Privacy Policy

This Privacy Policy for Sonomos, Inc., doing business as Sonomos, a Delaware corporation with its principal place of business at 9924 Kika Court #2416, San Diego, CA 92129, describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at sonomos.ai or any website of ours that links to this Privacy Policy;
• Use the Sonomos browser extension, including Dagger (real-time sensitive data detection) and, when available, Cloak (pre-send data tokenization);
• Create an account or subscribe to our Services; or
• Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at info@sonomos.ai.

We, us, our — Sonomos, Inc., doing business as Sonomos, a Delaware corporation with its principal place of business at 9924 Kika Court #2416, San Diego, CA 92129.

Personal Information — Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined in Cal. Civ. Code § 1798.140(v)(1).

Sensitive Personal Information — Personal information revealing a consumer's social security number, driver's license or passport numbers, account log-in credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of mail/email/text messages (where the business is not the intended recipient), genetic data, biometric information, health information, sex life or sexual orientation information, or citizenship/immigration status, as defined in Cal. Civ. Code § 1798.140(ae)(1).

Biometric Information — An individual's physiological, biological, or behavioral characteristics, including DNA, used to establish individual identity, including imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, and keystroke patterns, gait patterns, and sleep, health, or exercise data containing identifying information, as defined in Cal. Civ. Code § 1798.140(c).

Service Provider — A legal entity that processes personal information on our behalf pursuant to a written contract that prohibits the entity from retaining, using, or disclosing the personal information for any purpose other than performing the specified services.

Sale / Sell — Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information to a third party for monetary or other valuable consideration, as defined in Cal. Civ. Code § 1798.140(ad)(1).

Share / Sharing — Communicating a consumer's personal information to a third party for cross-context behavioral advertising, as defined in Cal. Civ. Code § 1798.140(ah)(1).

Targeted Advertising — Displaying advertisements selected based on personal data obtained from a consumer's activities over time and across nonaffiliated websites or applications.

Profiling — Any form of automated processing of personal data to evaluate, analyze, or predict certain personal aspects of an individual, including economic situation, health, preferences, interests, reliability, behavior, location, or movements.

In Short: We collect only the personal information necessary to provide the Services. We do not collect browsing history, geolocation data, biometric information, or any content processed by the Sonomos extension.

In the preceding 12 months, we have collected the following categories of consumer personal information:

• A. Identifiers — Real name, email address, account identifiers, unique user ID. (Collected)
• B. Personal information per Cal. Civ. Code § 1798.80(e) — Name, email address. We do not collect SSN, physical description, address, telephone, insurance, bank account, credit/debit card numbers, or health information. Payment card data is collected directly by Stripe. (Collected)
• C. Protected classification characteristics — None collected.
• D. Commercial information — Subscription purchase records and billing history (maintained by Stripe). (Collected)
• E. Biometric information — None collected.
• F. Internet or other electronic network activity — None collected. We do not track browsing history, search history, or interaction data. Our analytics (Simple Analytics) are fully anonymous and cookieless.
• G. Geolocation data — None collected.
• H–J. Audio/visual, professional/employment, education information — None collected.
• K. Inferences — None created. We do not build consumer profiles, infer preferences, or create behavioral models.
• L. Sensitive personal information — None collected.

Payment Data. All payment data is collected, handled, and stored directly by Stripe, Inc. We do not receive or store your full payment card number, CVV, or bank account details. See: stripe.com/privacy.

Third-Party Authentication. We may in the future offer registration via third-party authentication providers such as Google. If implemented, our use of such data will adhere to applicable API data policies. We will update this Privacy Policy before enabling any such feature.

In Short: The Sonomos browser extension processes all sensitive data locally on your device. No user content is transmitted to Sonomos, Inc. or any third party.

What happens on your device (and stays on your device):

• All text scanning and sensitive data detection is performed locally using on-device pattern matching and, where enabled, on-device machine learning models.
• All data masking and obfuscation is performed locally before any content leaves your device.
• Detection settings and preferences are stored locally using Chrome's local storage API.
• No user-generated content is ever transmitted to Sonomos servers, any third-party server, or any external service.

