PRIVACY POLICY

1. Who We Are

Sonar Bloom App LLC ("SonarBloom", "we", "us", "our") operates the SonarBloom platform (the "Service"), a software-as-a-service application that helps brands capture and organize the Instagram and TikTok content they are tagged in and ask creators for permission to reuse it, and that helps creators share insights about their content with brands they collaborate with.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. It applies to our website, our Shopify app, our Meta/Facebook app, and any other product or feature that links to this policy.

Privacy contact: [email protected]

2. Who This Policy Applies To

This policy covers three categories of users:

• Brand / merchant users: people who sign up for SonarBloom on behalf of a brand or business and connect a Shopify store, a Meta (Facebook/Instagram) account, or a TikTok account.
• Creator / influencer users: people who connect their Instagram account through a form sent by a brand (and may add their TikTok username to it), so the brand can see their profile and insights on content in which they tagged the brand.
• Website visitors: people who browse sonarbloom.com without creating an account.

3. Information We Collect

We collect the categories of personal information listed below. Where required by law, we specify the sources from which the information is collected.

3.1 Account and identity data

• Name, email address, and password (hashed)
• Company or brand name, website URL, country
• Role or job title (optional)
• Profile image (if you provide one)

Source: provided directly by you when you sign up or update your profile.

3.2 Shopify store data

• Shop name, shop domain, shop ID, shop owner email, plan type, country, currency, timezone
• Product catalog: titles, descriptions, images, SKUs, variants, tags, collections
• Order metadata associated with customer mentions or creator collaborations (no payment card data)
• Customer data we receive from Shopify only to the extent a merchant explicitly links a mention or a creator to a customer record
• Shopify API access tokens and OAuth scopes granted by the merchant

Source: Shopify Admin API, received after you install our app from the Shopify App Store and grant the permissions requested.

3.3 Meta / Instagram / Facebook data

• Instagram business or creator account ID, username, profile picture, follower count, account type
• Facebook Page ID and name linked to the Instagram account
• Public posts, stories, reels, and comments that mention, tag, or are tagged by the connected account
• Basic insights/metrics on content (reach, impressions, engagement) where the connected account has granted access
• Direct-message thread metadata where the connected account has enabled messaging permissions
• Meta OAuth access token and granted permission scopes

Source: the Meta Graph API and the Instagram API, received after you connect an account through Facebook Login or Instagram Login (including through a brand's invite form) and approve the requested permissions. To find tagged posts that Instagram's official feed leaves out, we also look up publicly available Instagram posts that tag a connected brand account through a third-party data API (RapidAPI).

3.4 TikTok data

• TikTok account username, display name, avatar, account type, follower count
• Public videos and posts that mention, tag, or are tagged by the connected account
• Basic video metrics (views, likes, comments, shares) where permitted by the permissions you granted
• The access token issued when you connect your TikTok account, and the permissions you granted

Source: TikAPI, a third-party TikTok API provider, which accesses TikTok data under the authorization you give when you connect your TikTok account. Media files of captured videos may also be retrieved through a third-party data API (RapidAPI).

3.5 Billing data

• For merchants billed through Shopify: your Shopify billing status (active, frozen, cancelled) and plan tier
• For customers billed outside Shopify (if applicable): billing name, billing email, billing address, last 4 digits of your card, card brand, and card expiry, collected and stored by our payment processor, Stripe. We do not store full payment card numbers.
• Invoice and payment history, refund records

3.6 Usage, device, and technical data

• IP address (truncated for analytics), approximate geolocation derived from IP (country/region level)
• Browser type and version, operating system, device type, screen size
• Pages viewed, features used, clicks, timestamps, referrer URL
• Server logs (requests, response codes, error traces) retained for security and debugging
• Session identifiers and authentication cookies

3.7 Communications and support data

• Emails and support tickets you send us, and our replies
• In-app messages, feedback, and survey responses

4. How We Use Your Information

We use the information described above for the following purposes:

• Provide the Service. Fetch mentions, surface insights, match creators to brands, display analytics, deliver notifications, authenticate you, and operate the core product features.
• Billing and account management. Charge subscription fees (via Shopify Billing API for Shopify merchants, or via Stripe for direct customers), issue invoices, prevent fraudulent charges, handle refunds and disputes.
• Customer support. Respond to questions, troubleshoot issues, investigate reports of abuse or platform-policy violations.
• Security and integrity. Detect and block unauthorized access, abuse, fraud, and violations of our Terms of Service; maintain audit logs; investigate incidents.
• Improve the Service. Analyze aggregate usage patterns to understand which features are used and how to improve them. We do not sell this data.
• Communications. Send transactional emails (receipts, alerts, service notices) and, with your consent where required, occasional product updates. You can unsubscribe from non-essential emails at any time.
• Legal compliance. Respond to lawful requests from public authorities, enforce our Terms, and comply with tax, accounting, and platform partner obligations (Shopify, Meta, TikTok, Stripe).

5. Legal Bases for Processing (EU/UK/EEA Users)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract (Art. 6(1)(b)). Providing the Service after you create an account, billing, customer support.
• Legitimate interests (Art. 6(1)(f)). Securing the Service, preventing fraud and abuse, aggregate analytics and advertising measurement on our website, support chat, improving the Service, and communicating with existing customers about features they use. The cookies these use are described in Section 13. Where we rely on this basis, we have assessed that our interests are not overridden by your rights and freedoms; you can object at any time.
• Consent (Art. 6(1)(a)). Optional marketing emails, and processing of special categories of data where you voluntarily share them. You can withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)). Tax, accounting, and responding to lawful authority requests.

6. Service Providers and Sub-Processors

We share personal data with the service providers ("sub-processors") below that help us operate the Service, for the purpose listed next to each. Each processes the data under its own terms and, where it offers one, a data processing agreement. The one exception is Google: Google may also use data from the Google Ads tag for its own purposes, as described below and in Section 13. Our current sub-processors are:

• Amazon Web Services, Inc.: cloud infrastructure, database hosting, and storage of captured media (United States)
• Stripe, Inc.: payment processing for direct customers (United States)
• Brevo (Sendinblue SAS): account, alert, and notification email delivery (European Union)
• OpenAI: AI analysis of captured images and captions, and of your product catalog, for content descriptions and automatic product matching (United States)
• TikAPI: access to TikTok data for the TikTok accounts you connect, and lookups of public TikTok creator profiles
• RapidAPI: third-party data APIs used to find public Instagram posts that tag you, look up public creator profiles and post metrics, and retrieve the media of captured Instagram and TikTok posts
• Pusher Ltd.: live updates inside the app (United States data region)
• Crisp IM SAS: support chat on our website and in the app (European Union)
• Cloudflare, Inc.: bot protection (Turnstile) on our sign-in and signup pages (United States)
• Datadog, Inc.: application monitoring and logs (United States)
• Google LLC: website analytics (Google Analytics) and ad conversion measurement (Google Ads), described in Section 13 (United States)

We also integrate with the following third-party platforms. These platforms act as independent controllers of the data you maintain with them, not as our sub-processors. They set their own terms and privacy policies for that data, and we access it only with your authorization:

• Shopify Inc.: source of your store data and billing path for Shopify App Store installs (Canada)
• Meta Platforms, Inc.: source of Facebook and Instagram data (United States)
• TikTok Pte. Ltd. / TikTok Inc.: source of TikTok data (United States and other jurisdictions, per TikTok's current privacy documentation)

We will post an update on this page before engaging a new sub-processor that handles personal data. If you have a data processing addendum (DPA) with us, you can request a current sub-processor list and sign up to be notified of changes by emailing [email protected].

We do not sell your personal information. Our website loads the Google Ads tag described in Section 13, which lets Google measure whether our ads lead to signups and which Google may also use for ad personalization under its own policies.

7. Data Retention

We retain personal data only as long as needed for the purposes described in this policy:

• Account data: until you close your account, plus up to 12 months for dispute resolution and legal compliance
• Captured content (Instagram and TikTok posts, Reels, videos, and Stories, their media files, captions, metrics, and direct-message metadata): kept while your account is active. Saving Stories after they expire on Instagram is a core feature, so captured Stories are kept like any other content. Disconnecting an Instagram, Facebook, or TikTok account stops new collection but does not delete content already captured.
• Shopify shops: when Shopify sends the shop/redact webhook (approximately 48 hours after you uninstall the app), we delete the shop's captured posts, Reels, videos, and Stories and their media files, usage rights records, social account connections, and Shopify access tokens within 30 days. Product catalog data is deleted when you uninstall. See our Data Deletion page for what is kept.
• Deletion on request: for any account, including standalone brand accounts and creators, data is deleted within 30 days of a verified email request
• Billing records: 7 years from the date of the transaction, to comply with tax and accounting laws
• Server logs and security logs: about 90 days, then deleted
• Support tickets: up to 3 years from resolution

When retention periods expire, data is permanently deleted or irreversibly anonymized. Earlier stored versions of media files are permanently purged within 90 days of a deletion, and database backups containing your data are purged on our backup schedule. See our Data Deletion page for how to request earlier deletion.

8. International Data Transfers

We are based in the United States and our primary hosting is in the United States. If you access the Service from outside the United States, your personal data will be transferred to, stored in, and processed in the United States and other countries where our sub-processors operate.

For transfers of personal data from the EEA, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, together with supplementary technical and organizational safeguards. You can request a copy of the SCCs used with a specific sub-processor by emailing [email protected].

9. Your Privacy Rights

Subject to applicable law, you have the rights below. We will verify your identity before acting on a request and will respond within the timeframes required by law (generally 30 days under GDPR, 45 days under CCPA, extendable where permitted).

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to fix inaccurate or incomplete data.
• Deletion. Ask us to delete your personal data. See Section 7 for retention exceptions.
• Portability. Receive your data in a structured, machine-readable format.
• Objection and restriction. Object to, or ask us to restrict, certain processing based on legitimate interests.
• Withdraw consent. Where processing relies on consent, withdraw it at any time.
• Complain to a regulator. EU/UK users have the right to complain to their local supervisory authority.

To exercise any of these rights, email [email protected].

10. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you additional rights. In the 12 months preceding the effective date of this policy we have collected the categories of personal information described in Section 3 (identifiers, commercial information, internet activity, geolocation derived from IP, professional information, and inferences drawn from the above).

You have the right to:

• Know what categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we share it with
• Delete the personal information we have collected from you, subject to legal exceptions
• Correct inaccurate personal information
• Opt out of sale or sharing. We do not sell your personal information. Our website loads the Google Ads tag described in Section 13, which may count as "sharing" for cross-context behavioral advertising under California law. You can limit it by turning off personalized ads at adssettings.google.com and by blocking third-party cookies in your browser. Questions: [email protected].
• Limit the use of sensitive personal information. We do not use sensitive personal information for purposes that trigger the right to limit.
• Non-discrimination. We will not deny service, charge a different price, or provide a different level of quality because you exercised a privacy right.

To submit a verifiable request, email [email protected] from the email address associated with your account. An authorized agent may submit a request on your behalf with written authorization.

11. Security

We implement technical and organizational measures designed to protect personal data from unauthorized access, loss, or misuse, including:

• Encryption of data in transit using TLS
• Encryption of data at rest using the standard encryption facilities provided by our cloud infrastructure providers
• Role-based access controls on administrative interfaces
• Isolation of customer data by tenant
• Audit logging of administrative actions
• Regular backups and documented recovery procedures

No system is perfectly secure. You are responsible for keeping your account password confidential and for notifying us immediately if you suspect unauthorized access.

12. Data Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by GDPR, and we will notify affected users without undue delay where required by applicable law.

13. Cookies and Similar Technologies

We use a small number of cookies and similar technologies:

• Strictly necessary: session and authentication cookies required for the Service to function. These cannot be disabled.
• Analytics: aggregated usage measurement (Google Analytics) to understand how our website is used. IP addresses are truncated.
• Advertising measurement: our website loads the Google Ads tag on every page, and the signup page of our app loads it once when an account is created, to measure whether our ads lead to signups. It sets Google advertising cookies, and Google may use the information it collects under its own privacy policy, including for ad personalization.
• Support chat: Crisp sets cookies so a chat conversation continues across pages and visits.

Apart from that signup measurement, the app you sign in to does not load advertising tags. You can block or delete cookies in your browser settings, turn off personalized ads from Google at adssettings.google.com, and opt out of Google Analytics with Google's browser add-on at tools.google.com/dlpage/gaoptout.

14. Children

The Service is intended for businesses and for creators who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a child under 18, we will delete it. If you believe a child has provided us with personal information, contact [email protected].

15. Third-Party Platforms

The Service depends on and integrates with third-party platforms including Shopify, Meta (Facebook and Instagram), TikTok, and Stripe. Those platforms each have their own privacy policies. When you authorize us to access your data on those platforms, the platform's terms and privacy policy also apply. We recommend you review them:

• Shopify: shopify.com/legal/privacy
• Meta (Facebook & Instagram): facebook.com/privacy/policy
• TikTok: tiktok.com/legal/privacy-policy
• Stripe: stripe.com/privacy

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will give you notice (for example, by email or by a prominent notice in the app) before the changes take effect, and we will update the effective date at the top. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

17. Contact Us

For any privacy question or to exercise your rights, contact us at: