Privacy policy

Effective from 29.10.2026

Who we are

Sonorus Cloud (cloud.sonorus.ee) is the work environment of Sonorus OÜ. The controller of personal data is Sonorus OÜ, registry code 14390795, Rukki tee 2, Lehmja küla, Rae vald, 75306 Harju maakond, Estonia. Questions and requests: tere@sonorus.ee.

What data we process

• When you sign in with Google: your name, e-mail address and whether Google has verified the address. Sign-in does not ask for your contacts, files or calendar.
• User account: role, access rights, language and preferences, time of last sign-in.
• Activity log: who did what in the portal and when.
• Content you add yourself: texts, images, files, videos and messages.
• Work data from other Sonorus tools (e.g. Rentman and Merit Aktiva): projects, clients and crew.

What for

• To recognise you and show only what you are allowed to see.
• To make the portal work: projects, schedules, knowledge base and videos.
• For security and audit.

The legal basis is the performance of an employment or cooperation contract and the legitimate interest of Sonorus OÜ in organising its work. Data is not sold, nor used for advertising or for training artificial intelligence models.

YouTube

Sonorus Cloud uses YouTube API Services. An administrator connects the Sonorus YouTube channel to the portal; Google then allows the portal to upload videos to the channel, read their processing status and delete videos uploaded by the portal that no page has used for 30 days (youtube.upload, youtube.readonly, youtube.force-ssl). We keep the channel ID, the channel name and an encrypted token. They are used only to upload and clean up videos and are not shared with anyone.

A video added to the knowledge base is uploaded to the channel as an unlisted video and shown on the page in the YouTube player. The player and the preview image come from Google’s servers; the Google Privacy Policy applies to them, and the YouTube Terms of Service apply to using YouTube.

You can revoke access at any time: in the portal under Administrator → Knowledge: YouTube → Disconnect, or in Google’s security settings. When disconnected, we revoke the token immediately and delete the channel data. If access is revoked on Google’s side, we delete it within one day.

Gmail

A project manager may connect their own Gmail account to the portal to send a quotation to a client and an inquiry to a subcontractor directly from the portal. Google then gives the portal permission only to send email (gmail.send). The portal sends a message only when you press “Send” yourself, only from your own account and only to the recipients you entered; the message ends with a note that it was prepared automatically in Sonorus Cloud.

We do not read your mailbox, messages, contacts or calendar, and this permission does not allow it. We keep your email address and an encrypted token; for a sent message, the activity log keeps the time, the number of recipients and the Gmail message ID. For a quotation, the quotation, its recipients and the message text are kept with the project like any other issued quotation; for a subcontractor inquiry, the project keeps the subcontractor’s name, the requested items and quantities, the sender, the time and the message and thread IDs (so that a change can be sent later in the same thread); the portal does not keep the text or recipients of the inquiry. A subcontractor’s reply also goes to Sonorus’s mailbox toivo@sonorus.ee: Toivo (Claude) reads that mailbox — only that one, not people’s mailboxes — and records what the subcontractor confirmed; the replier’s own text (without quotes) and the confirmations are kept with the project.

You can revoke access at any time: in the portal (Preferences → General → Gmail → Disconnect) or in Google’s security settings. When disconnected, we revoke the token immediately and delete it. If access is revoked on Google’s side, we delete the token on the next sending attempt.

Sonorus Cloud’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Toivo

Toivo is the AI assistant of Sonorus. When you talk to Toivo, your messages and name are processed with Anthropic’s Claude model to answer you. YouTube channel data, Gmail and other Google tokens are not given to Toivo.

Cookies

The portal uses only necessary cookies: the sign-in session, a security token, the language choice and a one-time sign-in check code. View preferences, such as light or dark theme, are kept in the browser’s local storage. There are no tracking or advertising cookies.

Where and how long

Data is kept on the Sonorus OÜ server (cloud.sonorus.ee) and its backups, for as long as needed for the purposes above or as required by law.

Your rights

You can ask what data we hold about you and request that it be corrected or deleted: tere@sonorus.ee. If you believe we are violating your rights, you can contact the Estonian Data Protection Inspectorate.

Changes

If this policy changes, we update the date here.