Privacy Policy

Last Updated: April 9, 2024

1. Revisions to this Privacy Policy

Any information collected is covered by the Policy in effect when collected. Material changes trigger notification via the Services or email, with the "Last Updated" date updated accordingly.

2. Scope of the Privacy Policy

This Policy applies to all Service users including visitors, account holders, trial customers, paying customers, and communication recipients. The Policy does not cover "Customer Data" that clients collect through Sona's platform — those activities are governed by customers' own privacy policies and contractual agreements with Sona.

3. Information That We Collect

Information Provided Directly

Sign Up Information: Account creation requires name, email address, employer/company name, website, and phone number.

Through Communicating with Us: Contact submissions, survey responses, and feedback may include name, email, phone, address, payment information, and identifying details.

Purchase and Payment Information: Order records, transaction history, and payment details are retained. Financial information transfers to third-party processor Stripe; Sona doesn't retain credit card numbers directly.

Through Interactive Features: Information submitted via messaging, comments, or social features is collected.

Contact Information of Others: Referral program data and contact information of other individuals may be collected with appropriate consent.

Job Applications: CV, cover letter, and application materials are collected for recruitment assessment and monitoring purposes.

Information Collected Automatically

Information Sent by Your Device: IP address, user agent, network connectivity, device identifiers, advertising identifiers, language preferences, software versions, hardware models, and usage information.

Location Information: IP address conversion to approximate geolocation or precise location via browser settings.

Information Collected Using Cookies and Other Web Technologies: Automated collection tools including cookies, web beacons, and pixel tags track user authentication, security, advertising delivery, site analytics, and fraud prevention.

Cookie Categories:

Necessary Cookies: Site operation and security risk prevention.
Performance Cookies: Usage analytics and performance improvement.
Preference Cookies: Settings and preference retention.
Marketing Cookies: Advertisement delivery and campaign efficiency tracking.

Interaction Data: Actions performed while logged into accounts are recorded.

Information From Third Parties

Affiliates, joint marketing partners, lead providers, fraud vendors, and identity verification services may supply Customer information.

4. How We Use the Information

Primary goals are providing and improving Services, customizing content, administering accounts, and enabling navigation. Uses include:

Providing Services and customer support.
Resolving disputes and processing payments.
Managing business operations including auditing, fraud prevention, and Terms compliance.
Customizing experiences and improving content.
Sending relevant promotional communications (with opt-out availability).
Enforcing agreements and sending notices.
Understanding Customer interests and demographics.
Contextual ad customization.
Compliance auditing and detecting security incidents.

De-identified and aggregated information creation is permitted. Uses disclosed at collection time or with consent are also permissible.

5. Information We Share with Third Parties

Service Providers and Business Partners: Web hosting, cloud providers, fraud detection, identity verification, and customer support partners receive Personal Data for operational purposes.

At Your Request: Information sharing occurs when Customers request it, such as through referral features or promotional offers.

Other Third Parties: De-identified or aggregated transaction information, location data, device information, and market analysis may be shared.

Subsidiaries and Affiliates: Corporate entities receive information for administrative purposes including IT management and compliance.

With Your Consent: Third-party sharing receives notification and consent.

Web Analytics Services:

Google Analytics: Usage data collection for engagement tracking; opt-out available at Google's tracking preferences page.
Segment: Analytics regarding Site and Services interactions; opt-out via persistent cookie at Segment's documentation page.

Business Transactions: Mergers, acquisitions, asset sales, or bankruptcy proceedings may transfer Personal Data to acquirers.

For Protection: Law enforcement cooperation and legal compliance may trigger disclosure to government officials or private parties regarding claims, property protection, safety, or illegal activity.

With Advertising and Social Media Partners: Advertising partners receive Personal Data for marketing, ad attribution, placement, audience measurement, and site analytics.

6. Your Choices

Services feature varies if Personal Data isn't provided.

Opt-Out of Mailings: Newsletter and promotional emails include unsubscribe instructions. Service communications regarding updates or billing cannot be opted out.

Cookie and Ad Tracking Choices: Opt-out options available through aboutads.info, youronlinechoices.eu, browser configuration, or cookie-blocking extensions like Privacy Badger or Ghostery.

Modifying Your Information: Account Personal Data modification is available via email to [email protected]. Deletion requests should be sent to [email protected]. Archived/backup copies may persist per legal requirements.

Additional Choices: GDPR (EU), LGPD (Brazil), and California law provide additional rights detailed below.

7. Responding to Do Not Track Signals

The Site lacks capability to respond to "Do Not Track" browser signals. Additional information available at allaboutdnt.com.

8. The Security of Your Information

Reasonable administrative, physical, and electronic protection measures safeguard information. Sensitive data uses SSL encryption. No transmission or storage method guarantees complete security. Security breaches trigger notification attempts via Services posting, mail, or email.

9. Data Retention

Information is retained for Service provision and as long as accounts are maintained. Transaction, location, device, and usage information retention continues per regulatory, tax, insurance, legal, and administrative requirements. Account deletion requests are processed, with exceptions for outstanding credit/debt, unresolved disputes, ongoing investigations, or legal/regulatory retention needs. Legitimate business interests like fraud prevention may warrant retention. Closed accounts due to security or fraud incidents may retain information to prevent future account opening.