What the extension communicates with our servers:

• License validation and subscription status checks (email address and subscription tier only).
• Extension updates are delivered automatically through the applicable browser marketplace (e.g., Chrome Web Store).

What the extension does NOT do:

• Send detected sensitive data patterns or categories to any server.
• Use any cloud-based AI or machine learning services for content analysis.
• Collect browsing history, page content, or interaction data.
• Use cookies, web beacons, pixels, or any tracking mechanisms.
• Collect telemetry or usage analytics from within the extension.

Chrome Extension Permissions: The extension requests permissions to scan text input fields on supported AI chat interfaces solely for detecting and masking sensitive data. The extension does not use these permissions to collect, record, or transmit page content.

In Short: We collect personal information directly from you and from your authentication or payment provider. We do not collect from data brokers, advertising networks, or other third-party sources.

• Directly from you — registration, subscription, contact forms, or email communication.
• From the authentication provider(s) — Supabase and Resend (email address and authentication tokens, used for passwordless login via one-time passcode).
• From our payment processor — Stripe provides subscription status and billing events, not full card numbers.

We do not collect personal information from: data brokers, advertising networks, internet service providers, social media platforms, credit reporting agencies, government entities, publicly accessible sources, or any other third-party sources.

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• Account creation, authentication, and management — Performance of our contract.
• Deliver extension and services, manage subscription — Performance of our contract.
• Process payments and billing through Stripe — Performance of our contract.
• Respond to inquiries and provide support — Contract performance; legitimate interest.
• Security, fraud prevention, and abuse detection — Legitimate interest.
• Comply with legal obligations — Legal obligation.
• Send marketing communications (only with express opt-in consent) — Consent.

We do not use your personal information for: profiling, automated decision-making, targeted advertising, cross-context behavioral advertising, sale to third parties, building consumer profiles, or training machine learning models.

In Short: We share with service providers only as necessary to operate the Services.

• Supabase — Authentication and database. Receives: email address, user ID. Purpose: account management.
• Stripe — Payment processing. Receives: name, email, payment data. Purpose: subscription billing.
• Resend — Transactional email. Receives: email address. Purpose: OTP delivery, account notifications.
• Simple Analytics — Anonymous, cookieless website analytics. Receives: no personal data.

We do not share with: advertisers, data brokers, social media platforms, marketing agencies, credit reporting agencies, or any third parties not listed above.

We do not sell your personal information. We have not sold consumers' personal information in the preceding 12 months and will not do so without notice and an opportunity to opt out.

We do not share your personal information for cross-context behavioral advertising or targeted advertising.

In the preceding 12 months, we have disclosed the following categories to service providers for business purposes:

• A. Identifiers (email address, user ID) → Supabase, Resend — Account management, transactional email.
• B. Personal information (name, email) → Stripe — Subscription billing.
• D. Commercial information (subscription records) → Stripe — Payment processing.

No other categories (C, E, F, G, H, I, J, K, or L) have been disclosed for any purpose in the preceding 12 months.

In Short: Active account + up to 6 months after termination. Extension-processed content is never stored.

• Account information — Account duration + 6 months.
• Authentication data — Deleted upon account termination.
• Payment and billing records — Account duration + 6 months. Stripe may retain per its own policies.
• Transactional email logs — Retained by Resend per its retention policies.
• Marketing opt-in preferences — Account duration + 6 months.
• Extension-processed content — Never stored. Processed locally, never transmitted.

When no longer needed, we delete or anonymize your information. If not immediately possible, we securely isolate it until deletion is possible.

In Short: Local-first architecture, encryption, and organizational security measures.

• Local-first architecture — All detection and masking occurs on your device. Content never leaves your browser.
• Encryption in transit — TLS encryption for all API communications.
• Encryption at rest — AES-256 via infrastructure provider.
• Authentication security — We use passwordless authentication (one-time passcode via email). No passwords are collected or stored.
• Payment security — Stripe handles all payment data (PCI-DSS Level 1 certified).
• Privacy-first analytics — Simple Analytics — no cookies, no tracking, no personal data.
• Access controls — User data access restricted to authorized personnel on need-to-know basis.

No transmission or storage technology is 100% secure. You should access the Services in a secure environment.

