What we collect, why we collect it, who we share it with, and the control you have.
In short. We collect what we need to run your account, generate designs and take payment. Your floor plans and project data are processed by our hosting provider and — when you use AI features — by a third-party AI provider. We use project data to improve our design engine only after stripping anything that identifies you or your clients. We use essential and analytics cookies. We do not sell your personal data. You can ask us for a copy of your data, ask us to correct or delete it, and withdraw consent at any time.
Sonic Arc is a platform for designing audio-visual systems and generating bills of materials and indicative quotations, operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. In this policy, "we", "us" and "our" mean Sonic Arc; "you" means anyone who uses the Platform, whether as a customer, architect, consultant, integrator or dealer.
This policy explains how we handle personal data when you use our website, web application and related services. It applies alongside our Terms & Conditions.
The Platform is for business use only. The personal data we handle is therefore, in almost all cases, business contact and professional data — your name, work email, firm and role — rather than personal or domestic information.
For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here, and you are the Data Principal. Where you upload personal data belonging to your own clients, see clause 14.
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored hashed, never in readable form), phone number, and your account role. |
| Business profile data | Company or firm name, business type (dealer, architect, consultant, integrator), city and service area, GSTIN, business address, professional credentials, portfolio and profile description, and any verification documents a dealer submits for approval. |
| Project and design data | Uploaded floor plans and drawings, venue dimensions, zone markings, venue type, acoustic and usage parameters, project names, saved quotes, BOMs, notes, and any client details you choose to enter. |
| Billing data | Plan and subscription status, credit balances and consumption history, invoices, transaction identifiers, and the last four digits and card type returned by our payment gateway. We do not receive or store full card numbers, CVV or UPI PIN. |
| Marketplace data | Connection requests, quotes shared with dealers, dealer edits, messages exchanged through the Platform, and ratings and reviews you give or receive. |
| Usage and technical data | IP address, browser and device type, operating system, pages and features used, engine version, timestamps, referring URL, session identifiers, error and crash logs. |
| Communications | Support tickets, emails, feedback and any attachments you send us. |
We do not deliberately collect sensitive categories of data such as health, biometric or financial account data beyond what is described above. Please do not include such data in project notes or uploads.
| Purpose | Basis under the DPDP Act |
|---|---|
| Create and manage your account and authenticate you | Consent / performance of our contract with you |
| Run the design engine and generate designs, coverage maps, BOMs and quotes | Consent |
| Provide AI analysis features (see clause 5) | Consent, given when you use the feature |
| Meter and deduct credits, take payment, issue invoices and handle tax compliance | Consent / legal obligation |
| Operate the partner marketplace: discovery, connections, shared quotes, ratings | Consent |
| Provide support and respond to your messages | Consent |
| Keep the Platform secure, prevent fraud and abuse, and debug problems | Legitimate use / legal obligation |
| Improve the design engine and the product (anonymised — see clause 8) | Anonymised data falls outside the DPDP Act |
| Send service messages about your account, billing or material changes | Consent / performance of contract |
| Send marketing or product-update emails | Consent — you can unsubscribe at any time |
| Comply with law and respond to lawful requests | Legal obligation |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
Some Platform features use artificial intelligence — including analysis of uploaded floor plans and zone-level design suggestions. Please read this clause before using them.
Current AI provider: [AI PROVIDER NAME AND JURISDICTION]. We will update this policy if we change providers.
We share personal data only as described below. We do not sell your personal data, and we do not share it with advertisers or data brokers.
| Recipient | What they get and why |
|---|---|
| Razorpay (payment gateway) | Name, email, phone, billing details and transaction data, to process subscription and top-up payments and recurring mandates. Razorpay handles your payment instrument details under its own terms and privacy policy. |
| Supabase (database and file storage) | Hosts your account records, project data, uploaded floor plans and quotes. |
| Render (application hosting) | Runs the application servers that process your requests; handles server logs. |
| AI service provider | Project data including uploaded drawings, when you use an AI feature (clause 5). |
| Email and analytics providers | Email address for transactional and, where you have consented, marketing email; usage data for analytics (clause 9). |
| Dealers you connect with | Only what you choose to share: your name, contact details, and the quote or project you share with them. See clause 13. |
| Professional advisers | Accountants, auditors and lawyers, where necessary and under confidentiality obligations. |
| Authorities | Where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim, or to protect anyone's safety. |
| A buyer or successor | If we are involved in a merger, acquisition or sale of assets, your data may transfer as part of that transaction. We will notify you and this policy continues to apply until replaced. |
Each service provider acts as our Data Processor, may use the data only for the purpose we engage them for, and is bound by contractual confidentiality and security obligations.
