1. DATA CONTROLLER

SONDER INNOVATIONS d.o.o. (“Sonder”, “We”, “Us”, “Our”), with its registered office at Petrovaradinska ulica 52, Zagreb, Croatia, registered in the court register of the Commercial court in Zagreb under number (MBS): 081636184, Croatian personal identification number (OIB): 95631264068, acts as a data controller in the context of this Policy. This means that Sonder decides on the purpose and method of collecting and using your personal data.

If you have any concerns regarding your data, you can contact us at any time at: privacy@sonder-ai.com.

2. INTRODUCTION

Welcome to Sonder. Here, we help you connect with the right mentors, peers and opportunities based on your digital twin profile. In order to present all of your qualities and skills, we collect, protect and use your data while ensuring your privacy in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) („GDPR“).

In this Policy, the “Service” refers to our Sonder application, platform, website, and all related features we provide.

3. PERSONAL DATA WE COLLECT

We collect different types of personal data depending on how you use our application and interact with the digital-twin features. This section explains what information we collect, how we collect it, and for what general purposes.

3.1. Data you directly provide to us

You may provide personal data to us when creating and updating your account, using our digital-twin tools, or communicating with other users. This includes:

• Account and Profile Information - such as your name, username, profile photo, age or date of birth, gender, location (city or country), and any biographical information you choose to include.
• Contact Information - such as your email address, phone number, or links to other profiles if you choose to share them.
• Digital-Twin Data (Inputs) - all information, text, images, or other content that you voluntarily provide to build or update your digital twin. This may include your interests, preferences, personality descriptions, opinions, lifestyle details, goals, or other information about yourself.
• Social and Communication Data - messages you send to other users, posts or comments you publish within the app, or participation in group discussions.
• Feedback and Support Requests - any messages or information you send to us for customer support, feature requests, or surveys.
• Payment and Subscription Data - if you purchase premium features, we collect payment-related information such as transaction ID, billing details, and the chosen payment method (handled securely through our payment provider - Stripe; we do not store full credit-card numbers).
• Consent Choices and Privacy Settings - your preferences regarding data visibility, sharing, and AI model personalization.

Our application is not intended to collect sensitive personal data (such as health information, political opinions, religious beliefs, sexual orientation, etc.). However, since your digital twin is based on information you choose to provide, you may decide to include such information voluntarily. If you do, we will treat it with heightened protection, and you may delete or modify it at any time in your settings.

3.2. Data collected automatically from your use of Sonder

When you use our app or website, we automatically collect certain technical and usage information to keep the service secure and to improve performance. This includes:

• Device and Connection Information - such as device type, operating system, browser type, app version, screen resolution, IP address, and time zone.
• Usage Data - information about how you interact with the app, including login times, features used, searches, clicks, content viewed, and time spent on different sections.
• Log and Diagnostic Data - event logs, error messages, and crash reports that help us troubleshoot technical issues and improve reliability.
• Cookies & Similar Technologies - small data files stored on your device that help us recognize you, remember your preferences, and measure how our services are used. Our Cookie policy is elaborated further in chapter 12.
• Approximate Location - derived from your IP address or device settings to customize recommendations and connect you with nearby users (you can disable this in your settings).
• Outputs - any content generated by Sonder based on your Input (In our Terms of Use, we refer to your Inputs and Outputs together as “User Content”).

3.3. Data generated by the Sonder system

To power your digital twin and provide personalized matches or recommendations, our system - using Google’s Gemini API - may generate or infer new data about you based on the information you provide. This may include:

• Interest and Personality Profiles - inferred traits, preferences, or compatibility scores created by analyzing your inputs and behavior.
• Similarity and Match Data - analysis of your digital twin against others to suggest potential connections or communities.
• Usage Insights - aggregated data on how your digital twin interacts with others or how frequently certain traits are updated.

These AI-generated insights are used solely within our service to enhance your experience and are not sold or shared for advertising purposes.

