong to and your role in each, and any profile details you choose to add, such as a photo.
• Billing information: plan, transactions, Publishing Credits, the Order Forms and estimates you sign (including the people named on them), and billing and shipping contact details. Card numbers go to our secure payment processors, never to our servers.
• Support communications: messages you send us, our replies, recordings of calls with us, and other correspondence with us.
• Usage and log data: technical and activity information such as your IP address and the approximate location it implies, browser and device information, pages visited, actions taken, and timestamps. Used for security, debugging, understanding how the Service is used, and, once anonymized, the platform learning Section 5 describes. If you listen to a collection's podcast feed outside the platform, the feed's delivery logs record the same kind of request data, and we may share aggregate listening statistics, never listener identities, with the collection's owner.
• Terms-acceptance records: which document versions you accepted, and when, from where.
• Cookies: see Section 8.

Similar information you give us, or that your use of the Service creates, belongs to the nearest kind above and is kept for the same period.

Sensitive personal information (California). On the account side, the sensitive personal information we need to run your account is your login credential, used only to authenticate you, and, where the collections you belong to reveal a religious affiliation, that membership, which we use only to run the Service and never to infer characteristics about you. A profile photo is not used to identify you biometrically, and we hold only the approximate location your IP address implies, not precise geolocation. We do not use sensitive personal information for purposes that would trigger a right to limit under California law.

3. What We Process (as Processor)

For collection owners we process the content of their collections: recordings (audio and video), including those our digitization service creates from physical media, photos and other uploaded files, transcripts and captions, translations, summaries, chapter markers, keywords, speaker-role labels, edits, corrections and redactions, titles, descriptions, notes, and metadata, the collection's access, membership, and certification records, and other material a collection adds or the Service creates for it. What we do with this content is directed by the collection owner through their settings, instructions, and Permissions Clearance certifications.

Recordings of teachings often include people speaking about their beliefs, health, or personal lives. Where collection content includes special categories of personal data, the collection owner determines the lawful basis for it; we process it only as their processor, under the safeguards in the Data Processing Addendum.

4. Why We Use Information, and on What Legal Basis

Where the GDPR applies, we rely on these legal bases:

• Performance of a contract: operating your account, billing, answering your support requests, and providing the Service you signed up for, including digitization projects.
• Legitimate interests: securing the platform, preventing abuse, understanding usage, improving the Service's features and reliability, including the platform learning Section 5 describes, and keeping records of what was agreed so we can handle notices and disputes. We balance these interests against your rights.
• Legal obligation: tax and accounting records, responding to lawful requests, and answering privacy-rights requests.
• Consent: where we ask for it specifically, which today means optional communications. You can withdraw consent at any time.

We do not sell personal information, and we do not use it to advertise to you. We do share information with service providers, such as hosting, payment processing, email delivery, and AI processing, under written agreements that limit what they can do with it (Section 6).

5. AI Processing and Voices

Our platform generates transcripts, captions, translations, summaries, chapter markers, keywords, speaker-role labels, and similar materials from recordings, and labels these materials as AI-generated.

Our systems are built not to identify people by their voices. Specifically:

• Speaker separation produces anonymous per-recording labels (a voice is "Speaker 1" in one recording and unrelated to any other recording).
• Voice data used for separation is ephemeral to the processing of a single recording. Our system is designed and configured so that no database of voices or retained voice embeddings is created or kept, either by us or, under the contractual commitments we require, by the providers that process audio for us. There is no cross-recording voice matching.
• Speaker roles (such as "Speaker," "Translator," and "Audience") are inferred from what is said, not from the characteristics of anyone's voice.
• Names attach to a recording from its content or from what people enter in it, never from voice recognition.

This is how we build the system, and what we require, contractually, of every provider that processes audio for us; our Data Processing Addendum (Annex B) carries these commitments.

Our position on biometric data. By design, we do not create or retain voiceprints or any other biometric identifier. The voice data used to separate speakers exists only for the processing of a single recording and is cleared when that run finishes; by design, it is never written to disk, never matched across recordings, and never used to identify anyone. Because we hold no biometric identifiers, we maintain no biometric retention schedule, and if that ever changes, we will publish one before it does. We never use recordings entrusted to us to imitate, clone, or synthesize anyone's voice.

