Privacy Policy

Version 6. Effective October 25, 2026.

Sondola Inc., a Delaware corporation ("Sondola", "we", "us"), operates Sondola, a metrics dashboard that reads business data from tools a company already uses and shows it back to them.

Read this first. This notice covers data we decide how to handle: your account, your use of the product, our website, program applications, billing once it opens, and messages you send us. It does not govern the business data we read from your connected tools. That data belongs to the customer whose workspace it is in. We process it only on their instructions, under our Terms of Service and our Data Processing Addendum at https://sondola.com/legal/dpa, which applies to every customer automatically. Section 3 explains the difference.

About the "In short" summaries. Sections marked In short are plain-English summaries. They do not change what this notice says. Where a summary and a section differ, the section governs.

1. The short version

In short.

• We keep business metrics from the tools you connect, such as totals, rates, balances and time series. Not individual records about your customers.
• When you connect a bank, card or accounting tool, we also keep each spending line: its date, amount, payee or account name and category. When you connect an AI or cloud provider's costs, we keep cost and usage by model, project and key. Section 4.3 has the detail.
• Not sold. We do not sell or share your personal information, and we do not share it for cross-context behavioural advertising.
• Not used to train AI. We do not train any AI model on your data, and our contracts with AI providers prohibit them from training on what we send.
• Read-only. Sondola does not change or delete your data in the tools you connect. Section 6.3 names the two things that are not reads.
• We do not use one customer's data to serve, benchmark or improve anything for another customer.
• Our staff can reach customer data only for support, security, a defect, at your request or where the law requires, behind multi-factor authentication and recorded in an audit log.
• Yours to take or delete. You can export everything, and delete everything, from inside the product.

2. Who we are and how to contact us

Sondola Inc., a Delaware corporation, is the controller of the personal data this notice covers.

• Privacy questions and requests about your data: privacy@sondola.com
• Security reports: security@sondola.com
• Legal notices: legal@sondola.com

Every right described in this notice can be exercised by email, and we answer to the timetables in section 12.

3. Three kinds of data, and our role in each

We are not the controller of your business metrics. The customer is. If you are an individual whose data reached us through a customer's connected tool, or as the recipient of a customer's investor update, that customer decides what happens to it. Contact them, and we will help them respond.

4. What we collect

4.1 You give us. Name, work email address, password (stored only as a hash), multi-factor enrolment, company name, workspace and metric settings, goals and notes you write, readings an owner or manager types in (labelled Typed in), invitations you send, feedback and any screenshot you attach to it, and support correspondence.

4.2 We collect automatically. IP address, browser and device type, pages and features used, timestamps, referring page, request and error logs, session and authentication events, and the identifiers our infrastructure needs to route and secure a request.

4.3 From your connected tools. Business metrics, on the schedule shown on each connector's page.

When you connect a bank, card or accounting tool, such as Mercury, Brex, QuickBooks Online or Xero, Sondola also stores each spending line: the date, the amount, the payee or account name and its category, so it can show spend by category and by vendor. When a bank or card gives no payee, we keep its description of the payment instead. A payee can be a person, such as a contractor you pay. We keep that name because your bank or books record it, and only to show your spend by vendor.

When you connect an AI or cloud provider's costs, such as OpenAI usage and costs, Google Cloud billing or AWS costs, Sondola stores cost and usage by model, project and key, with the names the provider gives them. We do not keep who created a key or who made a request.

We also cache the raw response from a connector for a short period so that a parsing error does not cost you a day of data. See section 6.4.

4.4 Sondola for Startups applications. If you apply to Sondola for Startups, we collect what you tell us about your company: its legal name, website, total amount raised, headcount, and the name and role of the person certifying, together with any evidence you give us if we ask for it. We check eligibility only against what you tell us and public sources, such as press coverage, company registries, SEC Form D filings, public funding databases and your company's own website. We never use data from your connected tools to check eligibility.

4.5 Payments. Sondola does not take payments yet. When paid plans become available, our payment processor, named on our Subprocessors page before it handles any data, will collect your card details directly. We will not receive or store full card numbers. We will receive only the billing name, billing email, billing address, the last four digits and expiry date of the card, and payment status, so we can keep records and handle billing questions.

