Privacy Policy

1. Information We Collect

• Account information — when you sign in (e.g. via Google), we receive your email address, name, and profile image.
• Your Content — the datasets, prompts, columns, and files you upload or generate, including any information you choose to enrich or research.
• Third-party API keys — keys you connect (e.g. OpenAI, Gemini, search providers) are stored in encrypted form.
• Usage & technical data — logs, device/browser information, and actions taken in the Service, used for operation, security, and debugging.
• Cookies & local storage — we use essential cookies and similar local-storage technologies only, to keep you signed in and maintain your session. We do not use advertising cookies.

2. Data About Third Parties (Leads)

The Service lets you upload and enrich data that may include information about other companies and individuals (“lead data”). For that data, you are the data controller and we act as a processor acting on your instructions. You are responsible for having a lawful basis and for providing any required notices to the individuals concerned. We process such data only to deliver the features you request.

3. How We Use Information

• to provide, operate, and maintain the Service;
• to authenticate you and secure your account;
• to run the enrichment, AI, and search tasks you initiate (which may involve sending relevant data to the providers below);
• to monitor, debug, prevent abuse, and improve the Service;
• to comply with legal obligations.

4. Sub-Processors & Data Sharing

We do not sell your personal data. To operate the Service, data may be shared with service providers acting on our or your behalf, including:

• Supabase — database, storage, and authentication;
• Google — sign-in (OAuth) and search;
• AI providers (e.g. OpenAI, Google Gemini, Ollama) — to run AI tasks on the data you submit;
• Search & enrichment providers (e.g. Serper, Findymail) — to look up and enrich data you request.

When you use your own keys (BYOK), the relevant data is sent to your provider accounts under your own agreements with them.

5. Data Retention

We retain your account information and Your Content for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time (see Contact). Some records may be retained where required by law or for legitimate operational reasons.

6. Security

We use reasonable technical and organizational measures to protect data, including encryption of stored API keys and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security, especially during beta.

7. International Transfers

Our providers may process data in countries other than yours. Where that happens, the data is subject to the practices of those providers. By using the Service, you acknowledge such transfers.

8. Your Rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, or to object to or restrict certain processing. To exercise these rights, contact us using the details below. For lead data you uploaded, requests from the individuals concerned should generally be directed to you as the controller.

9. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their personal data.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

11. Contact

For privacy questions or requests, contact us at contact@sorawna.com.