1. Who we are
This policy explains how Sorted. ("we", "us") handles personal data in connection with Sorted., our customer support service for online shops, and our website.
Contact: hello@sortedinbox.app
For anything about this policy or your personal data, email hello@sortedinbox.app.
2. The two roles we play
Data protection law treats us differently depending on whose data it is:
- We are the controller for personal data about the businesses that use Sorted. and the people who work for them: account and sign-in details, billing contacts, support conversations with us, and visits to our website. This policy mainly covers that data.
- We are a processor for the data our customers put into Sorted. to support their own customers, such as customer emails, order details and chat conversations. The shop is the controller of that data, and we only process it on their instructions under our Data Processing Agreement. Section 5 summarises how we handle it.
3. Personal data we collect as controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, work email, password (stored only as a secure hash), two-factor authentication settings, role, the company you belong to | You, or a colleague who invites you |
| Company data | Company name, website, logo, brand colour, plan and trial dates | You |
| Billing data | Billing contact, billing address, VAT number, invoices, payment status, the last four digits and expiry of your card | You, and our payment provider (we never see or store full card numbers) |
| Usage and technical data | IP address, browser and device type, pages and features used, sign-in times, error logs, security events | Automatically, when you use the Service or website |
| Communications | Emails and messages you send us, feedback, and our replies | You |
We don't intentionally collect special category data (such as health information) about our users, and we ask you not to send it to us.
4. How we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and running your account, providing the Service and its features, and supporting you | Performance of our contract with your business; and our legitimate interest in running the Service for the people who use it on that business's behalf |
| Billing, invoicing, collecting payments and keeping financial records | Performance of contract; legal obligation (tax and accounting records) |
| Keeping the Service secure: authentication, two-factor checks, fraud and spam prevention (including sign-up honeypots and rate limits), abuse detection, logging and backups | Legitimate interests in protecting our customers, their data and our Service |
| Sending service messages: invites, password and security notices, trial and billing reminders, changes to terms | Performance of contract; legitimate interests |
| Understanding how the Service is used, in aggregate, to fix problems and improve it | Legitimate interests in improving our product (we use our own server data, not third-party analytics) |
| Occasional product news to business contacts | Legitimate interests, in line with the Privacy and Electronic Communications Regulations. You can opt out at any time with one click or by emailing us |
| Complying with the law, responding to lawful requests, and establishing or defending legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights and expectations. You can ask us for details of that assessment, and you can object (see section 10).
We do not make decisions about you as a user based solely on automated processing that have legal or similarly significant effects.
5. Data we process for shops (as processor)
When a shop uses Sorted., we process the following on its behalf, only to provide the Service it has asked for:
- its customers' names, email addresses and, where relevant, postal addresses and phone numbers;
- the content of emails, chat conversations and returns requests, including attachments and photos the customer chooses to send;
- order, delivery, refund and product information from the shop's connected store;
- satisfaction ratings and feedback, and technical data such as IP addresses submitted with web forms.
Some of this is processed by AI models, through our sub-processor Anthropic, to classify messages and draft replies. Under our agreements, that data is not used to train AI models. We never use shop data for our own marketing, never sell it, and never combine it across shops. The Data Processing Agreement sets out our obligations in full.
6. Who we share personal data with
We share personal data only with:
- Sub-processors and service providers who help us run the Service, under written contracts that require them to protect it and use it only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic, PBC | AI models that read and draft support replies | United States |
| DigitalOcean, LLC | Application hosting and database | United Kingdom / European Union |
| Laravel Holdings Inc. (Forge) | Server management | United States |
| Stripe Payments Europe, Ltd. | Subscription billing | Ireland / United States |
- Services you connect, such as your email provider and Shopify, when you ask us to exchange data with them;
- Professional advisers such as accountants, auditors, lawyers and insurers, under duties of confidentiality;
- Authorities, such as HMRC, the police or a regulator, where the law requires it or to protect rights, property or safety;
- A buyer or successor if our business, or part of it, is sold or reorganised. They would have to treat your data in line with this policy.
We do not sell personal data, and we do not share it with advertisers.
7. International transfers
Some of our sub-processors are based in, or may access data from, countries outside the UK, including the United States. Where personal data is transferred to a country that the UK has not found to provide adequate protection, we put appropriate safeguards in place, namely:
- the UK International Data Transfer Agreement (IDTA), or the European Commission's Standard Contractual Clauses together with the UK Addendum issued by the Information Commissioner; or
- for US organisations certified to it, the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge");
together with a transfer risk assessment and supplementary measures such as encryption in transit. You can ask for a copy of the relevant safeguards by emailing hello@sortedinbox.app.
8. How long we keep it
| Data | Retention |
|---|---|
| Account and company data | While your account is open, then deleted within 60 days of closure (30 days for you to request an export, then up to 30 days to delete) |
| Billing and tax records | Six years after the end of the financial year they relate to, as UK law requires |
| Security and server logs | Usually up to 90 days, longer only where needed to investigate an incident |
| Backups | Overwritten on a rolling basis within 35 days |
| Our correspondence with you | Up to two years after the conversation ends, unless needed longer for a legal claim |
| Shop data we process as processor | As the shop instructs, and deleted after the shop's account closes as set out in the DPA |
9. How we protect it
We use appropriate technical and organisational measures, including encryption in transit (TLS) for all traffic, encryption at rest for stored credentials and connection secrets, passwords stored only as salted hashes, two-factor authentication, strict separation of each company's data, least-privilege access for our staff, logging and monitoring, regular backups and prompt security updates. No system is perfectly secure, but if something goes wrong we will act quickly and tell the people affected as the law requires.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected, or incomplete data completed;
- have your data erased in certain circumstances;
- restrict how we use your data in certain circumstances;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- data portability: receive data you gave us in a structured, machine-readable format, or have it sent to someone else, where processing is based on contract or consent;
- withdraw consent at any time, where we rely on it.
To use any of these rights, email hello@sortedinbox.app. We may need to confirm your identity. We will respond within one month, or tell you within that month if we need longer (up to two further months for complex requests). There is normally no fee.
If your request is about data a shop holds about you as its customer, we will pass it to that shop, which is responsible for answering it.
11. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113. If you are in the European Economic Area, you can also complain to your local supervisory authority.
12. Cookies
We use only the cookies that are strictly necessary to sign you in and keep forms secure. We don't use analytics, advertising or tracking cookies. Our Cookie Policy lists them.
13. Children
Sorted. is a service for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children as users of our Service.
14. Changes to this policy
We will update this policy when our practices change. If the changes are significant, we will tell account administrators by email or in the panel before they take effect. The date at the top shows when it was last updated.
Questions about this document? Email hello@sortedinbox.app and a person will reply.