Privacy Policy

Soda (soda.rs) is a private workspace for business email, leads and deals. This policy explains what we collect, why, and the choices you have.

What we collect

• Account data: your email address, name and the sessions you sign in with.
• Workspace data: the projects, contacts, companies, leads, deals, tasks and notes you and your team keep in Soda.
• Gmail data, only for mailboxes you connect: message metadata and content, labels and attachments metadata, used to show your conversations and keep your CRM up to date.
• Security records: an audit log of changes and sign-ins, without email bodies or secrets.

How we use it

• To provide the features you use: the unified inbox, CRM records, replies sent from your own Gmail account.
• To keep the service secure: authentication, rate limiting and abuse prevention.
• We do not sell data, use it for advertising, or use it to train general AI models.

Google user data and Limited Use

Soda's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide and improve user-facing features of Soda, is not transferred to others except as needed to provide those features, to comply with law, or as part of a merger with your notice, and is never used for advertising. People at Soda do not read your Gmail data unless you ask us to for support, it is needed for security or legal reasons, or it has been aggregated and anonymized.

AI processing

AI features are optional and controlled per workspace and project. When enabled, only the minimum needed content is sent to the AI provider your workspace selected, under terms that do not allow training on your data. AI suggestions never send email or delete anything on their own.

Where data is processed

We use these processors: Vercel (hosting), Neon (database), Resend (system emails such as sign-in links), Google (Gmail, when you connect it) and, if you enable AI, OpenAI or Anthropic.

Retention and deletion

You can disconnect a mailbox at any time, which stops syncing and revokes our access. Workspace owners can export data and ask for deletion. Some security records are kept as long as the law requires.

Your rights

Depending on where you live, you may have rights to access, correct, export or delete your data. Contact us at privacy@soda.rs.