4.6 What we do not collect.

• We do not collect full payment card numbers.
• We do not use advertising or cross-site tracking cookies, on our website or in the product.
• We do not buy data about you from data brokers.
• We do not collect biometric data, precise geolocation or any special category of data.
• We do not keep individual-level records about your customers from your connected tools. Some tools only give their figures as a list, such as subscriptions and charges in a billing tool. We count those lists as we read them and keep only the totals. Spending lines are payments your company made, not records about your customers.

4.7 The public demo. Each visit to the public demo uses a temporary guest account with an address that cannot receive mail. A job that runs every 15 minutes deletes that account soon after the visitor leaves, after two hours idle, or once it is 24 hours old.

The public demo stores a random ID in your browser's local storage only to limit how often the demo can be opened. We treat it as strictly necessary to protect the demo from abuse, and we use it for nothing else. It is sent with each request to open the demo. We do not store your IP address or that ID as they are. We store two one-way hashes made with a secret key, one of your IP address and one of your IP address together with the ID, with the time of the visit and the link you came from. We use them only to limit how often the demo can be opened.

5. Why we use it, and on what basis

Where we rely on legitimate interests, you may object, as section 12 explains. Where we rely on consent, you may withdraw it at any time.

6. Connected accounts, in detail

6.1 How a connection works. You authorise a connection with your own credentials, through the provider's own sign-in screen or by pasting a key you create in that tool. We request the narrowest permission the provider offers, and where a tool offers a read-only key, the guide asks for that one. Some tools only issue keys that could also write. Sondola uses those only to read. We store the credential encrypted in a secrets vault, separate from the application database, so that access to the database alone does not yield a working credential. Our systems are designed so that credentials are not written to application logs or error reports.

6.2 What we read. Business metrics: installs, active users, retention rates, revenue, subscription counts, cash balance, net burn, advertising spend and impressions, search impressions and clicks, and similar. From banks, cards and books, spending lines with the payee or account name, for spend by category and vendor. From AI and cloud providers, cost and usage by model, project and key. Each connector's page in the product lists what it reads and how often, and that list is the authoritative one.

6.3 Read-only, with two stated exceptions. Sondola reads from your tools. It does not change or delete anything in them. We do not use what we read from your tools for any purpose other than providing the product to you. Two things are not reads:

• The Google Cloud billing connector runs one query a day in your Google Cloud project to read your costs. Google may bill you for that query under your agreement with Google.
• The Slack digest posts the messages you set up to the channel you choose. Slack is a destination you add, not a tool we change.

6.4 The raw response cache. We keep the raw response from a connector for no more than 30 days, so that a bug in our parsing can be fixed without another call to a provider that limits how often we may call it. A daily job deletes anything older, and deletes a disconnected source's cached responses outright rather than waiting.

6.5 Revoking. Disconnect inside the product, or revoke at the provider. Either way we stop collecting, the connection is retired so no scheduled job can use it again, and the raw responses we cached from it are deleted within 30 days. We do not yet revoke the credential at the provider for you. That is your step, and the product tells you where to take it for each connector. We will update this section if we start doing it. The metrics already in your dashboard are yours and remain until you delete them.

6.6 Provider commitments we are bound by. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We handle Apple App Store Connect and Apple Ads data solely as your service provider and disclose it to no one else. We process Meta Platform Data only for Meta's permitted purposes and do not sell or re-identify it. We do not train a large language model on Slack API Data and do not use one organisation's data to benefit another.

6.7 Deleting your data. You can delete a metric, a connection or your whole workspace from inside the product at any time. To ask us to do it for you, email privacy@sondola.com. Section 9 gives the timetable.

7. AI features

7.1 Some features use a large language model to make suggestions, for example which events in a connected tool could define a metric.

7.2 If your workspace adds its own AI key, requests go to that provider under your account and your agreement with it. That provider is your vendor, not ours.

7.3 If a feature runs on a model we selected, the provider is our subprocessor and is named on our Subprocessors page before it receives anything. Today, connector suggestions send only the names of events recorded in your connected tool and your workspace's metric definitions. They do not send figures or credentials. If that changes, we will update this notice and the Subprocessors page first.

7.4 No training. We do not use your data to train, fine-tune or evaluate any AI model. Our contracts with AI providers prohibit them from training on what we send.

7.5 No automated decisions. We do not use AI or any other automated processing to make decisions about you that have legal or similarly significant effects.

8. Sharing

We share personal data only in these cases.

8.1 Subprocessors. Vendors that process personal data on our behalf, under written contracts that limit them to doing so on our instructions. The current list, with each vendor's purpose, data and location, is at https://sondola.com/legal/subprocessors. We give at least 30 days' notice by email before a new subprocessor starts handling Customer Data, and customers may object as that page describes.

