SONIX SA

COPPA and FERPA Compliance Approach

Operational controls, evidence, and Data Processing Agreement

Version 2.0

Publication date: August 14, 2026

We will never train AI on your voice, your messages, or your content. Not by default, not with an opt-out buried in settings, not ever — full stop, no exceptions, for any user.

Audience: Schools, universities, esports organisations, partners, procurement teams, and investors

Plain-language summary How SONIX is designed and operated to support compliance with the US Children’s Online Privacy Protection Act (COPPA, 2025 amendments) and FERPA. FERPA doesn’t recognise vendor certifications — this is a compliance approach, not a certification. Annex 1 is the Data Processing Agreement (DPA) schools and esports organisations sign as part of their Institutional Customer Agreement. CONFIDENTIAL — evaluation purposes only.

Executive summary
About SONIX and the SONIX product suite
Six privacy commitments that apply to every user
COPPA — our approach for users under 13
FERPA — institutional deployments
Operational evidence available on request
Subprocessors used in the school deployment
References

ANNEX 1 — Data Processing Agreement (DPA)

1. Executive summary

Plain-language summary SONIX is built to be the most protective gaming-communication platform on the market. We don’t record voices. We don’t profile users. We don’t run targeted ads on institutional domains student accounts, ever — advertising eligibility for everyone else follows SONIX’s standard account age eligibility (13+, 16+ EEA/UK), same as the Terms of Use, no additional restriction. We never train AI on user content — full stop, no exceptions, for any user. We don’t sell data. SONIX also offers a 3D Avatar Generator, from a template or a photo/webcam; the photo/webcam option is unavailable to students and to anyone under 18, since it involves biometric data. For schools: an Institutional Customer Agreement designates SONIX a “school official” under FERPA, with a strong DPA attached. For under-13s: SONIX isn’t directed at them; we apply the 2025 COPPA standards as our floor, and go beyond them.

Part A (§§ 2–3): What SONIX is, and the commitments that apply to everyone.
Part B (§ 4): Our COPPA approach for US users under 13.
Part C (§§ 5–7): Our FERPA approach and the evidence available.
Annex 1: The DPA institutional customers sign.

2. About SONIX and the SONIX product suite

SONIX SA, Swiss company, Rue de Genève 100, 1004 Lausanne, CH-550-1185270-2. Previously TYXIT SA.

Four modules:

Pulsar — voice/text chat, group spaces (“Crews”), DMs. Voice is never recorded.
Arena — a tournament platform for third-party Tournament Organisers
Orbital — mini-games, ours and approved third-party developers’. Third-party games get only a user’s 3D gamified avatar.
SONIX 3D Avatar Generator — build an avatar from a template, or a photo/webcam capture. The photo/webcam option, which processes facial geometry, is available only to eligible adult, non-institutional accounts.
Supersonix — optional paid subscription, extras across all four modules.

All four modules are free. None require behavioural data collection to work.

Institutional deployments. Schools, universities, and esports organisations deploy SONIX under an Institutional Customer Agreement. Administrators can apply domain restrictions, manage members — but can’t read access passwords.

3. Six privacy commitments that apply to every user

Every SONIX user, regardless of age, country, or subscription — reflected in our Privacy Policy and Terms of Use, and built into our systems, not just promised in a document.

Commitment

Operational meaning

1. Voice stays private

Except if you actually run the feature yourself: Never recorded, transcribed, stored, or analysed. No voiceprints, no emotion detection, no speech-to-text . Encrypted in transit, ephemeral in processing.

2. No behavioural advertising

Never for any institutional/school account/domain. Anyone else meeting SONIX’s standard account age eligibility (13+, 16+ EEA/UK — same line as the Terms of Use) sees consented, TCF-governed ads through one vetted gaming-focused partner (Nitro/Overwolf) — never an open exchange, never a data broker.

3. No AI training on user content

No content, voice, messages, avatars, or personal data used to train AI or ML models. Aggregated, anonymised, non-personal signals only.

4. No sale of personal data

No sale, no rental, no licensing for third-party marketing.

5. Minimal data collection

Only what’s needed. No special-category data collected proactively.

6. Strong user rights

Access, correct, export, restrict, or delete via account settings or privacy@sonix.gg — 30 days, typically faster.

4. COPPA — our approach for users under 13

4.1 When COPPA applies to SONIX

COPPA (15 U.S.C. §§ 6501–6506; 16 CFR Part 312) applies to operators directed to children under 13, or with actual knowledge they’re collecting personal information from children under 13. The FTC’s 2025 amendments (Federal Register, 22 April 2025; effective 23 June 2025; compliance deadline 22 April 2026) tightened several requirements — see § 4.9.

4.2 Our position: not directed to children under 13

SONIX is designed and marketed for gamers, not children under 13. Evidence: our positioning and visual design target teens and adults; our stated minimum age (13+ globally, 16+ EEA/UK) in the ToU and Privacy Policy; the self-declared eligibility confirmation at registration.

4.3 Operational controls

Eligibility confirmation at registration. You confirm you meet the minimum age at signup; actual date of birth is collected only at specific age-sensitive moments (an age-restricted tournament, the avatar photo/webcam option), not as a blanket requirement.
Self-declaration approach. Standard industry practice for general-audience services (matching Discord’s and FACEIT’s published approach) — self-declaration, no ID verification or parental email required to register.
Parental consent at sensitive moments. FTC-accepted method for the moment: a prize claim is always the Tournament Organiser’s responsibility under the TOA, including where SONIX sponsors that Organiser — we never hold, fund, or distribute prizes ourselves, or verify this directly; a flagged account gets a manual parental review via privacy@sonix.gg.
Actual-knowledge protocol. Learn a registered user is underage, and we suspend the account, delete the data per our retention schedule (narrow abuse-prevention/compliance exceptions aside), and offer parents a manual reinstatement review.
Dedicated channels. moderation@sonix.gg for underage-user reports; privacy@sonix.gg for parental rights and COPPA enquiries.
No behavioural advertising for institutional/school accounts — ever. Our single vetted ad partner (Nitro/Overwolf) never reaches institutional/school accounts, enforced by the domain list under each Institutional Customer Agreement. Advertising to any other account follows SONIX’s standard age eligibility (13+, 16+ EEA/UK), the same line as the Terms of Use.

4.4 Voice and biometric data — explicit position

A child’s voice content is personal information under COPPA, and the 2025 amendments require operators collecting children’s audio to describe its use and confirm prompt deletion. SONIX sidesteps this entirely: we don’t record, transcribe, store, or analyse anyone’s voice. No recording, no transcription, no AI analysis, no voiceprint extraction — ephemeral, encrypted in transit. Voice on SONIX is outside the scope of the 2025 Rule’s audio-retention requirements.

4.5 No advertising, profiling, sale, or AI training of children’s data

Beyond what COPPA requires, for every user under 18: no sale, rental, or licensing of their data; no training AI/ML on their data; no disclosure to third parties beyond what’s strictly necessary to run the Service (essential hosting and payment processors, under written DPAs). Advertising to a user under 18 follows SONIX’s standard account age eligibility (13+, 16+ EEA/UK) — the same line as the Terms of Use — rather than a separate, additional restriction, consistent with the legal floor under COPPA (13) and applicable EU/UK consent-age thresholds.

4.6 Biometric data in the 3D Avatar Generator

The photo/webcam avatar option processes facial geometry, as the purpose is to create reassembled gamified 3D avatars, which falls under biometric information under the 2025 COPPA Rule, BIPA, and GDPR/FADP. Consistent with our voice position (§ 4.4), it’s never available under 18 — minors get template-only, gated by the same age signal used throughout this document. The source photo isn’t retained; it’s processed transiently and discarded once the model’s built.

4.7 Retention and deletion

Our retention schedule (Privacy Policy § 11) covers everyone. Under-18 data is kept no longer than the specific purpose requires — never indefinitely. Parents can review, request deletion, or refuse further collection via privacy@sonix.gg, identity-verified, 30-day response.

4.8 Information Security Program

A written Information Security Program under our top management: annual risk assessment, regular vulnerability scanning and third-party testing, encryption in transit and at rest, role-based access with audit logging, sub-processor oversight - privacy@sonix.gg.

5. FERPA — institutional deployments

5.1 When FERPA applies to SONIX

FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) protects “education records” tied to a student, maintained by a federally funded educational agency or someone acting for it. SONIX isn’t an educational institution — FERPA becomes relevant when a US school or university uses SONIX officially and processes student data in that context.

5.2 School-official model — explicit designation

Deployed by a US School under our Institutional Customer Agreement, SONIX operates under the “school official” exception (34 CFR § 99.31(a)(1)(i)(B)), expressly designated in the Agreement and the DPA at Annex 1, meeting all four conditions: SONIX performs a function the School would otherwise handle in-house; is under the School’s direct control over education records; is subject to § 99.33(a)’s use/redisclosure limits; and meets the criteria in the School’s annual FERPA notification for a school official with legitimate educational interest.

5.3 How SONIX operates under institutional control

The Agreement and DPA require SONIX to: process student data only on the School’s documented instructions, for the Service’s purposes; never use it for advertising, marketing, profiling, sale, or AI training; never enable advertising for any user in a School workspace, regardless of age; never redisclose it except as the School directs, to approved sub-processors, or where the law requires (with notice where lawful); delete or return the data at the end of the agreement or on request; give the School the means to access, correct, and export records on behalf of students and parents with FERPA rights; notify the School of any breach within the DPA’s timeframe; and comply with any state-specific addenda.

5.4 Data minimisation in schools

Institutional deployments don’t need academic records. We collect the bare minimum to run Pulsar, Arena, and Orbital for the workspace; no student IDs, grades, transcripts, attendance, or academic content unless the School specifically asks; workspaces are private by default (public discovery and public Crews disabled or scoped); administrative controls govern what’s shared with users outside the workspace; logs kept only as long as security and operations require.

5.5 Voice in Pulsar in school deployments

Same voice-privacy commitments apply — no recording, transcription, analysis, or biometric extraction; encrypted; ephemeral. Practically: voice isn’t part of any education record, there’s no archive a school could ever be asked to produce, and no risk it gets reused for advertising, profiling, or AI training. A real step up from commodity gaming-voice platforms used in scholastic esports, which often allow recording and storage.

5.6 Retention and deletion for schools

Schools control workspace-data retention within the Institutional Customer Agreement. Default: retained for the contract’s duration; on termination, securely deleted or anonymised within 30 days, with the option to get a structured export first. Schools can also request deletion of specific users, Crews, time periods, or content categories anytime.

5.7 Security and accountability

The Information Security Program covers school deployments: breach notification within 48 hours; annual security review on request; SOC 2 (once available) and pen-test summaries under NDA; audit rights (reasonable notice, business hours, confidential); a published sub-processor list with change notice and objection rights; and cyber-liability/E&O insurance at commercially reasonable levels.

6. Operational evidence available on request

Under NDA, for schools, partners, and procurement teams:

screenshots and demo of the eligibility-confirmation flow at registration;
technical confirmation advertising scripts never load for School workspace domains;
screenshots and demo of the in-app deletion/account-closure flow;
the published retention schedule (Privacy Policy § 11);
the current sub-processor list (sonix.gg/subprocessors);
Information Security Program summary and the Security Coordinator’s name/role;
annual risk-assessment summary and most recent pen-test summary;
the moderation procedure (notice-and-action, statement of reasons, internal complaints);
references from other school customers who consent to being named;

Contact: security@sonix.gg or sales@sonix.gg.

7. Subprocessors used in the school deployment

Current list: sonix.gg/subprocessors. Categories used in school deployments:

cloud hosting and infrastructure;
content delivery network;
transactional email (confirmations, security alerts, breach notifications);
payment processing (Supersonix only — school licences are invoiced separately);
Google Workspace (support@, privacy@, moderation@ inboxes — email content and sender identity only);
age and identity verification (sensitive moments only - for tournament registrations);
advertising (Nitro/Overwolf — general consumer product only, eligible adult non-institutional users, never enabled for or receiving data from School workspaces).

All sub-processors operate under written DPAs flowing down equivalent obligations to our own. Schools get at least 30 days’ notice of changes, with the right to object on reasonable grounds.

8. References

FTC — Complying with COPPA: Frequently Asked Questions.
FTC — COPPA Rule, 16 CFR Part 312, as amended 22 April 2025.
FTC — Verifiable Parental Consent guidance, including the 2025 expanded methods.
US Dept. of Education, Student Privacy Policy Office — Third-Party Service Provider Responsibilities under FERPA.
US Dept. of Education — FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99.
EU GDPR, Regulation (EU) 2016/679.
Swiss FADP (revised, in force 1 September 2023), and FDPIC.
EU DSA, Regulation (EU) 2022/2065.
European Commission Guidelines on the protection of minors under DSA Article 28, July 2025.

ANNEX 1

Data Processing Agreement

The following forms part of the Institutional Customer Agreement between the School and SONIX SA.

This Data Processing Agreement (“DPA”) forms part of the Institutional Customer Agreement between the institution identified in that Agreement’s cover page (the “School”) and SONIX SA (“SONIX”). Where the School is a US educational institution receiving federal funding under FERPA, this DPA also designates SONIX as a school official with a legitimate educational interest within the meaning of 34 CFR § 99.31(a)(1)(i)(B). Where the deployment involves personal data subject to the GDPR or the Swiss FADP, this DPA also serves as the data-processing agreement under Article 28 GDPR and the equivalent FADP provisions.

1. Definitions

“Student Data”. Personal information of students and other Authorised Users processed under this DPA. Where FERPA applies, includes “education records” as defined in 20 U.S.C. § 1232g(a)(4) and 34 CFR § 99.3.
“Authorised User”. A student, staff member, or other person the School authorises to use SONIX through its workspace.
“Personal Data”. As defined in the GDPR (Art. 4(1)) or the FADP (Art. 5(a)), as applicable.
“Data Breach”. A security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Student Data.
“Sub-processor”. A third party SONIX engages to process Student Data for the Services.

2. Role of the parties

The School is the data controller (and, where FERPA applies, the responsible educational agency). SONIX is the data processor (and, where FERPA applies, a school official under 34 CFR § 99.31(a)(1)(i)(B)), processing Student Data only on the School’s documented instructions. In relation to FERPA, SONIX: performs an institutional function the School would otherwise use employees for; is under the School’s direct control over education records; is subject to § 99.33(a)’s use/redisclosure requirements; and meets the criteria in the School’s annual FERPA notification for a school official with legitimate educational interest.

3. Purpose and scope

SONIX processes Student Data solely to provide, maintain, secure, and support the Services to the School and its Authorised Users, and not for any other purpose without the School’s prior written consent. SONIX shall NOT use Student Data for: advertising, marketing, or behavioural targeting of any kind; commercial profiling; sale, rental, or licensing to any third party; training, fine-tuning, or evaluating AI/ML models; developing products or services outside the Services provided to the School; or any purpose unrelated to the Services.

4. Sub-processors

SONIX may engage Sub-processors solely to support delivery of the Services. SONIX shall: maintain an up-to-date list at sonix.gg/subprocessors; bind each Sub-processor to written obligations no less protective than this DPA; give the School at least 30 days’ notice before adding or replacing a Sub-processor, with a right to object on reasonable grounds (the parties work in good faith toward a resolution, which may include termination); and remain liable to the School for its Sub-processors’ acts and omissions as if they were SONIX’s own.

5. Redisclosure and law enforcement requests

SONIX shall not disclose Student Data to any third party except: as the School directs in writing; to approved Sub-processors under § 4; or where the law requires. Where SONIX receives a legally binding request from a public authority, it shall, unless legally prohibited, give the School prompt notice and disclose only the minimum required.

6. Data minimisation, accuracy, and student/parent rights

SONIX processes only the Student Data the Services need, and gives the School tools to access, correct, export, and delete it. The School handles requests from students, parents, and eligible students under FERPA; SONIX provides reasonable assistance, including access to the relevant data and the ability to correct or delete it.

7. Retention and deletion

SONIX retains Student Data only as long as the Services or the School’s instructions require, unless the law demands longer. On the School’s request, or on termination, SONIX will, at the School’s election: return all Student Data in a structured, machine-readable format within 30 days; and/or securely delete or anonymise it within 30 days, subject to documented backup cycles and any legally required retention. Deletion requests propagate to applicable Sub-processors.

8. Security

Appropriate technical and organisational measures against unauthorised or unlawful processing and accidental loss, destruction, damage, alteration, or disclosure: encryption in transit (TLS) and at rest; role-based, least-privilege access for SONIX staff; regular vulnerability scanning and periodic third-party testing; a designated Security Coordinator.

9. Data breach notification

SONIX notifies the School of any Data Breach affecting Student Data without undue delay, and within 48 hours of becoming aware of it — describing, to the extent known, the breach’s nature, the categories and approximate number of affected Authorised Users, likely consequences, measures taken or proposed, and a contact point.

10. Audit and demonstration of compliance

SONIX makes available what the School needs to demonstrate compliance with this DPA, architecture documentation. The School (or an independent, confidentiality-bound auditor it designates) may audit SONIX’s compliance with 30 days’ notice, no more than once a year (except reasonably following a Data Breach), during business hours, without unreasonably disrupting SONIX’s operations.

11. International transfers

Where Student Data moves from a jurisdiction restricting international transfers (EEA, UK, Switzerland), the parties rely on a recognised mechanism — EU SCCs, the UK IDTA, or FDPIC-approved Swiss clauses — incorporated by reference and prevailing over conflicting DPA terms for transferred Student Data.

12. Data location

Subject to § 11: Student Data is stored in the US or the EEA/Switzerland (EU/UK/Swiss), as the Institutional Customer Agreement specifies.

13. Term and termination

This DPA runs for the Institutional Customer Agreement’s duration. Provisions that should naturally survive termination do — confidentiality, return/deletion of Student Data, the audit right (one year post-termination), liability, and governing law.

14. Governing law and jurisdiction

Governed by the School’s home jurisdiction’s law (the relevant US state; England and Wales for UK Schools; Swiss law for Swiss/EU Schools), unless the Institutional Customer Agreement says otherwise. Disputes go to the courts specified there.

15. Order of precedence

Conflicts resolve in this order: (i) any state-law addendum; (ii) this DPA; (iii) the Institutional Customer Agreement; (iv) the SONIX Privacy Policy; (v) the SONIX Terms of Use.

16. Signature

Signed electronically as part of accepting the Institutional Customer Agreement, or separately where the School requires.

Signed for the School: ______________________ Date: ___________________

Signed for SONIX SA: ______________________ Date: ___________________

‍