1. Who handles your request
The data controller for everything described here is SoKKoS AI — eenmanszaak (sole proprietorship in the Netherlands), KvK 42029374, BTW-id NL005441743B74, Beuningen, Gelderland, NL. Contact: hello@sokkosai.com. We answer GDPR requests ourselves — there is no third-party processor handling them on our behalf.
2. Your rights at a glance
Under the EU General Data Protection Regulation (GDPR), Articles 15–22, you have six rights over the data we hold about you. They apply whether you're an EU/EEA resident or not — we extend them to everyone.
- Access (Art. 15)Ask what we have on you.
- Rectify (Art. 16)Fix anything wrong.
- Erase (Art. 17)Delete your account and data.
- Restrict (Art. 18)Pause processing while a question is open.
- Port (Art. 20)Get a machine-readable copy of your data.
- Object (Art. 21)Object to processing based on legitimate interest.
3. How to exercise each right
Most of these are self-service. For anything that isn't, send a one-line email to hello@sokkosai.com with the suggested subject line. We don't need a form — we just need to know which right you're invoking.
We may ask you to confirm the request from the email on file (to make sure someone else isn't trying to access your data). That's the only verification step.
4. Our response time
We respond to GDPR requests within 30 days, as required by Art. 12(3). In practice we aim for under a week. If a request is unusually complex, we may extend by up to two months and we'll tell you why before doing so.
No fee for the first request. Manifestly unfounded or repetitive requests may incur a reasonable fee (Art. 12(5)) — this has never happened.
5. Data export
Self-service: go to /dashboard/export and click “Export everything”. You get a tarball with:
- A JSON file of every record we hold about you (auth, billing metadata, dashboard settings).
- The Docker compose for your agent container.
- A SQL dump of your agent's database (skills, crons, history, embeddings).
Files are signed and time-stamped. If anything looks missing, email us with “GDPR: access” and we'll regenerate it within 30 days.
6. Account deletion
Self-service: /dashboard → Settings → “Delete account”. We:
- Stop the next billing renewal immediately.
- Keep your VPS available for 14 days so you can still export.
- Destroy the VPS and the auth record on day 15.
- Retain only the legally required payment records (7 years, Dutch tax law).
After day 8 there is nothing left to recover. If you change your mind on day 9, you'll have to start over with a new account.
7. Right to lodge a complaint
If you think we haven't handled your data properly and we can't resolve it by email, you can complain to the Dutch supervisory authority:
Autoriteit Persoonsgegevens
Bezuidenhoutseweg 30, 2594 AV The Hague, NL
autoriteitpersoonsgegevens.nl
Last updated 2026-05-27
You can also lodge a complaint with the supervisory authority in your EU/EEA country of residence if it differs from the Netherlands.