Privacy Notice — the SOAR application
Effective August 24, 2026
This covers the SOAR desktop application and the SOAR API behind it: what goes in, where it goes, who can see it, and how long it stays.
SOAR CRM LLC ("SOAR", "we", "us") provides the software.
Who is responsible for what
This distinction runs through the whole document, so it is worth being precise about it up front.
Your workspace data is yours. The companies, contacts, deals, tickets, invoices, emails and spreadsheets you put into SOAR belong to your business. You decide what goes in, what it is used for, and when it comes out. In the language of privacy law, you are the controller and we are your service provider (or processor). We process that data to run the service for you and for nothing else — we do not mine it, we do not sell it, and we do not use it to build features for anyone else.
Your own account data is ours to explain. Your name, your email address, your login and billing details are things we hold in our own right in order to have you as a customer. For those, we are the controller.
If you are a customer of one of our customers and your details are in their SOAR workspace: we are not the right people to ask. Contact the business you dealt with. We will help them answer you, and we will not answer for them, because their data is not ours to hand out.
1. What is in the application
Your account
Name, email address, a bcrypt hash of your password, your two-factor authenticator secret, session tokens, and — if you tick "remember this machine" — a hashed device token. Also the times and IP addresses of sign-in attempts, which is how the account lockout works.
We cannot read your password. Nobody at SOAR can tell you what it is.
Your workspace
Everything the CRM is for: companies, contacts, deals, tickets, projects, contracts, quotes, invoices, payments, expenses, time entries, and the notes and attachments on them. Whatever your business puts in, including personal information about your own customers and staff.
Connected mailboxes
If you connect a mailbox (IMAP, Microsoft 365, or Google), SOAR reads mail from it to triage it, file it against the right record, and draft replies. That means the content of those emails is processed by SOAR and by our AI provider, including anything your correspondents wrote.
Mailbox credentials are encrypted at rest and are never returned by the API, not even to you.
Connected bank and card feeds
If you connect an account through Plaid, SOAR receives transaction data — dates, amounts, merchant descriptors, and the last four digits of the card — to code expenses. Plaid holds the connection to your bank; we never see your banking password.
Uploaded spreadsheets
When you drop a spreadsheet on an agent to have it coded, the original file is stored on our servers exactly as you sent it. This is deliberate: it is the only way to hand the file back to you with the blanks filled in and everything else — your formatting, your other sheets, your formulas — byte-for-byte unchanged.
SOAR refuses files containing full payment card numbers. If a file you upload contains one, the upload is rejected with an explanation and the file is not stored. Please do not attempt to work around this.
What the agents learn
When you correct something an agent did, SOAR keeps the before-and-after so it does the right thing next time. This learned material — your vocabulary, how you code each merchant, examples of your own corrections — is scoped to your workspace and is never shared with another customer, whatever similarity there is between your business and theirs. This is enforced in the database structure, not only in application code.
Usage and diagnostics
Error logs and API request logs for keeping the service running, and a record of AI spend per workspace so you can see what the AI features cost you.
2. Artificial intelligence
SOAR uses AI to triage inbound mail, draft replies, answer questions in the agent chat, and code spreadsheets and statements. You should understand exactly what that means for your data.
Your data leaves our servers to do it. The relevant content — the email, the record, the spreadsheet rows — is sent to Anthropic, who run the model.
Anthropic does not use it to train their models. That is their commercial position and is the basis on which we send it.
Anthropic is currently the only AI provider that receives your data. Our software supports alternatives, but none is enabled. If that ever changes we will update this notice and tell affected customers before switching it on.
The AI cannot act on its own. Every consequence in SOAR — creating a record, sending an email, filing an expense — is decided by our code, not by the model. Outbound email is held for your approval unless you have explicitly turned that off for a department. When coding a spreadsheet, the model chooses from values your business has already used rather than inventing new ones.
It is not always right. Confidence scores are shown, low-confidence rows are flagged, and you are expected to review before you file anything. SOAR assists your judgement; it does not replace it.
You are always told when you are talking to an AI, in the app and on our website.
3. Staff access to your workspace
We can open your workspace, and you should know exactly how that works.