Your data is stored and processed on infrastructure operated by our hosting providers, which may be located in India and/or in other jurisdictions. Our AI service provider is likely to process data outside India.
By using the Platform you consent to your personal data being transferred to, stored in and processed in jurisdictions outside India, subject to the restrictions in section 16 of the DPDP Act and any country restrictions notified by the Central Government from time to time. Where data is transferred outside India, we require the recipient to protect it under contractual obligations no less protective than those in this policy.
We use project data to improve the Sonic Arc design engine — its quantity models, placement logic, coverage calculations and catalogue accuracy. We do this only with anonymised and aggregated data.
If you would prefer your project data to be excluded even from anonymised engine improvement, email us at [PRIVACY EMAIL] and we will action it.
We use cookies and similar technologies in two categories:
We do not currently use advertising, retargeting or cross-site tracking cookies. If that changes, we will update this policy and ask for your consent first.
You can manage analytics cookies through our cookie banner where shown, and you can block or delete cookies in your browser settings — though blocking essential cookies will prevent you from signing in. We do not currently respond to browser "Do Not Track" signals, as there is no agreed standard for them.
| Data | Retention |
|---|---|
| Account and profile data | For as long as your account is active, and for [e.g. 90 days] after closure to allow recovery and export. |
| Projects, quotes and uploaded drawings | For as long as your account is active, and for [e.g. 90 days] after closure, then permanently deleted. |
| Invoices, payment and tax records | Up to 8 years, as required under Indian tax and company law. |
| Marketplace ratings and reviews | Retained on the Platform indefinitely; may be shown without your name after account closure. |
| Server, security and audit logs | Typically [e.g. 12 months]. |
| Support correspondence | [e.g. 24 months] from last contact. |
| Anonymised engine-improvement data | Indefinitely — it is no longer personal data. |
We delete or anonymise personal data once the purpose it was collected for is served and no legal requirement to retain it remains. Backups are overwritten on a rolling cycle, so deleted data may persist briefly in backups before being purged.
We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest for stored files, hashed passwords, role-based access control on our admin systems, restricted access on a need-to-know basis, and logging of administrative actions.
No system is completely secure. You are responsible for keeping your password confidential and for activity under your account. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India as required by the DPDP Act.
Under the DPDP Act you have the right to:
To exercise any of these rights, email [PRIVACY EMAIL] from your registered address. We may ask you to verify your identity. We will respond within 30 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
If you upload or enter personal data belonging to someone else — a client's name, a site contact, an end-customer's address on a drawing — you are responsible for having a lawful basis and any consent needed for us to process it as described in this policy, and for telling those people how their data will be handled.
In that situation you act as the Data Fiduciary for that data and we act as your Data Processor. Please avoid uploading personal data about third parties that your project does not actually require.
The Platform is for business use only and is intended for users aged 18 and over. We do not knowingly collect personal data from children or from persons with a disability who have a lawful guardian, and we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has provided us with personal data, contact us at [PRIVACY EMAIL] and we will delete it.
The Platform may link to manufacturer websites, dealer websites, documentation and other external resources. We do not control those sites and are not responsible for their content or their privacy practices. Read their policies before giving them your data.
We may update this policy as the Platform changes or the law develops. The "last updated" date at the top always reflects the current version. If a change is material — for example a new category of data, a new purpose, or a new class of recipient — we will notify you by email or in-app before it takes effect and, where the law requires it, ask for fresh consent.
For any privacy question, request or complaint:
We aim to acknowledge within 48 hours and resolve within 30 days. This appointment is made in accordance with the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and the rules made under them.
If you remain dissatisfied, you may escalate to the Data Protection Board of India.