8.2 At your direction. When you create a share link, email an investor update, connect Slack, or point an AI assistant at your workspace, you instruct us to send data to a destination you chose. Those recipients are not our subprocessors. We did not select them, we do not control them, and their handling of the data is governed by your relationship with them.

8.3 Legal. Where required by valid legal process, where necessary to establish or defend a legal claim, or to protect someone's safety. We will tell the affected customer before disclosing unless the law forbids it.

8.4 Corporate change. In a merger, acquisition or sale of assets, subject to this notice continuing to apply. We will give notice before your data becomes subject to a different policy.

8.5 We do not sell. We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act. If that is ever to change, we will give at least 30 days' notice and an opt-out first.

9. How long we keep things

Agreement records. We keep a record of which versions of the Terms of Service and this Privacy Policy an account accepted, and when, without storing the IP address. Unlike the rest of your Account Data, it is not erased when the account is deleted. It stays for 6 years after the deletion, holding only the account's internal ID, the versions and the times, and no name or email address, so that we can show what was agreed. After 6 years a daily job deletes it.

We will delete sooner on request, except where the law requires us to keep something. If we must keep something you asked us to delete, we will tell you what and why.

10. Security

• Encryption in transit (TLS) and at rest.
• Connected-tool credentials stored encrypted in a secrets vault, separate from the application database.
• Isolation between workspaces enforced by row-level security in the database, designed so that one workspace cannot read another workspace's data, and checked by automated tests.
• Multi-factor authentication required for staff access to production and to the internal admin console.
• Staff access to customer data limited to support you asked for, security incidents, defects, your specific request or a legal requirement, and recorded in an audit log that is append-only and not editable through the application.
• Share-link, investor update and API tokens, including each recipient's own update link, stored as hashes. We do not store the token itself, and our systems are designed not to write it to logs.
• The narrowest permission each connected tool offers, read-only wherever the tool has it.

More detail is on our Security page at https://sondola.com/security.

What we do not claim. We do not hold SOC 2 or ISO 27001 certification and have not completed a third-party penetration test. Our infrastructure providers hold their own certifications. Those are theirs, not ours, and we do not present them as ours. No system is perfectly secure, and we do not claim otherwise.

11. If something goes wrong

If we determine that a security incident has affected personal data in a customer's workspace, we will notify that workspace's administrators without undue delay and in any case within 72 hours of that determination. We will tell them what happened, what data was involved, what we have done and what we recommend they do. Where we are the controller, we will notify regulators and individuals where the law requires it. To report a security issue, email security@sondola.com.

12. Your rights

Depending on where you live, you may have the right to know what we hold, get a copy in a portable format, correct it, delete it, restrict or object to processing, opt out of sale, sharing, targeted advertising or profiling, withdraw consent, and appeal a decision we make about your request. We will not discriminate against you for exercising a right.

How to exercise them. Many are available directly in the product under Settings. Otherwise email privacy@sondola.com.

How fast we answer. We acknowledge requests within 10 business days. If you are in the European Economic Area, the United Kingdom or Switzerland, we answer within one month of receiving your request, and may extend by up to two further months for complex or numerous requests, telling you why within the first month. If you are in a US state with a privacy law, we answer within 45 days, and may extend once by a further 45 days where reasonably necessary, telling you why within the first 45 days.

Checking it is you. We match requests to your account, for example by asking you to confirm from your account email address. We ask for more only where we cannot otherwise link the request to you, and we use what you give us only to check the request.

Authorised agents. You may use an authorised agent to make a request for you. We may ask the agent for your signed permission and ask you to confirm your identity directly with us, unless the agent holds a power of attorney that the law recognises.

Appeals. If we decline a request, you may appeal by replying to our response. We will answer within 45 days, and may extend by a further 60 days where the law allows, telling you why. We will tell you how to complain to your state Attorney General or data protection authority.

Complaints. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your data protection authority.

If your data reached us through a customer. We are the processor. Send your request to that company. If you send it to us, we will pass it on promptly and help them answer.

13. California and other US states

This section is our notice at collection for California residents, and applies to the Account Data and website data for which we are the business.

Section 9 says how long we keep each kind of data.

Not sold or shared. In the past 12 months we have not sold or shared personal information, as those terms are defined in the California Consumer Privacy Act, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link.

