Privacy Policy
What we collect, why, who sees it, and how to ask us to stop. Plain English, written for UK data protection law.
Who we are
Sonder is run by Sonder Technology Ltd, a company registered in Scotland (company number SC899516), registered office 5 South Charlotte Street, Edinburgh EH2 4AN, United Kingdom. In this policy “Sonder”, “we” and “us” mean that company.
We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where a customer gives us its own data to process on its behalf, we act as that customer’s processor under our contract with it, and the customer’s own privacy notice applies.
For anything in this policy, write to privacy@sonderlabs.co.uk. We have not appointed a data protection officer; that address reaches the people responsible for data protection at Sonder.
Whose data this covers
Four groups of people:
- Visitors to sonderlabs.co.uk.
- People who ask for a demo through the form on the site, or who email us.
- Users: people with a Sonder account, usually staff at our customers (record labels, publishers, brands, agencies and creators).
- People who post publicly on social media: creators and commenters whose public posts, comments and profiles appear in the data Sonder analyses. Most of them have never heard of us, so this policy is written to be read by them too.
What we collect
Visitors
The website has no analytics, advertising or tracking tools and sets no cookies (see the Cookie Policy). Like any web server, ours records technical details of each request (IP address, browser type, the page asked for and the time) to keep the site running and secure.
Demo requests
The details you type into the form: your name, work email, company, role, a description of your launch, any links you add, and the page you sent it from. We also use your IP address to limit repeated submissions.
Users
Your name and email address, your sign-in details (a password, which our sign-in provider stores only in hashed form, or your Google account if you sign in with Google), the workspaces you belong to and your role in them, what you do in a workspace (for example, creating a campaign or adding a list), and the content you add: campaign names, links, search terms, lists and notes.
People who post publicly
Sonder reads public posts on TikTok, Instagram, YouTube, X, Facebook, Snapchat, Reddit and Threads to show our customers how a launch, a trend or a creator is doing. From those posts we collect:
- Public profile details: handle, display name, profile picture, bio, follower and following counts, whether the account is verified, and the country the platform shows for it.
- Public posts: the link, caption, hashtags, sound, on-screen text, the video or image itself and what is said in it, view, like, comment and share counts, and when it was posted.
- Public comments on those posts, and the public profile details of the people who wrote them.
- What we work out from them: whether a post is about a given launch, which format or trend it follows, how a creator’s uploads have performed (Scout’s grades), and estimates of an audience’s make-up.
About audience estimates: to tell a customer roughly which age groups, genders and countries are commenting on a launch, we estimate an age band, gender and country for individual commenters from what they make public (their name, bio, the language they write in, a country their platform shows, anything they say about their own age, and in some cases their profile picture). An estimate below a confidence threshold is recorded as unknown. These estimates are only ever shown to customers as totals and percentages across an audience, never against a person. A profile picture used for an estimate is analysed and then discarded, not stored.
We only collect what the account holder has made public. We do not collect private accounts, private messages, or anything behind a platform’s privacy settings. We do not set out to collect special category data (such as health, religion or sexual orientation); if a public post happens to reveal it, we do not analyse it for that.
How we collect public data
Our software reads public web pages and public platform interfaces automatically, at scale. Some of it comes through data providers that supply public social media data (listed under Who we share data with). We never sign in as you, and we do not buy data from data brokers.
Why we use it, and our lawful basis
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Run the website and keep it, and Sonder, secure | Legitimate interests: operating and protecting our service |
| Answer a demo request and follow up about it | Legitimate interests: responding to an enquiry you made; steps before a contract |
| Provide Sonder to customers and their users, support them, and send service emails | Contract with the customer; legitimate interests for each user working under it |
| Collect and analyse public social media data for customers’ analytics | Legitimate interests (summarised below) |
| Keep business records, meet legal duties, deal with legal claims | Legal obligation; legitimate interests |
We only send marketing emails where the law allows it, and each one lets you unsubscribe. We do not use personal data to target advertising and we do not sell it.