One example of what this means in practice: because we keep no voiceprints, if you ask us to find every recording a particular person's voice appears in, we cannot do that by matching voices. That is by design. We can search the text instead.

How the system learns.

• What the platform learns from. The platform improves by learning from eligible Published Content, plus anonymized usage signals and de-identified corrections derived from participating Published Content. Eligible Published Content is content a collection makes available to the general public on the Service or distributes through the public feeds it enables, and that is included in the Service's public search and listings. It never includes private or invite-only material, Talks not marked Cleared, or compliance-review work.
• What anonymized and de-identified mean here. De-identification is effective when the result can no longer reasonably be linked to an individual, and we document our method against that standard, before the data trains anything. Standard learning, the kind every participating collection gets, may include the names of public figures and historical persons as they appear in published works and public listings, and those names are generally kept as published; it is designed to exclude the names of private individuals, and we remove any we find. Apart from those names, personal data in Published Content teaches the system only after effective de-identification.
• Special-category content. Apart from the names described above, where Published Content contains special categories of personal data, it is used for standard learning only after effective de-identification, performed on the collection owner's documented instruction, as their processor, before anything reaches our own learning.
• Enhanced learning is a separate, affirmative election that we may offer to some collections established in the United States. It permits learning from identifiable Published Content (Terms Section 6 describes it). It is never a default, the owner's warranty covers the disclosure it permits, and it can be ended prospectively at any time. We do not currently offer enhanced learning to collections established in the European Economic Area or the United Kingdom (DPA Section 12).
• What we do not do. Apart from the names described above, we do not use identifiable or merely pseudonymized special-category data for standard learning, we never train on unpublished content or compliance-review work, and we never use interaction data to build profiles of individuals for learning or marketing.
• Aggregate signals. Aggregate usage signals that identify no one are not part of a collection's choice to participate.
• Our controller-side role. For this learning, we are the controller: the sources are the Published Content, signals, and corrections just described, and the purpose is improving the Service's features. The processing that precedes de-identification is carried out for the collection owner, as their processor, on their instruction; once de-identification is effective, the resulting content is no longer personal data. Retention of learning artifacts follows Section 7.
• Notice. Collection owners who need to tell the people in their recordings about this processing may link to this section.
• Election and its effect. Collection owners choose whether their collection takes part in platform learning (Terms Section 6 describes the choice); participation does not begin unless their election is recorded. An exclusion stops new learning from the collection within 30 days; it does not unwind learning already lawfully completed, or require retraining of models already built, except where the law requires otherwise.

6. Who Helps Us: Sub-processors and Transfers

We use service providers for cloud hosting and storage, content delivery, AI processing (such as transcription, speaker separation, translation, summarization, and keyword extraction), payments, email, analytics and error monitoring, office and video-call software, and shipping for digitization projects. Providers that process collection content on a collection owner's behalf are our sub-processors, bound by data-processing agreements; providers that process data for our own purposes are our processors or service providers, bound the same way. Beyond our providers, we may disclose personal information to the owners and authorized users of the collections you belong to (your name, email address, and role, so they can manage access and work together), to our professional advisers, to courts, authorities, and others where the law or valid legal process requires it (Terms Section 12), and to a successor if our business is merged or sold (Terms Section 18).

• Our current sub-processor list is published at go.engagewisdom.com/sub-processors. We give notice of sub-processor changes as the Data Processing Addendum describes, and collection owners may object as it provides.
• We are a US company, and processing occurs in the United States and other countries. Where applicable law requires safeguards for an international transfer, we use the safeguards described in our Data Processing Addendum and in our arrangements with our providers. Email office@engagewisdom.com for a copy of the applicable transfer safeguards.
• If you connect a YouTube channel to the Service, we use YouTube API Services to publish video to that channel for you. We access and store the details of your channel needed to publish to it, and the authorization you give us, and we use them to publish and manage the videos you choose there. We send those videos, with their titles, descriptions, and other details, to YouTube, and the service providers described above store what we receive from YouTube for us. The Google Privacy Policy describes how Google handles information. You can revoke our access at any time at https://security.google.com/settings/security/permissions.

7. How Long We Keep Things

We keep personal information only as long as it serves the purpose we collected it for, or longer where the law requires us to keep it, and then we delete it. Here is how long we keep each kind:

• Account information: for the life of the account, then deleted within 180 days of closure. Billing and tax records follow their own period, below.
• Billing records: seven years after the end of the tax year they belong to, which covers the periods tax and accounting law requires of us.
• Support communications: 3 years from the last message in the conversation.
• Usage and log data: up to 180 days, then deleted; security logs kept longer only for an active incident investigation.
• Cookies: sign-in cookies end when you sign out or your session expires; analytics cookies last no longer than 13 months.
• Terms-acceptance records: for the life of the account and four years after it closes, the period in which a claim under a written agreement can ordinarily be brought in California.
• Collection content: controlled by the collection owner; deleted on their instruction or on closure of the collection, after the export window. We keep only backup copies, which clear on their normal rotation as described below, and copies we must keep under applicable law or need to establish or defend a legal claim, such as certification records and the owner's instructions; we use those only for that purpose and delete them when it ends. Where the Data Processing Addendum narrows this for a collection (its Section 10), the Addendum controls.
• Platform-learning artifacts: models, word lists, settings, and other aggregate improvements built from Published Content and de-identified signals and corrections; retained while they serve the Service, with superseded artifacts clearing on rotation.
• Backups clear on their normal rotation, within 180 days, and stay protected until deletion. In the meantime they are kept beyond use, meaning they are not used to inform any decision about you, and not restored from in a way that reintroduces erased data. Where we keep an archive longer than that, we remove from it any content we are required to delete.

The full retention schedule, by data type, is maintained in our written retention policy.

8. Cookies

We use cookies to keep you signed in, keep the Service secure, and remember your preferences. We also use analytics cookies to understand how the Service is used; we do not use advertising cookies, and we do not share analytics data for advertising. You can block or delete cookies in your browser settings; the Service works without analytics cookies, though you will need to sign in again if you delete the sign-in cookie.

Do Not Track. Some browsers can send a "Do Not Track" signal or a similar signal. The Service does not currently respond to it.

Other companies on the Service. Other companies whose tools run on the Service, such as Google through Google Analytics, may collect information about your use of the Service under their own privacy policies, and may combine it with information from other websites that use their tools. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

9. Your Rights

Your privacy rights. Depending on the law applicable to our processing, you may have rights to access, correct, delete or receive a portable copy of your personal data, restrict or object to processing, withdraw consent, and complain to a data-protection authority. These rights are subject to the conditions and exceptions in applicable law. We do not make automated decisions with legal or similarly significant effects about you.

What we offer California residents. If you are a California resident, you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, and we will not treat you differently for asking. We do not sell personal information (Section 4), and Section 2 describes the sensitive personal information we hold and the only uses we make of it.

To exercise any of these rights for data we control, email office@engagewisdom.com. We verify account-related requests by matching them to the email address on your account and respond within the time required by applicable law: for many requests, within one month under EU/UK law, with extensions where the law provides them. Where no law sets a time, our practice is to respond within 45 days, and to tell you if a request needs longer. If you do not have an account, tell us what your request is about and give us details that help us find the information, such as the email address you have written to us from; we use them only to check your request and may ask for one more detail. If we cannot verify you, or cannot link any information we hold to you (for example, because it is de-identified or is analytics data tied only to a browser), we will tell you. For personal data inside a hosted collection, contact the collection's owner (Section 1); if you are unsure who that is, or your request reaches us first, we can forward it to the collection owner and assist them in responding. For our own platform-learning processing (Section 5), contact office@engagewisdom.com directly.

10. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the data, such as role-based access, encryption in transit, access logging, and backups. No system is invulnerable, and we do not claim ours is. If a breach affects personal data we control, we notify you and the relevant authorities as the law requires. If a breach affects collection content, we notify the collection's owner without undue delay, so they can meet their own obligations, and we assist them.

11. Children

The Service is for people 18 and older (see the Terms), and we do not knowingly collect personal information directly from children under 18. If you believe a child under 18 has an account, contact us and we will remove it.

12. Changes to This Policy

We update this policy as the Service and the law evolve. Material changes are announced by email and by notice on the Service before they take effect, with reasonable time to review them.

13. Contact

Sonic Zen, Inc. (doing business as Engage Wisdom) 2916 Chapman Street Oakland, CA 94601, USA

• Privacy requests, copyright notices, and other legal matters: office@engagewisdom.com
• Everything else: help@engagewisdom.com

Version 3.0, 2026-11-01.