Privacy Policy

This Privacy Policy explains how [Legal Entity Name] (“Sonata,” “we”) handles personal data in connection with the Sonata service. For personal data that Sonata processes on behalf of a customer organization (its users’ and its own data within the workspace), Sonata acts as a processor and the customer as controller; that processing is governed by the Data Processing Agreement. This Policy describes Sonata’s own practices and is written to reflect how the product actually works.

Sonata collects and stores: account and organization data (the email address, name, and role of users, and organization and department information); workspace content (conversations and their results, agents and their instructions, workflows and the records of their runs, and documents and files that users provide); connection data (metadata about the third-party systems an organization connects, and encrypted credentials for those connections); and usage and operational data (records of usage such as message counts, token usage, and cost, and administrative audit records of privileged actions).

Sonata uses this data to provide, secure, and support the Service: to operate the workspace, to route requests to AI models for inference at the user’s direction, to enforce access and governance controls, to maintain audit records, and to understand and improve reliability and usage. Sonata does not sell personal data, and Sonata does not use customer content to train artificial intelligence models.

When a user sends work to an AI model, the request is transmitted to the model provider for processing. Sonata currently uses Anthropic for AI inference, and that processing is subject to Anthropic’s applicable terms. Where a customer organization brings its own model provider credentials, the request is processed under that organization’s own account and agreement with the provider.

Within an organization, that organization’s administrators can access the conversations and work created in the organization’s workspace, because the work product belongs to the organization rather than to an individual user. Across organizations, data is isolated, and one organization cannot access another’s data. Sonata personnel access organization data only as needed to operate, secure, or support the Service, or as required by law.

Sonata relies on a limited set of infrastructure and service providers to operate, including hosting, data storage and authentication, and AI inference. These are listed on the Subprocessors page. Basic page-view and performance telemetry, which does not include workspace content, is collected through our hosting provider.

Sonata protects data with technical and organizational measures, including database-level isolation between organizations, encryption of credentials at rest, server-side-only handling of secrets, a restricted set of trusted connectable systems, and human approval for actions that change connected systems. These measures are described in more detail in the Trust Center.

Sonata retains data for as long as needed to provide the Service and as described in the Data Processing Agreement and applicable order. We are candid that some data controls are still being built: today, access can be deactivated reversibly, and certain items can be restored within a window before removal, but full self-service permanent deletion, account deletion, and data export are not yet available and are on our roadmap. Administrative and usage records are retained as an ongoing record.

Depending on applicable law, individuals may have rights to access, correct, or delete personal data, or to object to or restrict processing. Because Sonata typically processes personal data on behalf of a customer organization, such requests are usually directed to and handled by that organization as controller; Sonata will assist its customers in responding as described in the Data Processing Agreement.

[Data location and any cross-border transfer mechanisms to be confirmed.]

The Service is not directed to individuals under 18 and is intended for use by legal professionals.

Sonata may update this Policy and will communicate material changes through the Service or by other reasonable means.

Privacy questions or requests: [Legal/privacy contact].