3.4. Data that is indirectly provided to us from third parties and other sources

We collect information that is publicly available on the internet, to develop our AI model(s) that power our systems. Since our AI models are trained on such information, this may contain personal data, even if we use good practices to filter out such personal data.

We also receive information from third parties when it is necessary to operate our service, such as:

• Google Cloud / Gemini - we use Google’s AI models to process certain prompts and generate outputs. Google acts as our data processor and processes your inputs and generated outputs on our behalf, in accordance with its Data Processing and Security Terms.
• Analytics Providers - such as Google Analytics, which provide aggregated usage statistics.
• Stripe - which confirm transaction success or failure and send us basic billing details.
• Optional Social or Identity Integrations - if you choose to connect external accounts (e.g., sign in with Google), we receive identifiers and basic profile data from that provider, according to your consent.

We do not buy or sell personal data from data brokers.

4. HOW WE USE YOUR DATA

• Providing and operating the service (creating accounts, managing digital twins, enabling communication, generating AI outputs)
  Data Processed: Account and profile data, Contact information, Digital-twin data and inputs, Generated outputs, Communication data.
  Legal Basis: Performance of a contract - Art. 6(1)(b) GDPR
  Retention Period: 2 months after the deletion of the account
• Personalization and improvement of user experience (tailoring recommendations, updating the digital twin)
  Data Processed: Inputs and outputs, Preferences, interests, interaction data, AI-generated personality and similarity profiles, Usage data and analytics.
  Legal Basis: Consent (for personalization) - Art. 6(1)(a) GDPR; Legitimate interest - Art. 6(1)(f) GDPR (improving service)
  Retention Period: 2 months after the deletion of the account or when the consent is revoked
• Connecting users and enabling social interaction (matching and community features)
  Data Processed: Profile and visibility settings, Match/compatibility data, Public or shared content.
  Legal Basis: Consent (for public visibility) - Art. 6(1)(a) GDPR; Performance of a contract - Art. 6(1)(b) GDPR
  Retention Period: Immediately after the deletion of the account or when the consent is revoked
• Technical operation, maintenance, and security (ensuring stability, preventing misuse, debugging)
  Data Processed: Technical data (IP address, device type, OS, browser, app version, logs), Usage data (clicks, session duration, errors), Cookie identifiers, Approximate location.
  Legal Basis: Legal obligation - Art. 6(1)(c) GDPR (security requirements)
  Retention Period: 5 years after the deletion of the account
• Customer support and communication (responding to requests, feedback, bug reports)
  Data Processed: Contact information, Message content and support tickets, Log or error data relevant to the issue.
  Legal Basis: Performance of a contract - Art. 6(1)(b) GDPR
  Retention Period: Immediately after successful resolution of the request. In case of the dispute, 10 years after the end of proceedings
• Billing and subscription management
  Data Processed: Payment data (transaction ID, billing details, subscription plan), Account identifiers.
  Legal Basis: Legal obligation - Art. 6(1)(c) GDPR (tax and accounting laws)
  Retention Period: 11 years
• Analytics, research, and AI development (improving algorithms, understanding usage)
  Data Processed: Aggregated and anonymized usage data, Interaction and feature-use data, AI performance data (model responses, feedback).
  Legal Basis: Legitimate interest - Art. 6(1)(f) GDPR (product improvement within the Service)
  Retention Period: Immediately after the deletion of the account
• Compliance with legal obligations and enforcement of rights
  Data Processed: All relevant data categories necessary to meet legal or regulatory duties.
  Legal Basis: Legal obligation - Art. 6(1)(c) GDPR
  Retention Period: As requested by the relevant legislation
• Marketing and optional communications
  Data Processed: Contact data (email), Interaction data for personalization.
  Legal Basis: Consent - Art. 6(1)(a) GDPR
  Retention Period: Immediately after the revocation of the consent
• Ethical and safe use of AI models (auditing outputs, detecting harmful or biased content)
  Data Processed: Inputs and outputs processed via Google Gemini, Feedback on AI responses, Logs of flagged or reported content.
  Legal Basis: Legitimate interest - Art. 6(1)(f) GDPR (ensuring responsible AI use)
  Retention Period: 2 months after the deletion of the account

