Privacy Policy

1. Who we are

SONAR is operated by UF Insula Ltd, a private limited company registered in England and Wales (company number 14157197) with registered office at Lytchett House, 13 Freeland Park Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA. "SONAR" is the trading name of UF Insula Ltd. See our Imprint for full contact details.

2. What personal data we collect

We process four distinct categories of personal data:

Customer account data

When you sign up we collect your email address and a hashed password (via Supabase Auth — we never see the plain password). If you sign in with Google instead, Supabase Auth receives your email address and basic profile (name and picture) from Google. We also keep what you add to your account: workspace names, notification settings (for example a Slack, Telegram or WhatsApp destination and email-alert recipients), API keys (stored as a hash), prepaid-balance transactions, support messages and per-report cost records. If you first arrived through a tracked link, we record that first visit with your account: the referring site, the landing page and the campaign parameters (such as utm_source). For paying customers, card and payment details are handled by our payment processor (see Subprocessors); we never see the card number.

KYB subjects submitted by customers

When a customer runs a KYB screening through SONAR, we process personal data about the subject — directors, Ultimate Beneficial Owners (UBOs), officers, authorized signatories, and where returned by public registries and lists: name, role, nationality, birth month and year, registered address, sanctions/PEP status, director disqualifications, matches in public leak databases (such as the ICIJ Offshore Leaks database), and news or enforcement items that mention them (adverse media). Some of this can relate to alleged or proven offences. For this category SONAR acts as a processor; the customer is the controller and must have its own lawful basis for submitting the subject.

Usage and device data

SONAR's own application does not store IP addresses or browser user-agent strings. Our hosting provider (Render) keeps request logs (IP address, user-agent string, request path, timestamps), and our database and authentication provider (Supabase) records sign-in events, including the IP address; these are used for security and abuse prevention. In our database we keep usage records — actions in the app, API calls and source-collection errors — for 90 days. Error reports, including crash reports from your browser, are stored with email addresses, IP addresses and tokens removed. In your browser we store your sign-in session, your language preference, your cookie-notice choice and, only if you accept, sign-up attribution (see the Cookie Policy). Our typeface (Inter) is served from our own servers, so your browser does not contact Google Fonts.

Public company pages and removal requests

SONAR publishes public KYB snapshot pages about companies (getsonar.report/check/…), built from public registries and sanctions lists. They show company-level results: names and birth dates of individuals are removed before a page is published. If you ask us to remove a page through the removal form, we process your email address, the page URL and any reason you give, to verify and handle the request. A person reviews every request, typically within 30 days, and may contact you at the email address you gave. The email address is visible to SONAR administrators only. We do not send automatic confirmation emails. Each new request also triggers an alert in our internal admin channel (Telegram) that contains only a status line and a link to the admin queue, with no personal data.

3. Legal bases (GDPR Art. 6)

• Contract: operating your account, running the screenings you request, billing you.
• Legitimate interests: securing the service against abuse, improving the product, internal operational alerts, responding to support requests, and publishing public company pages built from public records.
• Consent: first-visit sign-up attribution (campaign parameters, landing page and referring site), recorded only if you choose "Accept" in the cookie notice. Withdrawable at any time via the cookie settings link in the footer.
• Legal obligation: keeping invoices and payment records for as long as UK tax law requires (currently 6 years). These records are held by our payment processor and in our accounting records, not in your SONAR account (see Retention).

4. Purposes

• Provide the SONAR KYB / CI service
• Authenticate users and prevent unauthorized access
• Aggregate and summarize KYB signals for the reports customers request
• Bill customers and comply with tax/accounting obligations
• Respond to support requests, security reports, and legal requests
• Improve the product (aggregate analytics; no individual profiling)

