Privacy Policy

1. Who We Are

WinSonar (“we”, “our”, or “us”) is a competitive intelligence platform for B2B SaaS teams. We operate the website and application at winsonar.com. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Information We Collect

• Account data: name, email address, and password (hashed) when you register.
• Usage data: pages visited, features used, and interactions within the platform to improve product experience.
• Configuration data: tracked markets, competitors, and keywords you add to your account.
• Payment data: billing information processed and stored by our payment provider (Stripe). We never store raw card numbers.
• Communications: any messages you send us via support channels or email.
• Newsletter: your email address if you subscribe to our weekly intelligence brief.
• Business contact data: name, job title, company, business email address, and LinkedIn URL for people we contact about WinSonar. See section 4.

3. How We Use Your Information

• Provide, maintain, and improve the WinSonar platform and its features.
• Process transactions and send billing-related communications.
• Send product updates, executive briefs, and the weekly newsletter (where opted in).
• Respond to support requests and improve customer experience.
• Contact business professionals about services relevant to their role.
• Detect and prevent fraud, abuse, or unauthorized access.
• Comply with applicable legal obligations.

4. People We Contact About WinSonar

• What we hold: name, job title, company, business email, LinkedIn URL, and notes of our exchanges.
• Where it comes from: public professional sources (company websites, LinkedIn profiles, public job ads, press), and email-finding services (Hunter, Apollo) that find or verify business email addresses.
• How we process it: AI language models help us draft messages and, where enabled, sort replies. A person reviews and sends every message; nothing is sent automatically. Our email runs on Google Workspace. Where enabled, our system reads our own mailbox, with read-only access, to record which messages were sent, bounced or answered. The credential that gives that access is stored encrypted.
• Which mail we read: to find these messages, our system briefly reads the sender, recipient and threading headers, plus a few technical headers that identify automatic replies and delivery failures (not the subject and not the body), of new mail in the mailbox, in memory only, and discards what does not qualify immediately, without storing or logging it. The body of unrelated mail is never read. We keep a message only if it involves a person described in this section, or someone who works at a company we have contacted and who replies directly to a message we sent (even if we never wrote to that person), in which case their message and email address are stored on the same terms. We store the text of a message only if every other person on it is a person described in this section or a colleague of the person replying; otherwise we keep only the fact that a message existed. Forwarded messages are kept as metadata only.
• First look-back: when the mailbox is first connected, we search the previous 30 days for messages involving those people (an address with an unusual character that cannot be searched safely is skipped there; its mail is recorded from then on).
• Message text: we keep the messages we send to these people and the replies we receive, with the subject and body encrypted at rest, until 12 months after the last message in the thread. When a thread is deleted, the links from our outreach records to it are removed too.
• Delivery failures: for a delivery failure notice we keep the address that failed and the error status code (for example 5.1.1), not the text of the notice, until 12 months after the last message in the thread.
• Legal basis: legitimate interest under UK and EU GDPR.
• Retention: stored mail is deleted 12 months after the last message in its thread, whatever the relationship afterwards. Other contact details are kept for 12 months after the last contact, unless you become a customer (section 6 then applies). People who opt out stay on a do-not-contact list so the opt-out can be honoured.
• Opting out: reply “no”, or email privacy@winsonar.com.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Infrastructure providers: Supabase (database/auth), Vercel (hosting), and similar services necessary to operate the platform.
• Payment processors: Stripe for billing and subscription management.
• Business contact processing: Google Workspace (email), Hunter and Apollo (finding and verifying business email addresses), and AI model providers (drafting messages and, where enabled, sorting replies), for the people described in section 4.
• Analytics: aggregate, anonymised usage analytics to understand product performance.
• Legal authorities: when required by law or to protect the rights and safety of WinSonar or its users.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services, except as stated in section 4. You may request deletion of your account and associated data at any time by contacting us. Billing records may be retained for up to 7 years for legal and accounting purposes.

7. Cookies & Tracking

We use essential cookies to maintain your authenticated session. We may use analytics cookies to understand how users interact with the platform. You can disable cookies in your browser settings, though some features may not function correctly without them.

8. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict certain processing activities.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@winsonar.com.

9. Security

We use industry-standard security measures including encrypted connections (TLS), hashed passwords, and role-based access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We will notify you of any breach that affects your data as required by applicable law.

10. Children's Privacy

WinSonar is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected such data, we will delete it promptly.

11. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email or an in-app notice. Your continued use of the platform after changes become effective constitutes your acceptance of the revised policy.

12. Contact

Questions about this policy? Contact us at privacy@winsonar.com.