Privacy policy

Who is responsible

Sonar is currently an invite-only service run by the team that operates it at usesonarnow.com, and that team is responsible for the personal data described here. The legal entity and a dedicated privacy contact will be named on this page before Sonar is offered to the public. Until then, send privacy requests through the person who invited you; they can reach the team directly.

Account and workspace data

When you sign in we process your email address and the one-time sign-in link our authentication provider sends to it. For owners and operators we also process the second-factor (TOTP) enrollment. We store your workspace name, your membership and role, the businesses and website hosts you add, and the business profile you fill in, such as markets, languages and competitors.

Website and search data

• Crawl results: Sonar's crawler, which identifies itself as SonarBot, fetches public pages of the sites you connect and stores the checks, scores and page facts it derives.
• Google account (optional): for the sites you choose, daily Search Console performance rows (search queries, pages, clicks, impressions and average position), Google Analytics 4 reports, Business Profile locations and Merchant Center products. Access is read-only, except that Sonar adds a Search Console verification for your domain when you ask it to. The access tokens are stored encrypted.
• Bing AI Performance: the rows of the CSV files you upload, with the ID of the user who uploaded them.
• Edge traffic counts: if you install the Sonar edge worker, it counts visits by known AI crawlers and referrals from known AI assistants per day, with masked page paths. If you turn on conversion counting, it also counts conversions by visitors who arrived from an AI assistant, as daily totals per landing page, using an attribution token added to your internal links. It does not store visitor IP addresses, full user agents, query strings, full referrers or order IDs, and visits that do not come from an AI crawler or AI assistant create no record.
• WordPress plugin: its crawler log stores no IP addresses, full user agents or cookies. An optional reverse-DNS check keeps a salted hash of the IP address for 24 hours, and log rows are kept for 30 days.
• Mailbox outreach (optional): if you connect a Gmail or Microsoft 365 mailbox, Sonar sends outreach emails from it with send-only permission and cannot read it. Replies go to a Sonar reply address, are classified (for example an opt-out) and forwarded to you. For this it stores the people it contacts (names and work email addresses published on public web pages), the messages sent, a short classification of each reply (not its text), and a permanent do-not-contact list.
• Publishing and hosting connections (optional): the Vercel integration, GitHub, Shopify, Webflow and other CMS or DNS providers you connect, used to read your site's setup and apply approved changes; and Vercel or Netlify log drains, which send records of crawler visits. Per-visit crawler rows, which can include the crawler's IP address, are kept for up to 400 days; daily totals are kept.

Search queries, page text and outreach contacts can contain personal data about other people. For that data, you decide what is processed, and Sonar processes it on your behalf only to provide the service to you.

Connection credentials

Credentials you give Sonar to act on your site, such as a WordPress application password, are encrypted with AES-GCM using a separate data key for each workspace. That key is wrapped by a master key kept in Cloudflare's secret storage, never in the database, and the master key is not part of backups.

Data from Google APIs

Sonar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google account is used only to provide the features you turned on. It is not sold, not used for advertising and not used to train general AI models, and people at Sonar read it only with your permission, for security, or when the law requires it.

Approvals and audit trail

Sonar records who approved, rejected or rolled back each change, and why. The audit log is append-only: its entries cannot be edited or deleted, and it is kept when a workspace is closed (see below).

Free scan and report requests

The free scan stores the scanned host, the day and the language you used, together with the indicative report. It is not linked to any person. Your IP address is used only as a one-way hash to limit how many scans one network can start, and it is not stored.

If you ask us to email you a report, we store your email address, the scanned host, your language, the time you gave consent and the version of the consent text you saw. We use them only to send you that report and occasional news about Sonar. You can ask us to delete them at any time through the contact under “Who is responsible”.

Cookies and browser storage

Sonar sets four first-party cookies, all SameSite=Lax and, on https, Secure. After you sign in: sonar_session holds your sign-in token for one hour, sonar_refresh renews it for up to 30 days, and sonar_ws remembers the workspace you selected for 30 days; all three are HttpOnly. sonar_lang remembers the interface language for one year and is also set for visitors who are not signed in when a page opens in a chosen language. Your theme choice is kept in your browser's local storage. Sonar uses no analytics, advertising or tracking cookies or scripts. The site's fonts are loaded from Google Fonts, so your browser sends its IP address to Google when it fetches them.