5. Retention

• Account data: kept while your account exists. When you delete your account (Settings → Delete account), we delete your workspaces, reports and their PDFs, settings, API keys, API usage records, balance transactions and subscription records from our database straight away, and your login last. Per-report cost records are kept with the link to you removed. Invoices and payment records are kept by our payment processor (Stripe) and in our accounting records for as long as UK tax law requires (currently 6 years).
• KYB reports and submitted subject data: deleted automatically by a nightly job once they are 24 months old. The period is the same for every customer. You can delete any report, any workspace or your whole account earlier at any time, and the deletion takes effect immediately. Share links you create for a report expire after 90 days by default (at most 365 days) and stop working when you revoke them or delete the report. Reports from our earlier competitive-intelligence products are kept until you delete them or your account.
• Usage logs in our database (in-app activity, API calls, source-collection errors): 90 days rolling. Error reports (stored with email addresses, IP addresses and tokens removed): deleted 90 days after the error was last seen. Request and sign-in logs held by our hosting and database providers: kept for the period those providers set.
• Cookie consent record: kept in your browser for 12 months.
• Operational records: background-job records are deleted after 14 days, per-source collection logs after 30 days, cached AI summaries after 24 hours, and sign-out markers once the session they block would have expired. Internal admin alerts in Telegram contain no personal data: accounts and reports are referred to by internal ID only.
• Backups: our database provider keeps daily backups for 7 days, and we keep weekly encrypted backups for 12 weeks. Data you delete remains in these backups until they expire.
• Public company pages: kept while published and refreshed periodically. When we approve a removal request, the page is taken offline (HTTP 410) within minutes. Removal requests, including the requester's email address, are kept as a record of how each request was handled.

6. Who receives the data

We only share personal data with the subprocessors listed on our Subprocessors page, each of whom is contractually bound to process it on our instructions. If you connect your own Slack, Telegram, WhatsApp (via your Twilio account) or email destination for report alerts, we send report summaries there on your instruction; those services are chosen and controlled by you. We do not sell personal data. We may disclose data in response to a valid legal order, after assessing the order against UK GDPR Art. 6(1)(c) and the UK Data Protection Act 2018.

7. International transfers

SONAR is operated from the United Kingdom. Our application servers (Render, Frankfurt) and our database (Supabase, Ireland) are in the European Union. Some subprocessors are US companies or process data outside the UK and EEA: Anthropic and OpenAI (AI processing, United States), GitHub (encrypted backups, United States), Stripe (payments, EU and United States) and Bright Data (web access, Israel). Transfers of personal data from the EEA to the UK rely on the European Commission's adequacy decision for the UK (28 June 2021). Onward transfers to countries without an adequacy decision rely on the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914) for EEA-origin data and the UK International Data Transfer Addendum to those clauses (in force 21 March 2022) for UK-origin data, plus supplementary measures (encryption in transit and at rest, tiered access controls). Israel (Bright Data) benefits from EU and UK adequacy decisions.

8. Your rights

Under the EU and UK GDPR you can:

• Access a copy of your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent for consent-based processing
• Complain to your local supervisory authority (CNIL, Garante, ICO, BfDI, AEPD, etc.)

Under the California Consumer Privacy Act (CCPA/CPRA), California residents also have the right to:

• Know what personal information we collect and for what purpose
• Delete personal information
• Opt out of the sale of personal information — SONAR does not sell personal information
• Non-discrimination for exercising these rights

UK residents have the same rights under the UK GDPR and the UK Data Protection Act 2018, with the Information Commissioner's Office (ICO) as the supervisory authority.

You can delete your account yourself at any time in Settings → Delete account (cancel any active subscription in the billing portal first). To exercise any other right, email privacy@getsonar.report. We respond within 30 days (UK and EU GDPR) or 45 days (CCPA).

9. Data Protection contact & DPIA

SONAR has not appointed a formal Data Protection Officer: our core activities do not yet meet the "large-scale" threshold in GDPR Art. 37(1)(b)-(c), and our DPIA concludes the residual risk to data subjects is low-to-medium (balanced by the fact that all processed personal data is sourced from public registries). We revisit this annually. For any data-protection question you can reach us at privacy@getsonar.report.

10. Complaint rights

If you believe we are processing your data in violation of applicable law, you have the right to complain to your local supervisory authority. SONAR's lead supervisory authority is the UK Information Commissioner's Office (ICO, ico.org.uk). EU residents may also complain to their national authority — examples: France CNIL (cnil.fr), Germany BfDI (bfdi.bund.de), Italy Garante (gpdp.it), Spain AEPD (aepd.es).

11. Security

See our Security page for a description of the technical and organizational measures in place. Report suspected vulnerabilities to security@getsonar.report.

12. Children

SONAR is a B2B service not directed to children. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We update this policy as our service evolves. Material changes will be announced by email (for account holders) or by a banner on the website at least 30 days before they take effect. The current version and effective date appear at the top of this page.

14. Contact

Questions about this policy: privacy@getsonar.report. Legal and contractual matters: legal@getsonar.report. Postal: UF Insula Ltd, Lytchett House, 13 Freeland Park Wareham Road, Lytchett Matravers, Poole, England, BH16 6FA.