Policies

Privacy Policy

Last updated: 24 September 2026

1. Who we are

Sonder is run by Shourya Banda from Hyderabad, Telangana, India (“Sonder”, “we”, “us”). This policy covers sonderai.in, the Sonder Recruit web application, Sonder Jobs (the public job board and job seekers’ profiles, including jobs.sonderai.in), the “Send to Sonder” browser extension, and the careers, intake and shortlist pages the application creates.

2. Two kinds of data, two roles

• Account data is about the people who use Sonder: agency owners and recruiters. We decide how it’s used, so we’re responsible for it.
• Sonder Jobs profiles are yours, as a job seeker: we decide how that data is used on Sonder Jobs, so we’re responsible for it. When you apply to a role, or an agency opens your profile after you chose “Let agencies find me”, that agency receives a copy and becomes responsible for its own copy.
• Workspace data is the candidate profiles, CVs, applications, onboarding documents and client details that an agency uploads or collects through Sonder. The agency decides why and how that data is used, which makes it the data fiduciary under India’s Digital Personal Data Protection Act, 2023. We process workspace data on the agency’s behalf and only on its instructions.

If you’re a candidate and want to see, correct or delete your information, please contact the agency you applied to or that contacted you, and we’ll help them respond. You can also write to us and we’ll pass your request on.

3. What we collect

• Account details: your name, work email, workspace name and role. If you sign in with Google, we receive your name and email address from Google.
• Workspace data: job descriptions, candidate CVs and profiles, notes, pipeline stages, interview details, client contacts and the messages your team creates or imports.
• Sonder Jobs profiles: your name, email, password (stored only as a one-way hash), phone, location, headline, skills, experience, summary, CV, preferences (cities, notice period, expected salary), availability and when you last confirmed it, skill-test answers and scores, project links you submit and their reviews, your applications, and the agencies that opened your profile or put you forward to a company.
• Applications and documents: the details candidates submit through an agency’s careers or application pages, and onboarding documents (such as marksheets or ID proof) that an agency requests.
• Payments: Razorpay processes subscription payments. We receive the plan, amount, payment status and reference IDs, never full card, UPI or bank account details.
• Technical data: IP address, browser and device type, and server logs, which we use for security and to fix problems. Error reports we collect don’t include request contents such as CV text.

4. How we use it

• To provide the Service: matching and ranking candidates, showing evidence, running pipelines, and sharing client shortlists and reports.
• To send service emails, such as sign-in codes, invitations, password resets and the daily digest.
• For job seekers: to match you to roles, apply for you when you switch on auto-apply, show your profile to agencies in Talent Search only if you switch on “Let agencies find me”, tell you when an agency puts you forward to a company, and send the alerts you choose (email, and WhatsApp only if you switch it on). We ask you to confirm your availability monthly; a profile not confirmed in two months stops being shown to agencies.
• To process payments and manage your plan.
• To keep the Service secure, prevent misuse and fix problems.
• To answer your questions and requests.

We don’t sell personal data, share it for advertising, or use one agency’s workspace data to serve another agency.

5. AI and where matching runs

Matching runs inside your workspace’s deployment — CVs are never sent to third-party AI to be scored. An optional narrative feature can use an external AI model provider. It stays off unless a workspace owner turns it on in Team → Data path, and the workspace shows which path is active.

6. Who we share it with

We use a small number of service providers to run Sonder. Each processes data only to provide its service to us:

• Railway for application hosting and the database.
• An S3-compatible storage provider for collected documents and backups, which we encrypt before storing.
• Resend to deliver emails.
• Razorpay to process payments.
• Google for our email and, if you use it, Google sign-in.
• Sentry for error monitoring.
• Meta (WhatsApp Business), only if your agency sends WhatsApp messages through Sonder, or you switched on WhatsApp alerts on Sonder Jobs.
• Recruiting agencies on Sonder receive a job seeker’s profile when the job seeker applies to one of their roles, or opens it in Talent Search after the job seeker chose to be findable.
• An external AI model provider, only if a workspace owner turns on the narrative feature.

Our providers may store or process data outside India. We may also disclose data when the law requires it, or to protect the rights and safety of our users or the public.

7. Security

• Traffic to Sonder is encrypted in transit (HTTPS).
• Every record belongs to one workspace. Members only see their own workspace, and clients only see what an agency chooses to share with them.
• Collected documents and backups are encrypted before they’re stored.
• You stay signed in through a secure, HTTP-only cookie.

No system is perfectly secure. If a breach affects personal data, we’ll inform affected agencies and the authorities as the law requires.

8. How long we keep data

• Account and workspace data is kept while the workspace exists. After a plan ends, we keep the workspace so you can return or export your data, unless the owner asks us to delete it.
• Applications and extension profiles nobody has reviewed are deleted automatically after 30 days.
• Onboarding documents of candidates who drop out or decline an offer are deleted 30 days after their process ends. Documents of candidates who join are kept as employment records.
• Deleting a workspace removes its records, collected documents and backups. Our hosting provider’s database backups may hold a copy for a short time before they expire. We complete deletion requests within 30 days.
• Sonder Jobs profiles are kept until you delete your profile. Deleting it erases your profile, CV, test results, projects, applications still waiting for an agency’s review, and our records of who opened or submitted your profile; we tell you which agencies already saved a copy, so you can ask them too.
• Payment records are kept for as long as tax and accounting law requires.

9. Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask for a summary of the personal data we process about you, ask us to correct, complete, update or erase it, and nominate someone to exercise these rights for you. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email us, and we’ll respond within 30 days. For workspace data, we’ll work with the agency that controls it.

10. Cookies and local storage

We use one cookie to keep you signed in (job seekers on Sonder Jobs have their own, separate one). Your browser also stores small preferences, such as light or dark theme. We don’t use advertising or third-party tracking cookies.

11. Children

Sonder is for businesses and working professionals, and isn’t meant for anyone under 18.

12. Changes to this policy

We’ll post changes here with a new date. If a change is significant, we’ll email workspace owners before it takes effect.

13. Contact and Grievance Officer

For privacy questions, requests or complaints, contact our Grievance Officer, Shourya Banda, at shourya@sonderai.in (Hyderabad, Telangana, India). If you’re not satisfied with our response, you can complain to the Data Protection Board of India.