Service providers

• Supabase: database, sign-in links and second-factor checks, hosted in the ap-south-1 region (Mumbai, India). Calls to the Bing Webmaster API are relayed through a Supabase function.
• Cloudflare: hosting of this website and of Sonar's back end (Workers and Workflows), file storage and backups (R2), rate limiting, browser rendering for crawls, text embeddings (Workers AI), custom hostnames for the optional edge worker, DNS lookups, and the AI Gateway through which every call to an AI provider is routed. The AI Gateway keeps logs of prompts and answers.
• OpenAI, Google (Gemini), Perplexity and Anthropic (Claude, reached through OpenRouter): answer the category and brand prompts that measure how often AI assistants cite your site. These prompts can name your business and its category.
• Google (Gemini) and OpenRouter (models from OpenAI and Anthropic): draft content and check its quality. A request can include a page's address, title and main text, your brand name, facts you provided, competitors and source excerpts.
• Google Search Console, Google Analytics, Business Profile, Merchant Center, YouTube Data, PageSpeed Insights and Chrome UX Report APIs, the Bing Webmaster API and IndexNow: to read search and performance data for your sites and to tell search engines about changed pages.
• DataForSEO and Bright Data: search results, AI Overviews and AI Mode answers, keyword volumes and backlink data for the queries and domains Sonar tracks for your sites. Requests contain keywords, domains and markets, not data about you.
• Google (Gmail) and Microsoft (Microsoft 365): only if you connect a mailbox for outreach, with permission to send only. Resend: delivers emails sent by Sonar itself, such as operational alerts, and receives replies to outreach emails so they can be forwarded to you.
• Vercel, Netlify, GitHub, Shopify, Webflow and other publishing, hosting or DNS providers: only the ones you connect, to read your site's setup, receive log drains and apply approved changes. Vercel can also host this website; today it only redirects to this address.
• Slack and Microsoft Teams: only if a workspace owner adds a webhook; Sonar then posts that workspace's notifications there.
• Google Fonts: serves this website's fonts; your browser requests them directly from Google.
• Telegram: operational messages to the Sonar team only.

How long we keep data

Database backups are exported weekly, with daily incremental exports, and deleted after 90 days. Cloudflare keeps workflow run history for 7 days, and error logs are kept for up to 30 days. A weekly job deletes operational events after 180 days, per-visit crawler rows after 400 days, search ranking rows after 730 days, raw edge traffic files and old scan documents after 90 days, and page snapshots kept as proof after 400 days. Scores, AI-answer measurements, cost records and the audit log are kept while your workspace exists; the audit log is kept longer, as described below. Report requests from the free scan are kept until you ask us to delete them.

Disconnecting a site and closing a workspace

When you disconnect a site, Sonar stops all automation for it and deletes the credentials it stored for that site at once. The site's measurement history and the audit trail are kept while your workspace exists.

When the owner closes a workspace, all automation stops and every stored credential is deleted at once, and Sonar exports the workspace data as a JSON file the owner can download. 30 days later the workspace data and the export are deleted. Copies in database backups expire with the backups themselves.

The audit log of approvals, changes and account actions is not deleted when a workspace is closed: it is kept as evidence for at least four years to meet legal and accounting retention duties.

Where data is processed

The database is hosted in India (Supabase region ap-south-1). Cloudflare and the other providers listed above process data on their own networks, which can be outside your country. There is no EU data residency option today. The safeguards for these transfers will be described here after legal review.

Your choices and rights

You can ask for a copy of your data, for corrections or for deletion through the contact under “Who is responsible”. A workspace owner can also export the workspace data and close the workspace from Settings. We answer within the time the law that applies to you requires.

Changes to this policy

We will publish changes on this page and, for material changes, tell signed-in users before they take effect.