Our legitimate interests assessment, in short
We have assessed our use of public social media data against the legitimate interests test. The summary:
- Purpose. Labels, publishers, brands and creators want to know how their launches land with the public: how many people posted about them, what reach those posts earned, which formats are spreading, and which creators perform consistently. That is a legitimate commercial interest, and it often benefits creators, whose posts get counted and credited.
- Necessity. Public reaction cannot be measured without reading public posts. We collect the fields this needs and no more, and we report audiences in aggregate rather than person by person.
- Balance. The data is what people chose to publish to everyone on platforms built for being seen and counted. People reasonably expect public posts to be seen, shared and measured, including by the brands and artists they post about. We protect their interests by:
- collecting public data only, never private accounts or messages;
- showing audience estimates only in aggregate, with low-confidence estimates left unknown;
- not storing profile pictures used for estimates;
- not targeting special category data;
- keeping the data inside customers’ private workspaces, never publishing it or selling it;
- keeping it only as long as it is needed (see Retention);
- honouring objections and erasure requests, and taking steps not to collect an account again once it has opted out.
Because we collect this data from public sources and contacting every person individually would be impossible or take a disproportionate effort, we publish this policy instead of writing to each person (UK GDPR Article 14(5)(b)). You can ask us for the full assessment at privacy@sonderlabs.co.uk.
Profiling and automated decisions
Some of what we do is profiling under the UK GDPR: Scout grades a creator from A to F on the public performance of their recent uploads, and we estimate audience make-up as described above. None of it makes a decision about anyone by itself with legal or similarly significant effects. A grade helps a customer shortlist creators; a person at the customer decides whom to approach. You can object to this at any time (see Your rights).
International transfers
Our servers are in the EU (Germany), which the UK recognises as giving adequate protection. Several of our providers are based in, or process data in, the United States or other countries outside the UK. When data goes to a country the UK has not found adequate, we rely on one of the safeguards UK law provides: the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for a copy of the relevant safeguard at privacy@sonderlabs.co.uk.
How long we keep it
- Server logs: no more than 90 days.
- Demo requests: up to 24 months after we were last in touch, unless you become a customer.
- User accounts: while the account is open and for up to 90 days after it closes. Invoices and other accounting records are kept for six years, as UK law requires.
- Public social media data: while it is needed for a customer’s workspace or for the trend analysis Sonder offers, and no longer than three years after we collected it. Data about an account that opts out is deleted when we act on the request.
- Backups: overwritten on a rolling basis; deleted data leaves the backups as they roll over.
Your rights
Under UK data protection law you have the right to:
- get a copy of the personal data we hold about you (access);
- have inaccurate data corrected;
- have your data deleted (erasure);
- have our use of it restricted;
- object to our use of it based on legitimate interests, including the analysis of your public posts and profile, and to direct marketing at any time;
- receive data you gave us in a portable format, where we use it under a contract or your consent;
- withdraw consent, where we rely on it.
How to ask
Email privacy@sonderlabs.co.uk. If your request is about your public social media accounts, include the platform and a link to each profile. To protect you, we may ask you to show that you control the account, for example by adding a short code to your bio for a few minutes.
Opting out of Sonder
If you don’t want your public posts or profile in Sonder, tell us at the same address. We will delete what we hold about those accounts and take steps not to collect them again.
We answer within one month. If a request is complex we may extend that by up to two more months and will tell you why. Requests are free unless they are clearly unfounded or excessive.
Security
We protect data with encryption in transit (HTTPS), access limited to the people who need it, separate databases for each customer workspace, sign-in through an established identity provider, and regular backups. No system is perfectly secure; if a breach puts your rights at risk, we will tell the Information Commissioner’s Office, and you where the law requires.
Children
Sonder is a business service and is not meant for children. The platforms we read set a minimum age of 13, so some public commenters may be under 18. We never single out children: audience estimates group anyone under 18 as “13–17” and are only shown in aggregate. A parent or guardian can ask us to delete data about a child at privacy@sonderlabs.co.uk.
Complaints
Please tell us first at privacy@sonderlabs.co.uk and we will try to put it right. You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change matters to users, we will also tell them by email before it takes effect.