Privacy Policy

Herais International (“Socratopia”, “we”, “us”) operates https://www.socratopia.ca (the “Service”). This Privacy Policy explains what personal information we collect, why we collect it, how we use, protect, retain and delete it, and the rights you hold. It is drafted to comply with Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws, and applies wherever you access the Service from.

By using the Service you consent to the practices described here. If you do not agree, please do not use the Service. This Policy forms part of our Terms and Conditions.

We collect only the information needed to operate the Service:

• Account data: your name, email address and a password, which is hashed with a strong one-way algorithm before storage - we never store or transmit passwords in plain text.
• Library and usage data: saved terms, bookmarks, reading history and membership status, so the product can pick up where you left off.
• AI conversation data: the messages, persona and dictionary choices, and image files you send to THARA or NOVO, together with the generated answers and cited sources. Conversations of signed-in members are stored so you can reopen them; conversations of signed-out visitors are kept only in your own browser and are never written to our database.
• Correspondence: anything you send through the contact form or to us directly, kept to respond to you and to maintain records.
• Technical data: standard server logs and diagnostics (such as request metadata and error reports) used to secure, debug and improve the Service.
• Essential cookies: a single session cookie that keeps you signed in - see our Cookie Policy.

We use personal information only for the purposes for which it was collected:

• authenticating you and securing your account and member-only content;
• providing the dictionaries, reader, bookmarks and AI assistants, including grounding and citing answers;
• responding to your requests, questions and support messages;
• administering subscriptions and meeting accounting, tax and legal obligations;
• protecting the Service against abuse, fraud and security incidents;
• maintaining, debugging and improving the Service, in aggregate or pseudonymised form where possible;
• notifying you of material changes to our policies or the Service.

Our lawful bases for processing include your consent, the performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating and securing the Service.

We do not sell your personal information. We do not rent or trade it, we do not build advertising profiles from it, we do not share it with advertisers or data brokers, and we do not use third-party advertising or cross-site tracking technologies on the Service.

We disclose personal information only in these limited circumstances:

• Service providers: trusted infrastructure and processing providers (hosting, AI model serving, email delivery) that act on our instructions, under contractual confidentiality and security obligations, and only to the extent needed to perform their function.
• Legal requirements: where disclosure is required by subpoena, court order, warrant or other valid legal process, or where we reasonably believe disclosure is necessary to comply with law, protect our rights or property, prevent fraud, or protect the safety of any person.
• Corporate transactions: in connection with a merger, reorganisation or sale of assets, subject to this Policy remaining applicable to your information.
• With your consent, or at your direction.

When you chat with THARA or NOVO, your messages and any uploaded images are processed by the language-model infrastructure we operate or contract with, in order to generate grounded answers from the Socratopia dictionaries. Do not submit confidential information, personal data about other people, or anything you would not want processed for this purpose. We do not use your conversations for advertising. Aggregate, de-identified insights may be used to improve the Service.

We retain personal information only as long as necessary for the purposes described in this Policy: account data for the life of your account; conversation and library data while your account is active or until you delete it; correspondence and transaction records for the periods required by applicable accounting, tax and limitation laws; and server logs for limited diagnostic and security windows. When information is no longer needed, we delete it or render it de-identified.

The Service is served exclusively over encrypted HTTPS. Passwords are stored only as strong one-way hashes. The session cookie is HTTP-only and marked secure, member-only books are gated behind authenticated accounts, and access to production systems is restricted to authorised personnel. We apply administrative, technical and physical safeguards proportionate to the sensitivity of the data.

No method of transmission or storage is perfectly secure. While we work hard to protect your information, we cannot warrant absolute security, and you remain responsible for keeping your credentials confidential.

Your information is processed on infrastructure operated by or for us, which may be located outside Canada. Where personal information is transferred across borders, it may be subject to the lawful access requirements of that jurisdiction. We take reasonable contractual and technical measures so that protection comparable to this Policy follows your data.

Subject to applicable law, you may:

• access the personal information we hold about you and request corrections;
• delete saved terms, bookmarks and conversations at any time while signed in;
• request deletion of your account and associated personal data;
• withdraw consent to non-essential processing, understanding this may end our ability to provide certain features;
• complain to the Office of the Privacy Commissioner of Canada or your provincial regulator if you believe your privacy rights have been breached.

To exercise any of these rights, contact us. We will verify your identity, respond within the timeframes required by law, and provide reasons where a request is refused (for example, where retention is legally mandated). There is normally no fee.

The Service is not directed to children under the age of majority, and we do not knowingly collect their personal information. If you believe a child has provided us personal data, contact us and we will delete it.

The Service may link to third-party sites and embed third-party media for playback. Those services have their own privacy practices for which we are not responsible. This Policy applies only to information collected by the Service.

We may update this Policy at any time; the current version is always published on this page. Material changes will be highlighted in the Service or notified to signed-in users where appropriate. Continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

Privacy questions, access or deletion requests, and complaints can be sent through the contact form. We will acknowledge requests promptly and handle them in accordance with applicable law.