1. About Sonnet and scope
Sonnet is shop-management software for automotive service businesses. In this policy, Sonnet refers to the software, website, customer portals, and related offerings, and we, us, and our refer to the person or organization that provides and operates Sonnet.
This policy applies to our website, shop-management software, customer portals, emails, and related services (collectively, the Services). It applies to business users, website visitors, people who contact us, and individuals whose information a business enters into the Services.
A business using the Services decides why and how to use information about its customers, employees, and other people. We process that information to provide the Services on the business's behalf. If a business entered your information, contact that business first about its practices or to make a privacy request. This policy does not cover the business's independent practices.
2. Information we collect
Depending on how the Services are used, we may collect:
- Account information: name, email address, optional phone number and profile image, password hash, verification status, organization membership, role, preferences, and session details such as IP address and user agent.
- Business information: shop name, contact details, address, website, logo, labor rates, tax rate, and invoice or business settings.
- Customer and vehicle information: names, contact details, addresses, notes, vehicle year, make, model, color, mileage, VIN, license plate, and service history entered by a business.
- Job and transaction information:jobs, estimates, services, parts, materials, invoices, payment records, credits, refunds, status, and activity history. These records may describe a customer payment, but the Services do not currently process or verify payments made by a shop's customers.
- Files and media: photos, videos, documents, filenames, captions, and related metadata. Uploads may incidentally show people, license plates, addresses, or other identifying details.
- Technical and usage information: IP address, browser, device and operating system, pages or features used, referrer, approximate location, timestamps, and performance, error, security, and authentication events.
- Communications: information you provide when you contact us, request support, report a problem, or provide product feedback.
3. How we collect and use information
We collect information from you, from businesses and their authorized users, automatically from browsers and devices, and from providers that help us operate the Services.
We use information to:
- Create accounts, authenticate users, maintain sessions, and manage access.
- Provide, operate, secure, support, troubleshoot, and improve the Services.
- Store and display business records, create invoices, and provide customer portal access.
- Administer paid access if offered and maintain financial records.
- Send verification, password-reset, service, security, billing, and support communications.
- Measure aggregate usage and performance and prevent fraud, abuse, and unauthorized access.
- Comply with law, enforce our Terms, and protect users, Sonnet, and others.
We do not use information entered by shops to advertise unrelated products to their customers.
4. Cookies, password screening, and analytics
We use cookies and similar storage that are necessary to sign users in, maintain sessions, remember interface preferences, secure accounts, and operate the Services. Disabling them may prevent parts of the Services from working.
We use Have I Been Pwned's Pwned Passwords service to reject known compromised passwords. The check sends only the first five characters of a one-way password hash, not the password or its complete hash.
We use Vercel Web Analytics and Speed Insights for aggregated traffic and performance measurements. These tools may process page paths, referrers, approximate location, browser, device, operating system, and timing information. Vercel Web Analytics does not use cookies to recognize visitors across websites.
We do not use personal information for cross-site or cross-context behavioral advertising.
5. How we disclose information
We may disclose information:
- At a business user's direction, including to its authorized staff and to customers through portal links. Anyone with a valid portal link may be able to see the information available through it.
- To service providers that support hosting, databases, file and video storage, email, analytics, security, and authentication. Current providers include Vercel, Neon, Cloudflare, Resend, and Have I Been Pwned.
- For legal and safety reasons when reasonably necessary to comply with law or valid legal process, enforce agreements, investigate misuse, or protect rights, safety, and security.
- In a business transaction involving a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.
- With consent or at your direction or as otherwise disclosed when information is collected.
We do not sell personal information or share it for cross-context behavioral advertising. If that changes, we will update this policy and provide legally required choices before beginning the new practice.
6. Retention and security
We retain information as reasonably needed to provide the Services, maintain business and security records, comply with legal, tax, accounting, and contractual obligations, resolve disputes, and enforce agreements. Retention varies by the type of information and why we collected it. When information is no longer needed, we may delete or de-identify it. Information may remain temporarily in backups, logs, or legally required records.
We use reasonable administrative, technical, and organizational safeguards designed to protect information. No online service is completely secure, and we cannot guarantee absolute security. Keep your credentials confidential, use a strong unique password, and notify us if you suspect unauthorized access.
7. Your choices and privacy rights
You can update certain account and shop information in the Services. You may unsubscribe from promotional email using the link in the message, when available, but we may still send necessary service communications.
Depending on where you live, you may have rights to request access to, correction or deletion of, or a copy of personal information, to appeal a denied request, or to opt out of certain uses. To make a request, email support@trysonnet.ai. We may need to verify your identity or authority and may retain information where permitted or required by law. We will not unlawfully discriminate against you for exercising an applicable privacy right.
If a business using the Services provided your information, direct your request to that business first. We will assist it as required.
8. Children
The Services are intended for businesses and adults, not children. You must be at least 18 to create an account. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided information directly to us, contact us so we can review and take appropriate action.
9. United States operation
The Services are operated from the United States. Information may be stored or processed in the United States and other places where our providers operate. Privacy laws in those places may differ from the laws where you live.
10. Changes and contact
We may update this policy as the Services, our practices, or legal requirements change. We will post the revised policy and update its effective date. If a change is material, we may provide additional notice where required.
Questions and privacy requests concerning Sonnet may be sent to support@trysonnet.ai.