Data use and retention.

How your content is used

Only for you

Your content serves only your own organization's agent.

Never sold or used to train a model

Sondel does not sell your content, use it for an unrelated purpose, or train or fine-tune a model on it. Sondel does not allow a provider to train a model on it. The providers listed on the subprocessors page process the data needed to provide Sondel.

Patterns without content

Sondel may learn from numbers that contain none of your text, such as decline rates by source age or how often a repair fails.

More learning only if you agree

After you have seen first results, Sondel may ask your admin for permission to use your data to improve the product. It is off until an admin agrees. If you decline, Sondel asks again at most once a quarter, and service never depends on a yes. You can withdraw at any time. Personal data is removed first, and no model is trained on it even then.

What is removed before storage

Card and ID numbers

Sondel removes common card-number, government ID number, and password patterns before storage and before any model call. The customer is told. This is pattern matching, not a guarantee. A number split across several parts, or written out in words, can pass through.

What is out of scope

Early access terms exclude regulated health data and card data. There are no HIPAA agreements yet.

How long Sondel keeps it

Each item has its own clock.

Conversations

90 days by default. An admin can set 30 to 365 days.

Conversations on hold

A billing dispute holds a conversation until the dispute closes, plus 90 days. Your editor or admin can also hold one, with a reason, until a user releases it, plus 90 days.

Sources, Policies, and Flows

While active. Past versions are kept 12 months. Embeddings and other derived data are deleted with their source.

Audit trail

2 years after each event. It holds no message content.

Operational logs

30 days, with no message content.

Billing records

As Canadian tax law requires.

Backups

Expire within 30 days.

Deleting data

Removing a source

Deletes its versions and derived data, and marks every answer that depended on it for re-testing.

A customer's privacy request

Your customer's request goes to you, because you are the data controller and Sondel is your processor. Your admins get a self-serve tool to find one person's data, preview it, delete it, and keep a record of the deletion.

Closing your account

AI processing and writes stop at once. You keep read-only access for 30 days. A full JSON export is being built; until it ships, email hello@sondel.cx and we send your data. Then content and derived data are deleted: access is denied immediately, online data is removed within 24 hours, and backups expire within 30 days.

What remains after closure

Billing records as tax law requires, the audit trail and deletion records (2 years, no content), cost rows with no content (2 years), and a minimal account record (organization name, email domain, closure date, whether the refund guarantee was used, and no card number) for 2 years.

Abandoned previews

A reminder after 30 days without a sign-in or change. Content is deleted after 60 days. Any sign-in or change restarts the clock, and you can ask for your data at any time by emailing hello@sondel.cx. A self-serve JSON export is being built.

Every deletion leaves a record

You get a record of what was deleted, without the deleted content.

This website

Visit counts

This website uses Google Analytics to count visits and see which pages people read. Google sets cookies in your browser and receives the page address, your browser and device type, and your approximate location. It does not receive any customer conversation or documentation.

Where it applies

Only on this marketing website. The chat widget and the owner area do not use it. To opt out, use Google's browser add-on or block cookies for this site.

The early access form

What it collects

Your work email, your company name, and your optional help centre address. If your visit includes a valid campaign link, we also store short source, campaign, and content codes with the request. A signed audit link can also attach an opaque audit request ID and the source code audit_tool. It carries no email or page text. We do not store a raw referral URL or query string in those attribution fields.

Why

To reply to you, review whether Sondel fits your needs, set up your free preview, and measure requests that lead to paid activation.

Where it goes

Your form details are stored in Sondel's database and emailed to hello@sondel.cx. The notification also includes an opaque request ID and the short campaign codes, so staff can connect a reply to the stored request. This site keeps the first valid campaign codes and an optional signed audit reference in this browser tab until its session ends. A valid audit reference can pre-fill the email and help centre address on this form. These defaults stay out of browser storage and analytics.

Review and activation records

Staff keep private records of fit reviews, reviewed activations, payment receipts, and refunds linked to the request ID. These contain dates, status and reason codes, staff roles, opaque evidence references, and receipt amounts and currencies. They do not contain card or bank details. We do not send these records or your form details to Google Analytics.

Deleting it

Write to hello@sondel.cx and ask, and we will delete the request and its linked review and activation records. We have not set an automatic retention period for these request records. Separate billing records follow the retention terms above.

Public documentation audit

Sondel operates this service at app.sondel.cx/audit. A temporary pause can stop new audit starts. Read how the crawler works and how to block it on the audit crawler page.

What it collects

The audit collects a work email, a submitted public website address, an email-verification token, consent choices, a hashed IP address, and public page text that the crawler reads. Product-update consent is separate and unticked by default. It does not use private customer conversations or documentation.

Bot check

Each audit request uses Cloudflare Turnstile. Cloudflare receives browser and IP-address data for the challenge. See Cloudflare's Turnstile Privacy Addendum.

Private reports and analytics

Reports use a private, time-limited link. The audit service does not add report content to website analytics.

Model processing

Sondel sends public passages, plus Sondel-generated questions and instructions used for planning and drafting, to BaseTen. It does not send the lead email. The direct audit route has no fallback gateway.

Retention

Verification links expire after 24 hours. Raw public text is deleted 24 hours after a completed, failed, or expired audit run. Private reports expire 30 days after they are ready. IP-derived codes are deleted 30 days after request creation. A lead and its requests without product-update consent are deleted 90 days after the latest request; consented product-update records are kept for up to 365 days after the latest request. Cost records contain no page text and are kept for two years.

Separate notices

A budget-refused requester can separately ask for one email when audits reopen. That one-time notice is not a product update.

Deletion or opt-out

To ask Sondel to delete an audit record or block future audits of a domain, email hello@sondel.cx.

Who can see it

Sondel staff

No access to your content by default. Access needs approval from your editor or admin, is limited in time and to your organization, and is logged where every user can see it. Every user is emailed when it starts.

Where it is hosted

In the United States by default. Other regions are planned for when a customer needs one.

Providers

The companies that process your content on Sondel's behalf are listed on the subprocessors page.