Privacy Policy
Last updated: 2026-07-12 · Version 0 (draft)
This policy explains how Sondara collects, uses, shares, and protects personal data. It covers three groups: (a) client users, (b) registered experts, and (c) prospective experts whose professional contact data we source from third parties and public sources before they register. Sondara is the data controller.
1. Data we collect
Client users: account and profile details, research queries, and usage/security logs. Experts: identity, contact details, employment history, biographical and expertise data, payment details, and call recordings and transcripts (which may include sensitive information). Sourced prospects: name, professional contact information, employer, and role, obtained from people-data vendors and public sources — we may hold data about people who have not registered.
2. Sources of data
We collect data directly from users and experts, and indirectly from third-party people-data/enrichment vendors, public records, and web sources. Where we obtain data indirectly, we provide notice as required (e.g., GDPR Art. 14).
3. How & why we use data (purposes and legal bases)
We use data to operate the platform: source and match experts, run compliant outreach and interactions, produce research deliverables, screen for compliance, process payments, and maintain audit and security records. Legal bases include contract, consent (for SMS/AI-voice outreach and call recording), legitimate interest (B2B expert sourcing and first-touch outreach, documented in a legitimate-interest assessment), and legal obligation.
4. Automated decision-making & AI (Sarah)
Sarah is an AI assistant that helps source, rank, message, interview, and screen individuals. These processes are substantially automated. We provide meaningful information about the logic involved, its significance, and a route to human review; we do not make solely automated decisions producing legal or similarly significant effects without a lawful basis and human oversight.
5. Multi-channel communications & consent
We contact experts by email, SMS/text, phone (including AI voice), and direct mail, and we disclose that Sarah is AI at first contact. Consent requirements by channel:
| Channel | Our commitment |
|---|---|
| Accurate headers, a physical postal address, and one-click unsubscribe honored promptly (CAN-SPAM); B2B first-touch under legitimate interest with opt-out. | |
| SMS / text | Sent only after documented express opt-in; brand/campaign registered (10DLC); STOP honored immediately; quiet hours respected. Cold-sourced experts are not texted until consent is captured. |
| Phone / AI voice | Prior express (written where required for AI/marketing) consent; do-not-call and calling-window rules honored; AI voice disclosed. |
| Call recording | All-party consent by default; a verbal recording disclosure is given at call start. |
| Direct mail | Disclosed use of sourced postal data; suppression honored. |
6. Data sharing & disclosure
We share data between clients and experts (the core purpose of the service), with subprocessors under contract, and where required for legal, compliance, or corporate transactions. We do not sell personal data.
7. Subprocessors & third-party vendors
We use vetted vendors under data-processing agreements. Categories (a current, dated list is maintained and available on request):
- Cloud hosting & storage — Application hosting and object storage.
- AI / LLM providers — Power Sarah's sourcing, messaging, and screening.
- Transactional email — Outbound and inbound email.
- SMS / A2P messaging — Text outreach (with 10DLC registration).
- Voice & conferencing — Calls and recordings.
- Transcription — Call transcripts.
- Direct mail — Physical mail outreach.
- People-data / contact enrichment — Sourcing expert professional contact data.
- Payments & payouts — Client billing and expert honoraria.
- CDN / security — Content delivery and security.
8. International transfers
Where we transfer data outside the EEA/UK, we rely on appropriate safeguards (e.g., Standard Contractual Clauses / UK IDTA). [Attorney review required.]
9. Retention
We retain data for as long as needed for the purposes above and to meet compliance and audit obligations (expert-network norms include multi-year retention of consultation records), balanced against data-minimization principles, then delete or de-identify it.
10. Your rights
Depending on your location you may have rights to access, correct, delete, restrict, port, or object to processing (including profiling) of your data (GDPR), and to know, delete, correct, and opt out of sale/share or limit use of sensitive information (CCPA/CPRA). We respond within the timeframes the applicable law requires.
11. Opt-out for sourced (non-registered) experts
If we hold your professional contact data and you never registered, you may request that we stop outreach and delete your data, free of charge, using the contact below. We honor such requests and add you to our suppression list.
12. Security, children & changes
We apply reasonable technical and organizational safeguards and notify of breaches as required. The service is not directed to minors. We may update this policy; material changes will be notified. Contact: privacy@sondarainsights.com (placeholder). California and other regional disclosures are provided where applicable.