SOAR is sold with configuration and training included, which means someone here sometimes needs to work inside your workspace — to set up an agent, teach it how you code your expenses, or diagnose something that only reproduces in your data. Rather than pretend this does not happen, we built it as a controlled feature:
- A written reason is required before a session can start. It is stored and cannot be skipped.
- Every session expires, and access ends automatically. There is no permanent staff login to your workspace.
- It is under our staff member's own name, never yours. Nothing done in your workspace by us will ever appear to have been done by one of your people.
- Every change is logged against that session.
- Staff act as an administrator, not an owner. We cannot remove your owner account or close your workspace.
You can ask us at any time for the log of who has opened your workspace, when, and why, and we will send it to you. Write to hello@soar-crm.com.
4. Who else touches your data
| Who | What they do | Where |
|---|---|---|
| DigitalOcean | Hosts the SOAR API and database | New York, United States |
| Anthropic | Runs the AI models | United States |
| Resend | Sends product email (invites, resets, notifications) | United States |
| Plaid | Bank and card feeds, if you connect one | United States |
| Cloudflare | DNS and network protection | Global |
| Microsoft / Google | Only if you connect their mailbox or calendar; your own provider, under your own agreement with them | Global |
We do not sell your personal information. We do not share it for advertising. We do not disclose it to anyone not on this list, except where we are legally required to — and if we ever receive a demand for your data, we will tell you unless we are legally forbidden from doing so.
5. How long we keep things
| What | How long |
|---|---|
| Deleted records | 90 days in a recoverable hold, then permanently destroyed |
| Workspace data | While your account is active |
| After you cancel | 30 days to export, then deleted within 90 days |
| Uploaded spreadsheets | 12 months, or until you delete the upload |
| Agent chat transcripts | 12 months |
| Staff access logs | 3 years — deliberately longer than everything else, because an audit trail that expires before an audit is not an audit |
| Sign-in attempt records | 12 months |
| Invoicing and tax records | 7 years, as tax law requires |
When you leave, you can take your data with you. Ask and we will export your workspace in a machine-readable format. We will not hold it hostage.
6. Security
What we actually do:
- Traffic to the API runs over HTTPS.
- Passwords are bcrypt hashed. Two-factor authentication is mandatory for every account, not optional.
- Connector credentials are encrypted at rest.
- Sessions expire, can be revoked individually, and can be killed everywhere at once by a password reset.
- Workspaces are separated in the database structure itself, so one customer's data cannot be reached from another's account.
- Signing out, resetting a password, or removing a staff member takes effect immediately rather than when a token happens to expire.
- We run an adversarial test suite against the authentication and tenant isolation before each release.
What we do not claim:
- We hold no security certification. We are not SOC 2 audited and not ISO 27001 certified. When that changes we will say so here and not before.
- We have not had an independent penetration test. Our testing is our own.
- No system is unbreachable, including ours.
If we discover a breach affecting your data, we will tell you without undue delay — what happened, what was affected, and what we are doing about it — and notify authorities as Georgia and Texas law require.
7. Your rights
You can ask us to show you what we hold, correct it, delete it, or export it. Write to hello@soar-crm.com; we respond within 45 days.
If you are in Texas, the Texas Data Privacy and Security Act gives you these rights formally, plus a right to appeal a refusal. To appeal, reply to our decision saying so; we will respond within 60 days and, if we still refuse, tell you how to complain to the Texas Attorney General.
Georgia has no comprehensive consumer privacy statute at the time of writing. We apply the same process to everyone.
Requests about data inside a customer's workspace go to that customer, not to us. We will help them respond. We will not hand over their records to somebody who asks us directly, and you would not want us to.
8. Where your data is
The United States. We do not currently operate in other regions.
If your business serves customers in the EU or UK, their data may end up in your SOAR workspace and therefore on US infrastructure. That is a transfer you are responsible for as the controller — ask us for a Data Processing Addendum and we will provide one.
9. Children
SOAR is business software, not directed at children, and we do not knowingly collect information from anyone under 18.
10. Changes
The date at the top changes when this notice does. For anything significant — a new subprocessor, a new category of data, a change in how AI is used — we will notify workspace owners by email before it takes effect, not after.
Contact
SOAR CRM LLC 100 Holly Park Court, Holly Springs, GA 30115 hello@soar-crm.com