Skip to main content

Privacy Policy

Last updated: October 2026

1. Introduction

Welcome to Sovarium. We are committed to protecting your privacy and handling your data transparently and securely. This Privacy Policy explains how Sovarium Ltd ("we," "us," "our") collects, uses, and protects information when you use our AI-powered data analysis platform.

By using Sovarium, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

2.1 Account Information

When we set up your organization's account, we collect:

  • Name and email address of authorized users
  • Organization name, contract and billing information, and the invoices we issue
  • Credentials for connecting to your data sources (encrypted at rest with AES-256-GCM)

2.2 Usage Data

We collect information about how you interact with our platform:

  • The questions you ask, your conversations with the AI assistant, and the SQL generated to answer them
  • The answers, charts, dashboard cards, alerts and opportunities produced for you
  • Feature usage and query metrics, and analytics derived from conversations (such as topic and sentiment)
  • IP address and browser user agent, used to secure your session

2.3 Data Source Connection Information

To provide our services, we store:

  • Encrypted data source credentials (AES-256-GCM encryption at rest)
  • Database schema metadata (table names, column names, data types)
  • Your Context Layer configuration (business-friendly descriptions and relationships)

2.4 Anomalies Monitoring Data

If your organization uses Anomalies, then for each table you choose to monitor we store:

  • Column profiles: statistics such as row counts, load times, null rates, distinct counts, value ranges and value formats, plus up to 10 sample values per text column (each cut to 100 characters) to learn those formats
  • The baselines learned from those profiles over time
  • Scan results: the findings each nightly scan raises, their severity, the AI-generated diagnosis, the evidence behind it (including up to 20 example rows from the query that confirmed it), and your team's triage decisions (confirmed, dismissed, snoozed)

3. How We Handle Your Data

3.1 Querying Your Data

  • Queries run in your data warehouse. We send SQL to your warehouse and receive the results on our servers in London, where they are processed to produce answers and charts.
  • Every query is validated before it runs. Only read queries pass our SQL validator. For PostgreSQL, MySQL and ClickHouse we also open the session in read-only mode; for other warehouses, read-only access depends on the credentials you provide, so we ask you to connect with a read-only user.
  • Full result sets are not stored. What we keep is described in 3.3; it can include individual rows where an answer, chart, card or finding needs them.
  • Credentials are encrypted at rest. Data source credentials and Slack tokens are encrypted with AES-256-GCM before storage.

3.2 What the AI Can Access

To answer questions and diagnose findings, our AI models receive:

  • Database schema information (table and column names, data types) and your Context Layer
  • Your question and the conversation so far
  • The results of the queries it runs: up to the first 100 rows of each result, plus summary statistics for each column
  • The data prepared for each chart and dashboard card it creates (up to 500 rows for a card)
  • For Anomalies, the column profiles, baselines (including the sample values above) and check results of a flagged table, and the rows it queries to investigate a finding

These can include individual records, and any personal data in the columns queried. Alert evaluations make no AI call. We use OpenRouter to reach AI models and configure it to route requests only to model providers with zero data retention, which do not store your data or use it for training.

3.3 Data Retention

We retain different types of data for varying periods:

  • Chat answers and charts: Kept until deleted, unless your organization's admins set a retention period (1 to 365 days). Admins can also delete all stored answers at any time. Chart data can include the rows the chart plots.
  • Questions, generated SQL and conversations: Kept for the life of your organization's account. Deleting a conversation removes it from your view; the records are retained.
  • Command View insights: Deleted after 30 days. Dashboard cards, with a snapshot of up to 500 rows of their data, are kept while they are on your dashboard and deleted within two days of removal.
  • Opportunities: Kept for the life of your organization's account, including their supporting evidence (up to 100 rows). Your feedback on them expires after 6 months, or 30 days after you remove it.
  • Alert history: Deleted after 90 days.
  • Anomalies findings: Deleted after your organization's history period (30 days by default, configurable from 1 to 365 days). Column profiles: deleted after 180 days. Both remain for these periods after a table stops being monitored.
  • Sessions: Expire after 7 days of inactivity, and after 30 days at most.
  • Account data: Kept while your organization's account exists, including while it is suspended. When your contract ends, we remove your data source credentials and Slack connection and delete your organization's account and its data within 30 days. Copies in backups expire on their normal cycle. To have your organization's data deleted sooner, contact privacy@sovarium.com.
  • Staff access logs: Every time Sovarium staff access your organization's data, we record who, what, when, and their IP address and browser. These logs are kept indefinitely for security purposes.
  • Operational logs: Record request metadata such as identifiers, timings and errors. They do not record your questions or query results, though part of a blocked or failing SQL query may be logged.

4. How We Use Your Information

We use collected information for the following purposes:

  • Service provision: To provide, operate, and maintain our platform
  • Query generation: To generate accurate SQL queries based on your natural language questions
  • Platform improvement: To improve our platform features, using usage metrics and conversation analytics. We do not use your data to train AI models, and we test our AI with synthetic data, not yours.
  • Communication: To send service updates, security alerts, and support messages
  • Security: To detect and prevent fraud, abuse, and security incidents
  • Compliance: To comply with legal obligations and enforce our Terms & Conditions

5. Information Sharing

We do not sell your data. We share information only in the following limited circumstances:

  • Service providers: These companies process data on our behalf to run the platform:
    • Cloudflare: DNS, network security, and hosting of our websites
    • Fly.io: application servers (London)
    • Supabase: database and authentication (London)
    • Redis Cloud: sessions and job queues (London)
    • OpenRouter, and the AI model providers it routes to (such as Google): AI processing, with zero data retention
    • Resend: email delivery
    • FreeAgent: accounting and invoicing
    • Google: Sign in with Google, if you use it
    • Attio: our CRM, for enquiries sent through the contact form on sovarium.com and for customers' account, contract and billing details
  • Delivery channels you connect: Alerts and the Anomalies morning digest are sent by email, and to Slack if your organization connects a Slack workspace. Answers to questions asked in Slack, including their charts, are posted to Slack.
  • Legal requirements: We may disclose information if required by law, court order, or government regulation
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity

6. Your Rights (GDPR)

If you are in the UK or the European Economic Area, you have the following rights under GDPR:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your personal data ("right to be forgotten")
  • Restriction: Request restriction of processing of your data
  • Portability: Request transfer of your data to another service
  • Objection: Object to processing of your data for certain purposes

To exercise any of these rights, please contact us at privacy@sovarium.com.

7. Data Transfers

We host your data in London, United Kingdom. Some of our service providers, such as AI model providers and email delivery, may process it in other countries. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8. Cookies and Tracking

On this website (sovarium.com), we use Google Analytics 4, provided by Google, to understand how visitors use the site and to measure our advertising. It only runs if you accept it in the cookie banner. Until then, Google's tag is not loaded and no analytics cookies are set.

  • sovarium_consent: remembers whether you accepted or rejected analytics, so we don't ask on every visit. Strictly necessary; kept for 180 days.
  • Google Analytics cookies (_ga, _ga_*): set only after you accept. They distinguish visitors and sessions; Google keeps them for up to two years.

You can change your choice at any time with the "Cookie settings" link in the footer of every page, or by clearing the cookies in your browser.

In the Sovarium platform (app.sovarium.com), we use essential cookies only, for authentication and core platform functionality. Disabling them in your browser will prevent you from signing in.

9. Security Measures

We implement industry-standard security measures to protect your data:

  • TLS/HTTPS encryption for all data in transit
  • AES-256-GCM encryption for sensitive data at rest (data source credentials, Slack tokens, session tokens)
  • Role-based access controls, with each organization's data isolated at the database level
  • Sign in with Google, and two-factor authentication (TOTP) that your organization can require
  • Sessions bound to the browser and IP address they were created on
  • Staff access to customer data restricted to Sovarium employees and logged

While we take extensive measures to secure your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes via email or through a prominent notice on our platform. Continued use of Sovarium after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us: