Sub-processors

Everyone who touches your data.

Sonar runs on other people's infrastructure, so this is the whole list: who they are, what each one does, and where it happens. Reviewed against the code on 22 October 2026.

Running the service

Supabase

The database, sign-in, and file storage. Your workspace lives here.

Singapore

Vercel

Hosting and the servers that run the app, and cookieless page-view counts (Vercel Web Analytics) once you allow analytics.

Singapore, with a global edge network

Anthropic

The AI that writes and edits drafts. Your prompts and the context sent with them pass through it.

United States

Stripe

Card payments and subscriptions. Card numbers go to Stripe and never reach us.

United States and Ireland

PostHog

Product analytics, and session replay inside the app with all text and inputs masked. Knows your email address once you sign in, records which buttons are used but not the words on them, and never receives the text in an app link.

United States

Resend

Sends sign-in emails: confirming your address and resetting your password.

United States

Loops

Sends product emails about your account and your use of Sonar. Receives your name, email address, profile photo and headline, what you have done in Sonar (for example, whether you finished setup or published a post), and the content an email shows you: the opening of a draft or post, the titles of moments from your week, and your monthly numbers.

United States

Slack

Our own team workspace, not yours. Receives internal notices: a new signup's email address, and the feedback you send from inside Sonar.

United States

Reading public material

Apify

Reads public LinkedIn posts and profiles for the watchlist, the niche snapshot and voice import.

United States and the European Union

Tavily

Public web search behind competitor discovery and the weekly niche brief.

United States

Firecrawl

Reads your own public website once, to pre-fill the onboarding questions.

United States

Measuring our ads

Meta

Measures our Facebook and Instagram ads. Only after you allow ad measurement; account setup and subscriptions are sent, and our customer lists kept, with your email hashed.

United States and Ireland

LinkedIn

Measures our LinkedIn ads through the Insight Tag. Only after you allow ad measurement.

United States and Ireland

Google

Measures our Google Search ads through the Google Ads tag. Only after you allow ad measurement; account setup and subscriptions are sent, and our customer lists kept, with your email hashed.

United States and Ireland

What is not on this list

The tools you connect yourself, Google Calendar and Meet, Slack, Zoom, Notion, Microsoft 365, Granola, Fireflies, Wispr Flow, LinkedIn and X, are not sub-processors. Data moves from them to us because you authorised it, under their terms and yours, and we do not send your data to them. You can disconnect any of them in Settings, which deletes the stored token.

Changes, and how you hear about them

When we add a provider that handles customer data, this page changes first and the date above changes with it. If you have a written agreement with us that requires notice before a change, we give it. To be told about changes, or to ask for a data processing agreement, write to hello@meetsonar.co.

Who you are contracting with

V Group (FZE), trading as Distilled, registered in the United Arab Emirates. How we handle your data, and the rights you have over it, are in the privacy policy.