Privacy Policy

1. Who we are

Winvest AI, Inc dba Sorec ("Sorec") operates the Service at sorec.io. We are incorporated in the State of Delaware, United States. Our address is 16192 Coastal Highway, Lewes, DE 19958, United States. For privacy-related questions or requests, contact us at contact@sorec.io.

2. Data we collect

Account and profile. When you create an account, we collect your email address and, if you choose, your name, profile photo, biography, location, professional topics, and language preference.

Authentication. If you sign in with Google, we receive basic account information from Google (such as your name, email address, and profile picture) to authenticate you and link your account.

Google Contacts (optional). If you connect Google Contacts, we access your contact list through Google’s API with read-only permission. We process contact identifiers to help you find people you may know on Sorec. We store only cryptographic hashes of email addresses and phone numbers for matching; raw contact values are not kept in our database.

Recommendations and trust. We store recommendations you write or receive, trust relationships you establish, and related activity needed to operate the network.

Identity verification (optional). If you complete identity verification, verification is handled by Stripe Identity. We receive confirmation of verification status, not your identity documents.

Technical data. We automatically collect limited technical information such as IP address, browser type, device information, and session cookies required to keep you signed in and secure the Service.

Communications. We process your email address to send authentication links, invitations, and service-related messages.

3. How we use your data

We use personal data to provide, maintain, and improve the Service; authenticate users; operate invitation-only access; display profiles and recommendations; enable trust and contact-matching features; send transactional emails; prevent abuse and fraud; comply with legal obligations; and communicate with you about the Service.

We may use automated tools, including AI services, to help format or suggest content you choose to publish. We do not use your Google Contacts for advertising, and we do not sell personal data.

4. How we process your information

We process personal information as needed to provide the Service, secure our platform, comply with law, and pursue our legitimate business interests. Where required, we rely on your consent—for example, when you connect Google Contacts or complete optional identity verification.

If you are located in the European Economic Area or the United Kingdom, we also process personal data under the GDPR on the bases of contract performance, legitimate interests (balanced against your rights), consent, and legal obligation.

5. Sharing and processors

We share personal data only as needed to operate the Service, with trusted service providers acting on our instructions, including:

Supabase (authentication, database, and file storage); Vercel (application hosting); Google (OAuth sign-in and, if authorized, Contacts API access); Stripe (identity verification); MailerSend (transactional email); and AI providers used to process content you submit when using AI-assisted features.

Other users may see information you choose to make visible on your profile, recommendations addressed to them, and trust relationships according to product settings. We may disclose information if required by law or to protect rights, safety, and security.

6. Google user data

Winvest AI, Inc dba Sorec’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google account data is used only to provide user-requested features such as sign-in and optional contact matching. You can disconnect Google from your account settings at any time. When you disconnect, we stop accessing your Google data and delete associated contact hashes stored for matching.

7. Data retention

We retain personal data for as long as your account is active and as needed to provide the Service, resolve disputes, enforce our agreements, and comply with legal obligations. When you delete your account or disconnect an integration, we delete or anonymize associated data within a reasonable period, except where retention is required by law.

8. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing such as targeted advertising or the sale or sharing of personal information where applicable law provides those rights.

California residents may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information. To submit a request, contact contact@sorec.io. We will not discriminate against you for exercising your rights.

If you are in the EEA or UK, you may also have the right to restrict or object to certain processing, request data portability, and lodge a complaint with your local data protection authority. Where processing is based on consent, you may withdraw consent at any time. We may need to verify your identity before responding.

9. Security

We implement appropriate technical and organizational measures designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International transfers

We are based in the United States and your information may be processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction. Where required by law, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may also be communicated through the Service or by email where appropriate.

13. Contact

Winvest AI, Inc dba Sorec, 16192 Coastal Highway, Lewes, DE 19958, United States. Questions about this Privacy Policy or our data practices: contact@sorec.io.