We do not knowingly collect, solicit data from, or market to children under 18 years of age. If we learn personal information from users under 18 has been collected, we will deactivate the account and promptly delete such data. Contact us at info@sonomos.ai if you become aware of any such collection.

In Short: No cookies, no tracking. Privacy-first analytics only.

Cookies: We do not use cookies on our website or in the extension. Authentication uses secure tokens, not cookies.

Analytics: Simple Analytics — no cookies, no cross-site tracking, no personal data. All data is aggregated and anonymous.

Do-Not-Track: We honor DNT browser signals by default.

Global Privacy Control (GPC): We recognize and honor GPC signals as valid opt-out preference signals. Because we do not sell personal data, share for targeted advertising, or engage in cross-context behavioral advertising, GPC signals are already honored by default.

In Short: California residents have specific rights under the CCPA/CPRA as described below.

Right to Know / Right to Access — You have the right to request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties to whom we disclose it. We are not required to provide this information more than twice in a 12-month period.

Right to Opt Out of Sale or Sharing — We do not sell or share your personal information, so no opt-out action is required.

Right to Limit Use of Sensitive Personal Information — We do not collect or process sensitive personal information. No limitation request is necessary.

Right to Deletion — On receipt of a verifiable request, we will delete your personal information and direct our service providers to do the same, subject to lawful exceptions.

Right to Correction — You may request correction of inaccurate personal information.

Right to Non-Discrimination and Non-Retaliation — We will not deny goods or services, charge different prices, or provide different quality for exercising your privacy rights.

In Short: Residents of states with comprehensive privacy laws have specific rights. Because of our minimal data collection and no-sale, no-targeting, no-profiling practices, many of these rights are already satisfied by default.

This section applies to residents of states with comprehensive consumer privacy legislation, including: Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota, Rhode Island, and Florida.

Common rights across state laws:

• Right to Access / Right to Know
• Right to Correction
• Right to Deletion
• Right to Data Portability
• Right to Opt Out of Sale — We do not sell your personal data. No opt-out action required.
• Right to Opt Out of Targeted Advertising — We do not process data for targeted advertising.
• Right to Opt Out of Profiling — We do not profile consumers.
• Right to Non-Discrimination

Universal Opt-Out Mechanisms: We recognize browser-based opt-out preference signals, including Global Privacy Control (GPC). Because we do not sell personal data, share for targeted advertising, or engage in profiling, opt-out signals are honored by default.

Appeals Process: If we decline your privacy rights request, we will inform you of our reasons and provide instructions for appealing. Email info@sonomos.ai with subject line "Privacy Rights Appeal." We respond within 60 days.

To exercise any right described in Sections 13 or 14:

• Visit sonomos.ai/contact
• Email info@sonomos.ai
• Write to: Sonomos, Inc., 9924 Kika Court #2416, San Diego, CA 92129

Data access or portability requests are limited to twice per 12-month period. We verify identity using the email address associated with your account. We respond within 45 days, extendable by an additional 45 days with written notice.

Authorized Agent: You may designate an authorized agent with written permission. We may require direct identity verification.

EEA, United Kingdom, and Switzerland: GDPR and equivalent rights apply: access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority. Legal bases: contract performance, consent (marketing), legitimate interests (security, fraud prevention), legal compliance. Withdraw consent anytime without affecting prior processing. International Data Transfers: Services hosted in the US. We rely on Standard Contractual Clauses and appropriate safeguards.

Australia and New Zealand: We process your information under Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020. You may request access or correction. Complaints may be filed with the OAIC or NZ Privacy Commissioner.

Canada: Your PIPEDA rights are addressed throughout this Privacy Policy. We process with express or implied consent. Withdraw anytime.

Cal. Civ. Code § 1798.83 permits California residents to request disclosure of personal information shared for direct marketing. We do not disclose personal information to third parties for their direct marketing purposes.

We may update this Privacy Policy from time to time. Material changes will be indicated by an updated "Last Updated" date and may include direct notification. Review this Privacy Policy periodically.

Sonomos, Inc.
9924 Kika Court #2416
San Diego, CA 92129
United States

General: info@sonomos.ai

To submit a request, visit sonomos.ai/contact or email info@sonomos.ai. We respond to all verified requests within 45 days.