10. Links to Other Sites

Third-Party Services linked from the Services have separate ownership and privacy policies. Sona isn't responsible for third-party content, privacy, or security practices. Users should review Third-Party Service privacy policies.

11. Processing Information in the United States

Sona is U.S.-headquartered with service providers in various countries. Personal Data may transfer to outside-jurisdiction computers with potentially less protective privacy laws. Reasonable safeguards consistent with applicable laws protect information, though no measures are failsafe.

12. Cookie Preferences Management

IP address, browser information, and device information combined with third-party cookies, pixels, or similar technologies enable collection of personal data held by third parties (name, contact details, location, employer). Opt-out is available via contact information in the "Privacy Questions" section below.

13. Our Policy Toward Children

Services aren't directed to children under 16. Personal Data from children under 16 is deleted upon discovery.

14. Privacy Notice for California Residents

The California Consumer Privacy Act (CCPA) grants additional rights to California residents.

Your Rights Under the California Consumer Protection Act

Right to Request Disclosure: Request details on specific Personal Data collected in the past 12 months by contacting Sona directly.

Right to Request Information Sharing Disclosure: Sona doesn't sell Personal Data within CCPA meaning, though data is shared with service providers. Contact Sona to request sharing details.

Right to Opt Out of Selling: While Sona currently doesn't sell Personal Data, future sales would include opt-out methods.

Right to Request Deletion: Data deletion may be requested unless exceptions apply (legal obligations, fraud detection, abuse investigation, Terms violations, security fixes, or service necessity). Account deletion is available; verification applies before deletion.

Timely Response: Two free requests per 12-month period are allowed. Sona responds within 45 days, with possible 45-day extension for complex cases.

Non-Discrimination: Exercising CCPA rights involves no discrimination. No goods/services denial, price differences, or quality differences occur due to rights exercise.

Contacting Us (CCPA)

Email [email protected] identifying yourself as a California resident. Verification steps may follow.

Information We Collect (CCPA Required Disclosure)

Identifiers: Name, email, IP address, username, and similar identifiers used for account creation, security, and communication.

Customer Records Information: Telephone, bank account, credit card, or debit card numbers used for transactions, payments, and communication.

Commercial Information: Payment and purchase history used for transaction tracking and financial record-keeping.

Internet or Electronic Network Activity: Session logs, search history, and website/application/advertisement interaction information used for Services performance understanding and improvement.

Geolocation Information: IP address-derived rough location used for understanding Customer access locations and relevant advertising.

Professional or Employment-Related Information: Employer name used to identify business types utilizing Services.

Information Sharing (CCPA Disclosure)

Past 12 months disclosures included service providers, affiliates, and other third parties. Data hosting and storage providers receive Personal Data. Service provider agreements limit information use and require confidentiality.

Updates to this CCPA Section

Annual updates occur with notification per the broader Privacy Policy.

15. Privacy Notice for European and Brazilian Customers

Supplemental notice for European data subjects (EEA, UK, Switzerland) per GDPR and Brazilian subjects per LGPD. Sona Labs is the Personal Data controller, responsible for handling practices.

Bases for Processing of Personal Data

Processing Purpose	Legal Basis
Operate Services	Contract performance necessity or consent-requested steps; legitimate interest if no contract exists.
Research, development, marketing, compliance, fraud prevention, safety	Legitimate interests unless overridden by Customer impact without consent or legal requirement.
Legal compliance	Legal obligation necessity.
Consent-based processing	Customer consent; withdrawal available.

Rights Under the GDPR and LGPD

Identity verification is required before request response. Legal refusal reasons may apply.

Access: Right to know if Personal Data is processed and access data, usage details, and sharing parties.

Portability: Right to receive provided Personal Data in structured, commonly-used, machine-readable format if processed under contract or consent basis; right to request transfer to another party. Technical feasibility limitations apply; transferred data security becomes third-party responsibility.

Correction: Right to require inaccurate Personal Data correction and incomplete data completion. Processing restriction is exercisable during assessment.

Erasure: Erasure may be requested when data is unnecessary, consent is withdrawn, legitimate interest processing is objected to, marketing use is unwanted, or unlawful processing is suspected. Legal/regulatory/accounting retention requirements may prevent erasure.

Restriction of Processing to Storage Only: Processing stoppage except storage is requirable when: data accuracy verification is pending, unlawful processing erasure is sought but storage is retained, data is unneeded but legal claim retention is required, or legitimate interest objection awaits overriding interest determination.

Objection: Right to object to data processing; Sona considers requests. Marketing processing objection stops processing immediately.

Withdrawal of Consent: Consent-based processing withdrawal occurs via email to [email protected].

Complaints and Questions

EU-based individuals may file supervisory authority complaints in their Member State. Direct contact at [email protected] is encouraged first.

16. Privacy Questions

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Sona Labs LLC
Attn: Data Privacy Team
5627 Telegraph Avenue, #211
Oakland, California 94609
[email protected]