Legal

Sovara Labs Privacy Policy

Version 1.0 - July 9, 2026

Company: Sovara Labs ("Sovara", "we", "us", or "our")

Address: 201 Harvard St, Cambridge, MA, US, 02139

This Privacy Policy explains how Sovara collects, uses, discloses, and protects personal information when you visit our websites, use our login and account systems, interact with us, or receive support and related services.

At the date of this Privacy Policy, Sovara is provided on-premises or in customer-managed environments. Customer prompts, responses, traces, tool calls, uploaded documents, application logs, agent outputs, annotations, and similar customer content generally remain within the customer's own environment and are not automatically collected by Sovara.

This Privacy Policy does not apply to customer content that is processed solely within a customer-controlled environment and is not transmitted to Sovara. If a customer or authorized user voluntarily provides information to Sovara, for example for support, debugging, product feedback, or troubleshooting, we process that information as described in this Privacy Policy and any applicable customer agreement or data processing agreement.

1 Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the version or effective date above and, where appropriate or required by law, provide additional notice. If you do not agree with an updated Privacy Policy, you should stop using the relevant Sovara websites, login systems, support services, or other services to which the updated policy applies.

2 Information We Collect and How We Use It

We collect limited personal information needed to operate our business, manage user access, secure accounts, provide support, and communicate with customers and users.

2.1 Information you provide to us

We may collect information that you or your organization provide directly to us, including:

basic contact and account details, such as name, email address, organization name, job title, and account credentials or identifiers;
organization and authorization information, such as organization membership, team, role, permissions, access level, administrative settings, and invitation status;
commercial and billing information, such as company legal name, billing contact, invoice information, purchase order information, tax or VAT details, and records relating to customer agreements;
support and communications information, such as emails, messages, meeting notes, issue descriptions, feedback, screenshots, configuration details, or other information you choose to provide to us.

We use this information to create and manage accounts, administer customer relationships, provide and improve support, manage roles and permissions, communicate with you, process commercial arrangements, and operate and secure Sovara.

2.2 Information collected automatically

When you visit our websites or use our login and account systems, we may automatically collect certain technical and security information, including:

device and browser information, such as browser type, operating system, device type, and IP address;
website and interaction information, such as pages visited, referring pages, date and time stamps, and general usage events;
authentication and security metadata, such as login timestamps, session identifiers, authentication method, failed login attempts, account status, and security events;
error and diagnostic information relating to account access, authentication, security, and support.

We use this information to operate our websites and login systems, maintain account security, detect abuse or unauthorized access, troubleshoot issues, understand how our websites are used, and improve reliability.

Our websites may use cookies or similar technologies for essential functionality, security, analytics, and preference management. You can usually control cookies through your browser settings, but disabling cookies may affect website or login functionality.

2.3 Information from customers, administrators, and third-party login providers

If you use Sovara through your employer or another organization, that organization or its administrators may provide us with information about you, such as your name, email address, organization, team, role, permissions, and account status. We use this information to set up and manage access to Sovara and to support the customer's administration of authorized users.

If you choose to sign in using a third-party identity provider, such as Google, we may receive basic account information from that provider, such as your name, email address, profile picture, and account identifier. We use this information only to authenticate you, create or manage your account, apply organization-specific roles and permissions, prevent abuse, maintain security, and provide support.

Sovara does not access Gmail, Google Drive, Google Calendar, Google Contacts, or other Google Workspace content merely because you use Google Sign-In. If Sovara later offers optional integrations with additional third-party services, we will request only the permissions needed for the relevant feature and will describe how that data is accessed, used, stored, and shared.

Sovara's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3 Customer Content in On-Premises or Customer-Managed Environments

Sovara is currently deployed on-premises or in customer-managed environments. This means that customer content processed by the software generally remains under the customer's control and is not automatically transmitted to or collected by Sovara.

For clarity, Sovara does not automatically collect customer prompts, responses, traces, tool calls, uploaded documents, application logs, agent outputs, annotations, or similar customer content from on-premises or customer-managed deployments.

Sovara may receive customer content only if the customer or an authorized user chooses to provide it to us, for example for support, debugging, troubleshooting, security review, product feedback, or another agreed purpose. In those cases, we use the information only for the purpose for which it was provided and in accordance with the applicable customer agreement.

We do not use Google user data for advertising. We do not sell personal information. We do not use Google user data to train general-purpose AI models. We do not use customer content from on-premises or customer-managed deployments to train or improve models unless the customer has expressly agreed to that use in writing.

4 How We Disclose Information

We may disclose personal information for legitimate business, legal, and security purposes, including to the following categories of recipients:

vendors and service providers who help us operate our business, such as providers of hosting, infrastructure, security, authentication, customer relationship management, communications, analytics, email delivery, and support tools;
enterprise customers and organization administrators, where your account is provided by an organization and that organization manages your access, role, permissions, account status, or related administrative information;
professional advisors, such as lawyers, accountants, auditors, insurers, and other advisors;
third parties involved in a business transaction, such as a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets;
law enforcement, regulators, courts, or other third parties where we believe disclosure is required by law or necessary to protect rights, safety, security, prevent fraud, or enforce agreements;
third parties where you or your organization request, authorize, or direct us to disclose the information.

We require vendors and service providers that process personal information on our behalf to use appropriate confidentiality, security, and data protection safeguards.

5 Third-Party Websites and Services

Our websites or communications may link to third-party websites, platforms, or services that we do not control. We are not responsible for the privacy, security, or content of those third-party services. You should review the applicable privacy notices and terms before using them.

If you use third-party login or identity services to access Sovara, the relevant provider may process your information according to its own privacy policy and account settings.

6 Data Security and Retention

We use reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Because Sovara is currently deployed on-premises or in customer-managed environments, customers are generally responsible for the security, operation, access controls, storage location, backups, and retention of customer content within their own environments, unless otherwise agreed in writing.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, manage accounts, maintain security, comply with legal obligations, resolve disputes, enforce agreements, and maintain business records.

Support materials voluntarily provided to us may be retained for as long as needed to resolve the relevant request, maintain support records, improve reliability, or comply with legal or contractual obligations, unless a shorter retention period is agreed with the customer.

7 International Transfers

Sovara may process personal information in the United States, Switzerland, the European Economic Area, and other countries where we or our service providers operate. Where required by applicable law, we use appropriate safeguards for international transfers of personal information, such as contractual protections or other legally recognized transfer mechanisms.

8 Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a copy of your personal information. You may also have the right to withdraw consent where processing is based on consent. To exercise these rights, contact us at hello@sovara-labs.com.

If you use Sovara through your employer or another organization, we may direct your request to that organization because it may be the controller or administrator of your account and related information.

You may unsubscribe from non-essential marketing communications by using the unsubscribe link in the relevant message or by contacting us. We may still send transactional, security, legal, or service-related communications where appropriate.

9 Children's Privacy

Sovara is not intended for children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

10 Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:

Sovara Labs 201 Harvard St Cambridge, MA, US, 02139 Email: hello@sovara-labs.com