Privacy and data

Where respondent data lives, how long it stays, and how to erase a person on request.

Respondents give their details to you, not to us: Sondr processes them on your behalf. These are the controls that matter.

Retention

Leads are deleted automatically once they pass your retention window — 24 months by default, settable per workspace. Deletion runs on a schedule, not on request, so the window is enforced whether or not anyone signs in.

Consent

A consent tick on the contact step, on by default, with your own wording and a link to your privacy notice. Whether each lead ticked it is stored with the lead.

IP addresses

Not stored unless you switch it on. Sondr records a coarse device label — "iPhone · Safari" — rather than the raw user-agent string, either way.

Getting a copy of everything

Settings → Data and privacy has a Download everything button. It builds a zip on the spot: quizzes.json with every question, option and band; leads.json with each lead's answers, notes and activity; leads.csv and answers.csv for a spreadsheet; team.csv; and audit-log.csv. It is the copy to keep for an access or portability request, and the copy to take with you if you leave — it works whether or not the subscription is active, and it never contains an API key, session token or card detail.

Your own personal record is separate and smaller: your profile page has a Download button for the data Sondr holds about you as a person — profile, preferences, workspaces, sessions and your recorded activity.

Erasing one person

Settings → Privacy takes an email address and erases every lead for it across every quiz in the workspace, answers included. It is immediate and it cannot be undone — which is what a valid erasure request requires.

Deleting the workspace

An owner can request deletion of the whole workspace. It is scheduled rather than instant: access stops at once, and there is a grace window in which the request can be cancelled before anything is destroyed. After it, quizzes, leads and members are removed permanently.

Requesting deletion also stops the billing: the subscription is set to end at the end of the period already paid for, and it is cancelled outright when the workspace is actually removed. Cancelling the deletion does not restart it — use Resume subscription under Plans and billing if you decide to stay.

Closing your own account

Your profile page closes your personal account. Workspaces where you are the only member go with it, immediately; a workspace with other people in it has to be handed to another owner first, and Sondr will say so rather than orphaning a team. Everything else you belonged to simply loses your access.