Sonomir turns files into documents. To do that it has to see your files, briefly. This page says exactly what is kept, for how long, and who else touches it — in plain words, because most of what people upload here is private.
The short version
- Uploaded files are deleted from storage when the job that uses them ends, whether it worked or not. Abandoned and incomplete uploads are removed by the daily cleanup after they are 24 hours old. Failed deletions are retried by cleanup.
- New results are available for 24 hours by default, or 30 days if you choose. Delete a completed result sooner with its delete button. Results are private and never published.
- You can use every tool without an account. An email address is only needed to hold credits.
- Analytics count page views and button presses. They never see what is in your files, and screen recording is switched off.
- Nothing is sold, and nothing is used to train anyone's model by us.
Files you upload
A file you upload is stored privately, sent to the service that reads it (see "Who else handles your data" below), and deleted from our storage when the job finishes. Files are never public and are only reachable through the job that created them.
For bank statements, only the last four digits of an account number are kept in the result.
Results
The result of a job — a transcript, extracted text, a table, a list of transactions — is stored with the job so the page and the downloads still work if you come back later. A job belongs either to the browser session that started it or, once you sign in, to your email address. Nobody else can open it.
Before processing, choose 24 hours (the default) or 30 days from the start of the job. Downloads stop working when that period ends. Our daily cleanup removes expired results from active storage; opening an expired result also triggers its removal. Use “Delete this result” for immediate removal from active storage, including the job input and output. Save downloads before deleting; this cannot be undone.
Older jobs created before retention choices were introduced keep their original policy: they remain until you delete them or ask us at hello@sonomir.com. Financial purchase records remain for accounting. Infrastructure backups and processing providers follow their own retention rules; deleting a result is not a promise of immediate erasure from their backups.
Your email address, name and credits
An email address is collected only when you sign in, create an account or buy credits. It is used to send confirmation, sign-in and password reset links and receipts, and to hold your credit balance. Creating an account on the sign-up page also asks for your name, which is saved only after you open the confirmation link and is shown only to you, on your account page. To change or remove it, email hello@sonomir.com. If you choose a password, only a salted scrypt hash of it is stored, never the password itself. There is no newsletter.
A record of credit purchases and spending is kept for accounting, even after a balance is used up.
Payments are handled by Dodo Payments, which acts as the merchant of record: it takes the payment, collects any sales tax or VAT, and sends the receipt. Card details go to Dodo Payments directly and never reach Sonomir; what Sonomir receives is the email address, the pack bought and a payment reference.
Limits and abuse prevention
Free allowances are counted per visitor per day. To do that, and to stop scripts from draining the free tier, a one-way hash of your IP address and a random browser identifier are stored with your usage counts. The hash cannot be turned back into your address. A daily count of free runs per network uses the same hash. Signed-in free allowances follow a hashed account identifier across browsers and networks.
Who else handles your data
These services process data on Sonomir's behalf, only to run the tools:
- Vercel — hosting.
- Google Cloud (Gemini) — the AI models that read documents and write summaries, on Google's paid tier, which does not use your files to train its models.
- Groq or Deepgram — audio and video transcription.
- Supabase — the database and private file storage.
- Dodo Payments — checkout, payments, tax and receipts, as merchant of record.
- Resend — sign-in and receipt emails.
- PostHog — product analytics, without screen recording.
Each processes your data under its own terms and retention rules. Model and transcription providers receive the file or page being read and return the result; Sonomir does not ask them to keep it or learn from it.
Your rights
You can ask what is held about you, have it corrected, or have it deleted — jobs, results, your email and your balance. Email hello@sonomir.com. Requests are handled within 30 days, usually much sooner.
Changes
If this page changes in a way that matters, the date at the top changes with it, and a significant change is announced on the site before it takes effect.