Privacy Policy

As of November 9, 2026 · Sokaina Agency and Sokaina OS

Draft: Details regarding storage of backup copies are still being confirmed. This version is not yet final.

Person responsible and contact

Account and workspace

We process your email address, a salted password hash, invitation and session data, and the content you store: such as profile, projects, tasks, applications, financial records and media. This enables the agreed account functions and the management of your work (Art. 6 Para. 1 lit. b GDPR). No account is possible without an email address and password; You determine further content yourself. Please only save data that you need and are allowed to process for your work.

Access and security

Accounts are given a specified type: Agency or Artist. Content is assigned to the respective account. This means that an agency account does not have access to private artist accounts. Authorized technical support may require access for necessary maintenance or support. Technical connection data, in particular IP address, time and requested address, are processed for delivery. Security measures and limited login attempts protect accounts from misuse (Art. 6 Para. 1 lit. f GDPR; interest in secure operation).

Hosting and recipients

Accounts, content and media reside on the server environment managed by Sokaina. The infrastructure is operated by Hetzner in Germany. As an infrastructure service provider, Hetzner can process technical data as part of hosting. The specifically agreed order processing conditions, subcontractors and any other recipients will be checked before this declaration is concluded. There is no automatic sharing of your content to other accounts.

Necessary session cookie

The “sokaina_session” cookie keeps you logged in for up to seven days and is removed when you log out. It is required for the expressly requested registered service (Section 25 Paragraph 2 No. 2 TDDDG). Without explicitly loading an external Pinterest preview, the application does not integrate any analytics or advertising trackers.

Internal AI and funding research

AI functions only run on your request. Shortened excerpts of the selected profile, project and application are processed for draft applications. Funding proposals use the selected project and public tender titles. The model runs within the Sokaina server environment; These features do not send your workspace content to external AI providers. The processing serves to provide the requested support (Art. 6 Para. 1 lit. b GDPR).

A separate research component loads public funding pages. She does not receive any profile or project texts. Public sources can be cached. If you open an external link, its operator processes your connection data according to its own conditions. The application does not transmit a referrer.

AI results may be inaccurate. Funding proposals are thematic information and not confirmed eligibility for funding. There is no automatic application or decision with legal or similarly significant effect. You check results and save draft applications yourself.

Image search and Pinterest

When searching for images, we send the search term you enter to Wikimedia Commons via a separate server component. Account, profile and project content will not be transmitted. Search results and public image metadata are cached in memory for up to one hour. Selected images are saved in your private media pool with source and license information.

Pinterest references are initially only saved as a link. Only when you select “Load Pinterest preview” will your browser load content from Pinterest. Pinterest receives technical connection data, including your IP address; Its cookies and other data processing may be used. The preview is isolated from the private workspace. These apply Pinterest Privacy Policy. You can close the preview or reload the page to disconnect the preview.

Optional Google News name search

This function is initially switched off. If you enable it in the dashboard or settings, Sokaina will query Google News for your saved artist name when you open the dashboard. When searching locally, your country is also transmitted. Biography, projects and financial information will not be transferred. Google receives the search terms and connection data from the Sokaina research server. Results are reused on this server for up to 15 minutes. You can turn off new queries at any time in the settings; Requests that have already been started can still be completed. These apply to processing by Google Data protection information.

Support requests

When you send a ticket, we store your description, area, account email, status and reply. Only explicitly authorized support staff can access the central inbox. Other users can only view their own tickets. Replies appear in My tickets; no automatic email notification is sent. Tickets are retained for handling and follow-up. Contact the address above for deletion requests. Do not send passwords or unnecessary personal information about others.

Storage duration

Saved workspace content is retained for account use. You can create an export and request deletion via the email address above. Necessary legal retention obligations or the clarification of specific claims may prevent immediate, complete deletion; the data concerned will then be limited to this purpose.

Sessions are valid for a maximum of seven days. Private AI designs and funding proposals are reused for up to 24 hours; Expired cache entries are cleaned up the next time they are called. Saved favorites and explicitly saved drafts remain workspace content. Retention and deletion periods for backup copies and any infrastructure logs still need to be confirmed.

Your rights

In accordance with the GDPR, you can request information, correction, deletion, restriction and data portability. If processing is based on legitimate interests, you can object on grounds relating to your particular situation. You can revoke any consent in the future. To do this, contact hello@salmaabdo.com.

You can complain to a data protection supervisory authority, particularly where you live, work or suspect a breach. For North Rhine-Westphalia you can find contact information at State Commissioner for Data Protection and Freedom of Information NRW.

Account security and privacy choices

Authenticator secrets are encrypted on the server; recovery codes and reset tokens are stored as hashes. Security changes revoke existing sessions. We record the account, action and time for security events, and the notice version, choice and time for optional Google News searches and Pinterest previews. Closing a preview removes it from the page; turning off name searches blocks new requests. Requests already sent may finish. Local backups retain seven successful snapshots. Encrypted offsite backups retain the last seven snapshots, seven daily, four weekly and six monthly snapshots. Retention for manual backups, security events and consent records still requires an approved policy.