5. YOUR CONSENT AND CHOICES

We process personal data only when there is a valid legal basis under the GDPR. Depending on the type of data and the purpose of processing, we rely on one or more of the following legal grounds:

5.1. Consent - Article 6(1)(a) GDPR

In certain cases, we process your data only when you have given us your explicit consent. This includes situations such as:

• personalizing your digital twin’s behavior and recommendations,
• making parts of your profile visible to other users,
• receiving marketing messages, newsletters, or promotional updates, and
• using optional cookies or analytics tools.

You can withdraw your consent at any time through your account settings or by contacting us at our privacy email address. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.2. Performance of a Contract - Article 6(1)(b) GDPR

We process personal data when it is necessary to perform our agreement with you or to take steps at your request before entering into such an agreement. This includes, for example:

• creating and managing your user account and digital twin,
• enabling communication and interaction between users,
• processing your inputs through Google’s Gemini model to generate outputs, and
• handling billing and payments for premium features.

5.3. Legal Obligation - Article 6(1)(c) GDPR

We may need to process certain personal data to comply with our legal obligations, such as:

• tax and accounting requirements,
• consumer protection regulations,
• data protection compliance, or
• responding to lawful requests from courts, regulators, or public authorities.

5.4. Legitimate Interests - Article 6(1)(f) GDPR

We process certain personal data to pursue our legitimate business interests, while protecting your fundamental rights and freedoms. These legitimate interests include:

• maintaining the security and stability of our systems and services,
• preventing fraud, misuse, or technical failures,
• improving and developing our products, algorithms, and AI-based features,
• to establish, exercise, or defend our legal rights or those of our users (e.g., in the event of a dispute, investigation, or suspected breach of our Terms of Service)
• conducting analytics and user research, and
• ensuring ethical and responsible AI use, including monitoring AI outputs and preventing harmful or biased content.

6. YOUR RIGHTS

You can exercise any of the following rights:

• Right of Access - You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data along with information about how and why it is processed.
• Right to Rectification - You have the right to request correction of any inaccurate or incomplete personal data that we hold about you. You can also edit much of your information directly through your account settings.
• Right to Erasure - You may request the deletion of your personal data in certain circumstances, for example: when the data is no longer necessary for the purposes for which it was collected; when you withdraw your consent (where consent was the legal basis); or when you object to processing and there are no overriding legitimate grounds. However, we may opt for pseudonymization of your data rather that erasure, for which we would ask your consent.
• Right to Restriction of Processing - You can request that we restrict processing of your personal data in specific situations, such as when you contest its accuracy or when you believe the processing is unlawful but you prefer restriction over deletion.
• Right to Data Portability - You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically possible.
• Right to Object - You may object at any time to the processing of your personal data based on our legitimate interests, including profiling. If you object, we will stop processing your data unless we can demonstrate legitimate grounds that override your interests, rights, and freedoms, or unless the processing is required for the establishment, exercise, or defence of legal claims. You may also object to the use of your data for direct marketing at any time, in which case we will immediately stop sending such communications.
• Right to Withdraw Consent - Where we rely on your consent to process personal data, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to Lodge a Complaint - If you believe that your personal data has been processed in violation of applicable data protection laws, you have the right to lodge a complaint with your local supervisory authority. If you are located in the European Union, you can find contact details for all EU data protection authorities here.

To exercise any of these rights, to submit a request or to obtain additional information, please contact us at privacy@sonder-ai.com.

We may ask you to provide information necessary to verify your identity before fulfilling your request. We will respond to verified requests within the time limits required by applicable data protection law.

