Privacy Notice

Version 2026-10-27 · Sonik · Nigeria Data Protection Act 2023

What we collect

  • An email address, asked for before your first purchase. Used for receipts and to recover your account.
  • Your messages and prompts — what you ask for, so we can make it.
  • A platform identifier — your Telegram user id, or a signed cookie in the browser. We do not ask for your name or phone number.
  • Payment records — the amount, the currency and a reference from Paystack. We never see or store your card details.
  • A voice recording, only if you choose to use voice features and only of yourself. See below.

Voice recordings, specifically

A consent recording is a recording of you speaking a phrase we issue, including a one-time code. It is the evidence that you authorised cloning your own voice, and it is the only sample used.

These recordings are treated as sensitive. They are stored in a private location with no public access, are never shared beyond the transcription provider listed below, and are never used to train anything. We will not clone the voice of anyone other than the person operating the account.

You may withdraw consent at any time — send /revoke in the chat. The voice clone is deleted at the provider first, voice generation is blocked immediately, and the recording is scheduled for deletion.

How long we keep it

Consent recordings and voice samples

365 days from verification, or immediately on withdrawal of consent

Evidence that you authorised cloning your own voice, and the sample itself

Chat messages

90 days

So the bot can follow a conversation across a few messages

Prompts, tracks and payment records

Retained while your account exists

To show you your tracks, and to prove what you paid for and what rights it carries

Who else receives it

Sonik is built on third-party services. Each receives only what it needs to do its job:

ElevenLabs — Your prompt text. Generating the music.
Google (Gemini) — Your chat messages. Understanding what you asked for.
Deepgram — Your consent recording. Checking you spoke the phrase we issued.
Paystack — Your email address and payment details. Taking payment.
Cloudflare (R2) — Your tracks, voice samples and consent recordings. Storage.
Railway — All of the above, in transit. Hosting.
Telegram — Your messages and finished tracks. Delivering the conversation, if you use the bot.

Several of these operate outside Nigeria, so your data is transferred abroad to provide the service. We do not sell your data, and we do not use it for advertising.

Your rights

Under the NDPA you may ask what we hold about you, ask us to correct it, ask us to delete it, and withdraw consent you previously gave. Withdrawing voice consent is immediate and self-service, as above. For anything else, contact us and we will respond.

Deleting your account deletes your prompts, messages, voice samples and consent records. Payment records are kept as long as the law requires us to keep them.

Contact

Questions about this notice, or a request about your data, can be sent to the address on our Telegram bot or by replying to any receipt email.