Privacy Policy - Sonar Air

Last updated: July 2026
Contact: info@sonarair.com

These documents describe our current practices. They are not a certification or legal advice. We will have them reviewed by qualified counsel as we grow.

This policy explains what personal data we process when you use Sonar Air, why, how long we keep it, and your rights.

Who we are

Sonar Air is a B2B recruitment-sourcing product operated by Sonar Air (Amsterdam, Netherlands). We help recruiters discover publicly available professional profiles, evaluate fit against role definitions, and review results in a dashboard. Humans remain responsible for hiring decisions.

What we collect

Account data (customers / recruiters)

When you sign in (via Auth), we store identifiers needed to run your account: email, display name, company (if provided), and internal user id. We use this to secure access to role profiles, scans, candidates, and agents.

Candidate and prospect data

To match roles you define, we process publicly available professional information from supported platforms such as GitHub, Stack Overflow, Hacker News, Kaggle, and technical blogs (searched by default as part of the service). Typical fields include handles, bios, public URLs, repository metadata, and similar professional signals. We do not intentionally collect special categories of data (health, religion, politics, etc.).

Technical and operational data

We may log errors, request metadata, and similar data needed to run and secure the service.

Contact and demo requests

If you submit a contact or demo form, we store the details you provide (name, email, message) to respond to you.

Why we process data

To provide the sourcing service you requested
To secure accounts and prevent abuse
To improve reliability and support
To comply with law where applicable

See our legal bases summary below (not legal advice).

Legal bases (summary)

Depending on role and jurisdiction:

Contract - running your account and the service you signed up for
Legitimate interests - operating a B2B recruitment tool, security, and (for public-profile sourcing) presenting professional signals from supported platforms, balanced against individual rights (see LIA doc)
Consent - where required (e.g. non-essential cookies, if enabled)

Your organization may be the controller for prospect data processed in your workspace; we often act as processor for that use. Counsel should confirm roles in your contracts.

How long we keep data

Account: Until you delete your account or we remove inactive accounts per our schedule
Candidate profiles: Automatic retention limit (default 12 months since last relevant activity on the record)
Exports / digests: Until overwritten or deleted; candidate references removed when underlying rows are deleted
Contact leads: Limited retention (see internal runbook); not kept indefinitely

Sharing and subprocessors

We use infrastructure and service providers (authentication, database, hosting, optional LLM APIs, email). A detailed subprocessor list is available:

To customers under our Data Processing Agreement (annex)
On request via Settings or by emailing info@sonarair.com (access may require approval)

We do not sell personal data.

International transfers

Some subprocessors may process data outside the EEA. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses). See our transfer note in the sales pack.

Your rights

Depending on law (e.g. GDPR, UK GDPR), you may have rights to access, rectify, erase, restrict, port, or object to processing, and to lodge a complaint with a supervisory authority.

Your account (export and deletion)

Signed-in users can download a JSON export and request removal of app data from Settings → Data & privacy. Deleting your account removes application data tied to your user id. It may not automatically delete your authentication identity until you delete it via your identity provider or support.

Exclusion requests (prospects / engineers)

If you are a person whose public profile was surfaced and you want to be excluded, email info@sonarair.com with enough detail to identify your public profile (e.g. GitHub username). We aim to acknowledge within a reasonable time and complete removal within 30 days where applicable. Until automated suppression is fully deployed, we process valid requests manually and log completion.

If we process data as processor for a customer, we follow their instructions and our DPA.

Automated decisions and AI-assisted features

When enabled, language models may be used to help create summaries and build search queries. They are not used to score or rank candidates. Outputs are assistive; recruiters should review candidates before hiring or outreach decisions. This is not intended as solely automated legal or similarly significant decisions without human review.

Changes

We may update this policy. Material changes should be communicated to active customers and the “Last updated” date revised.

Children

Sonar Air is not directed at children under 16. We do not knowingly collect their data.