7. PERSONAL DATA PROTECTION

We take the protection of your personal data very seriously. We have implemented a range of technical and organizational measures designed to ensure an appropriate level of security and to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

7.1. Technical Measures

We use a range of security technologies and controls, including:

• Encryption: Personal data is encrypted both in transit and at rest.
• Access Controls: Only authorized personnel can access personal data, following a strict need-to-know policy.
• Monitoring and Testing: We maintain system monitoring, logging, and regular security testing to identify and prevent vulnerabilities.
• Pseudonymization: Whenever possible, we pseudonymize personal data by replacing direct identifiers (such as names or emails) with artificial codes. This ensures data can no longer be linked to you without separate, securely stored information, minimizing privacy risks.
• Data Segmentation and Backup: We separate live and backup environments, perform regular backups, and maintain secure recovery procedures to prevent data loss.

7.2. Organizational Measures

In addition to technical safeguards, we maintain strict organizational controls, including:

• Confidentiality: All employees and contractors handling personal data are bound by confidentiality agreements and trained in data protection.
• Vendor Oversight: We carefully select and contractually bind third-party processors (such as Google for AI processing) to ensure compliance with GDPR and equivalent security standards.
• Data Minimization and Retention Controls: We collect and retain only the data necessary for specific purposes and delete, anonymize, or pseudonymize it when no longer needed.
• Privacy by Design: Security and data protection principles are integrated into our systems and product development from the start.

8. RECIPIENTS OF YOUR DATA

We do not sell or rent your personal data. We share it only when necessary to operate our services, comply with the law, or with your explicit consent. Whenever we share data, we do so under contractual safeguards and apply appropriate technical and organizational measures to protect your privacy.

8.1. Service Providers and Business Partners

We engage trusted third-party providers who process personal data on our behalf and in accordance with our written instructions (“data processors”). Such partners include:

• Google Cloud / Google Gemini - for AI model processing and infrastructure hosting. Google acts as our data processor under the Google Cloud Data Processing Addendum.
• Stripe - to securely process payments, manage billing information, and comply with tax and accounting regulations. Stripe acts as our data processor under the Stripe Data Processing Agreement.
• Analytics Providers - to measure service performance and usage patterns (for example, Google Analytics).
• Customer Support and Communication Tools - to manage user requests and send service messages.

8.2. Legal and Regulatory Requirements

We may disclose personal data to public authorities or third parties if required by law or when necessary to:

• comply with legal or regulatory obligations;
• respond to lawful requests from courts or government agencies such as AZOP;
• protect the rights, property, or safety of our users or the public; or
• enforce our Terms of Service or defend legal claims.

8.3. Corporate Events

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data may be transferred as part of the transaction. We will ensure that the receiving entity continues to handle your data in a manner consistent with this Privacy Policy.

8.4. Other Users and Public Content

When you interact within the app - for example, by sharing parts of your digital twin, posting in a community space, or messaging another user - certain information will be visible to those users according to your privacy settings. You can adjust the visibility of your profile or digital-twin elements at any time through your account preferences.

9. TRANSFER OF DATA OUTSIDE THE EU

We primarily store and process personal data within the European Economic Area (EEA). However, some of our trusted partners (including Google and Stripe) may process data on servers located outside the EEA, such as in the United States.

Whenever personal data is transferred outside the EEA, we ensure that it receives an adequate level of protection in accordance with Articles 44-46 of the GDPR, by relying on one or more of the following safeguards:

• Adequacy Decision of the European Commission
• Standard Contractual Clauses (SCCs): Transfers to Google are governed by the Google Cloud Data Processing Addendum, which include the access controls, and other security measures to protect your data during European Commission’s SCCs. Transfers to Stripe are governed by the Stripe Data Processing Agreement and the Stripe Data Transfer Addendum, which also implement the SCCs and additional transfer safeguards.
• Technical and Organizational Measures: Our processors apply encryption transfer and processing.