Sensitive personal information. The only sensitive personal information we collect is your account log-in. We use it only to sign you in and keep your account secure, and not to infer characteristics about you, so there is nothing to limit.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

Global Privacy Control. We honour Global Privacy Control signals. Section 16 explains how.

14. International

We are based in the United States. Account Data and Customer Data are stored at rest in the United States, in Amazon Web Services region us-west-1 through Supabase. Requests to our website and app may pass through edge servers of our hosting and network providers in other countries. The Subprocessors page gives each vendor's location.

When we receive personal data from the European Economic Area, the United Kingdom or Switzerland as a processor for a customer, the transfer is covered by the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, both incorporated in our Data Processing Addendum at https://sondola.com/legal/dpa. Our transfers to our own subprocessors are covered by their data processing terms, which include the same clauses where required.

Where you give us your own Account Data directly from outside the United States, we process it in the United States as this notice describes.

15. Children

Sondola is for businesses and is not directed to anyone under 18. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we will close that user's access and delete their data. Tell us at privacy@sondola.com if you believe this has happened.

16. Cookies, analytics and your choices

Our Cookie Notice at https://sondola.com/legal/cookies describes everything we store in your browser. In summary:

• Strictly necessary. The product at app.sondola.com uses cookies or browser storage that are strictly necessary to sign you in and keep your session secure. Your cookie choice is stored in your browser so we can respect it. The public demo stores the random ID described in section 4.7.
• Optional analytics. On the marketing site at sondola.com only, PostHog provides product analytics and session replay, each only with your consent. Both are off until you turn them on. We keep your choice for six months, and the Cookie choices link in the footer of any page changes it at any time. PostHog does not run inside the product at app.sondola.com.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and do not ask.
• Do Not Track. We do not track you across other websites, and no advertising technology runs on our website or in the product. We do not respond to the older Do Not Track signal separately, because there is no cross-site tracking for it to stop.

17. People who receive an investor update

When a customer emails an investor update from Sondola, the customer is the controller of its recipients' personal data, and we process it as the customer's processor (see section 3). We process the recipient's email address and, each time the page behind their link is opened, the date and time.

As a security measure to protect the update, the product checks whether a link may have been forwarded. For that check only, we keep a one-way fingerprint made from a secret key, the link, the first part of the network address (not the full IP address) and the type of device. It cannot be turned back into an address, cannot be matched across links, and is erased after 30 days. We do not record a reader's full IP address, location or what they do on the page. The product is designed not to record opens by the customer's own team or by automated mail scanners. The page tells the reader that the sender can see when it is opened. Questions about an update should go to the customer who sent it.

18. Changes

We will post any change here with a new effective date. For a material change we will give at least 30 days' notice by email and in the product before it takes effect, and the change will apply only from then on. Every prior version stays listed at the end of this page.

What changed in version 6

• Sondola Inc., a Delaware corporation, is named as the controller. All contact is by email.
• The Data Processing Addendum is published at https://sondola.com/legal/dpa and applies to every customer automatically.
• New sections cover Sondola for Startups applications (4.4), payments once billing opens (4.5), AI features (7), California disclosures with a category table, sensitive personal information and Shine the Light (13), and a Cookie Notice (16).
• The read-only promise now names its two exceptions: the daily Google Cloud billing query and the Slack digest.
• The demo ID is used only to limit how often the demo can be opened, and no longer to count visitors.
• The investor update forwarding check is described as a security measure, and the customer is named as controller for its recipients.
• Response times now follow each law: one month for the EEA, UK and Switzerland, and 45 days for US states. Authorised agents are covered.
• The retention table now matches the Terms of Service, and adds billing records and program records.
• International transfers now say data at rest is in AWS us-west-1 and requests may pass through edge servers worldwide.
• Security statements are worded more precisely, and notice of a new subprocessor is 30 days in every case.

Previous versions: version 1, published September 1, 2026. Version 2, published September 15, 2026, named PostHog, split analytics from session replay as separate choices, and stated that we do not sell or share personal information. Version 3, published September 24, 2026, added how we handle people who receive an investor update, guest accounts in the public demo and the record of what each account agreed to. Version 4, published September 24, 2026, removed wording that only applied to a paid service, named Typed-in Data as the Terms did, and said the record of what each account agreed to is kept for 6 years after the account is deleted. Version 5, published September 25, 2026, described the spending lines and AI cost data the product keeps and the random ID the public demo keeps in your browser. Version 6 is described above.