10. HOW LONG WILL YOUR DATA BE STORED?

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal requirements and legitimate business operations in accordance with this Policy.

After the retention period expires, we delete or anonymize personal data, unless continued retention is required by law.

10.1. General Retention Principles

• Account Data: kept for the duration of your account and deleted once your account is closed.
• Digital Twin and Interaction Data: retained for as long as your account is active or until you delete it from your profile or conversation history.
• Payment and Billing Data: retained for the period required by tax and accounting laws (typically up to 11 years).
• Technical and Security Logs: stored for a limited period (usually up to 12 months) to ensure system security and detect misuse.
• Anonymized or Aggregated Data: may be retained indefinitely for statistical, research, or AI model improvement purposes.

Certain categories of data may be retained for longer periods where required by Croatian law.

10.2. Deletion and User Requests

You may delete your account or request deletion of your personal data at any time by contacting us at privacy@sonder-ai.com. When you make such a request, we will permanently delete your personal data unless retention is required by law or necessary to defend legal claims. When data is deleted, it is also removed from active systems. Copies may remain temporarily in encrypted backups for a limited technical recovery period before being overwritten or destroyed.

11. AUTOMATED PROCESSING OF PERSONAL DATA

Our services use artificial intelligence and algorithmic processing to personalize your experience and provide recommendations based on your digital twin.

This involves analyzing the information you provide - such as your preferences, inputs, and interactions - to generate suggestions, insights, or potential matches with other users.

However, we do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR.

All AI-generated recommendations are intended to support your choices, not replace them, and you remain in full control of how you use or act upon those results.

We regularly review and monitor our automated systems to ensure fairness, transparency, and accuracy. If we ever introduce forms of automated decision-making that could have significant effects on you, we will notify you in advance and provide clear information about the logic involved and your rights related to such processing.

12. COOKIES

Our website and application use cookies and similar technologies to provide, secure, and improve our services.

Cookies are small text files stored on your device that help us recognize you, remember your preferences, and understand how our platform is used. You can manage cookie preferences in your browser or device settings.

We use the following categories of cookies:

• Strictly Necessary Cookies
  These cookies are essential for the operation of our website and app. They enable basic functions such as user authentication, security, and maintaining sessions. You cannot disable these cookies through the cookie banner or browser settings, as they are required for the service to function.
• Functional Cookies
  These cookies remember your preferences (such as language or interface settings) to enhance your experience. They may also store certain choices related to your digital twin configuration. We activate these cookies only after you provide consent via our cookie banner.
• Analytics Cookies
  We use analytics tools, such as Google Analytics, to understand how users interact with our services and to improve performance. These cookies collect aggregated, anonymous information (for example, which pages are most visited). We activate these cookies only after you provide consent via our cookie banner.
• Optional Personalization Cookies (if applicable)
  With your consent, we may use cookies to personalize recommendations or interactions related to your digital twin. These are not required for service functionality and can be declined without affecting your use of the platform.

When you first visit our website or app, you will see a cookie consent banner that allows you to accept or reject optional cookies („Managing Cookies“).

You can change or withdraw your consent at any time by adjusting your cookie preferences through the banner or your browser settings.

Most browsers allow you to:

• delete cookies,
• block future cookies, or
• receive notifications before cookies are placed.

Please note that disabling certain cookies may limit some functionalities or your ability to use the full features of our platform.

13. CHANGES TO THIS POLICY

Sonder may amend this Policy from time to time to reflect changes in its practices, technologies, legal requirements, or other factors.

When we make material changes, we will notify you in a clear and timely manner - for example, through email, in-app notifications, or a notice on our website.

The date at the top of this Policy always indicates the most recent version.

We encourage you to review this page periodically to stay informed about how we protect your personal data.

If you continue to use our services after an updated Policy takes effect, we will consider that you have read, understood and that you accept the changes.