Privacy policy

SortedMate Ltd ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website or use our service.

Information We Collect

Contact Form Data

When you submit our contact form, we collect:

• First name and last name
• Email address
• Phone number (optional)
• Company name (optional)
• Your message

This information is used solely to respond to your enquiry and is stored securely in our database hosted by Supabase.

Account Information

When you create an account, we collect your name, email address, profile photo, and business details (business name, address, VAT number, company registration) to provide our service. Authentication is managed by Clerk.

Business Data

Data you enter into SortedMate (customers, quotes, jobs, invoices, file attachments, site photos) belongs to you and is processed solely to provide our service. See our Data Processing Terms for details on how we handle your clients' data.

Communications Data

When you use our messaging features, we process email content (via Resend), SMS content, and WhatsApp messages (via Twilio) to deliver communications on your behalf.

Payment Information

Subscription payments are processed by Stripe. We store only the last 4 digits of your card and billing address. Full card details are never stored on our servers.

Payment Processing Information (Stripe Connect)

When you enable SortedPay, our integrated payment feature, we collect and process additional information in connection with Stripe Connect:

• Stripe connected account identifiers and onboarding status
• Business verification status (charges enabled, payouts enabled, details submitted)
• Payment transaction data (payment intent IDs, amounts, currency, status)
• Payout status and timing
• Account capabilities and requirements

This information is collected from Stripe via webhook events and API calls. We do not collect or store card numbers, bank account numbers, or other sensitive financial credentials — these are handled exclusively by Stripe.

When you provide personal data in connection with payment processing, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy.

AI Interactions

When you use our AI features (quote enhancement, job title suggestions, enquiry parsing, AI assistant), your prompts and generated content are processed by OpenAI. We store conversation history to provide continuity.

Analytics Data

With your consent, we collect anonymised analytics (pages visited, features used, device type) via PostHog to improve our service.

Technical Information

We automatically collect browser type, device type, and IP address (hashed, not stored raw) to ensure security and improve performance.

Integration Data (Optional)

If you connect third-party services (Xero, QuickBooks, Google Calendar, Outlook Calendar), we sync relevant data as directed by you. These integrations are optional and can be disconnected at any time.

Google Calendar

If you connect Google Calendar, we read the events in it for the next 30 days and store each event's title, times, location, description and link, so SortedMate can show when you're busy. An event you delete from your calendar is removed from our copy at the next sync. When you book a visit in SortedMate, we can add it to your calendar, and update or remove it if the visit changes. You can disconnect Google Calendar at any time.

Google Analytics and Search Console (Website Service)

For websites we build and host for you, we read your site's visitor and search statistics from Google Analytics and Google Search Console, using SortedMate's own access to those accounts, and show them to you in SortedMate.

Google Business Profile

Direct Google Business Profile integration is in development and is not currently available. Before you can connect a profile, we will explain the permissions requested and update this policy with the Google data accessed, its purpose, storage, sharing, retention and deletion. Existing Google Maps and Calendar features are described separately in this policy.

If you use our website service and ask us to help with your Google Business Profile, we work as a manager you invite through Google. You keep ownership of your profile and can remove our access at any time in Google Business Profile.

Facebook & Instagram (Social Auto-Publishing)

If you connect a Facebook Page so SortedMate can publish posts on your behalf, we collect and store:

• The connected Facebook Page's name and ID, and any linked Instagram business account ID
• A Page/Instagram access token, held encrypted in a secure vault and never exposed to your browser or to other users
• Your Meta user ID, used solely to map Meta data-deletion requests back to your connection
• The posts you approve for publishing and their publish status

We request only the permissions needed to publish content you have approved to your own Page (pages_show_list, pages_read_engagement, pages_manage_posts), plus business_management, which lets you connect a Page owned by your business portfolio. We do not read anything about the portfolio itself. We do not read your personal Facebook profile, friends, messages, or ad accounts.

If you connect an Instagram professional account (Business or Creator) directly, with Instagram Login, we collect and store:

• The account's username, its Instagram account ID, and the app-scoped user ID Instagram gives us, which we use to map deauthorisation and data-deletion requests back to your connection
• An Instagram access token, held encrypted in a secure vault and never exposed to your browser or to other users
• The posts you approve for Instagram, their publish status, and the ID and link of each one we publish

While you confirm which account to connect, we briefly hold its profile picture link and account type so we can show it back to you. They are deleted when you confirm, or within about a day if you don't.

We request only instagram_business_basic, to read your own account's username and type, and instagram_business_content_publish, to publish photos you have approved. We do not read your followers, insights, comments, direct messages, or anyone else's content. Instagram only accepts certain photo shapes, so we may save a cropped copy of the photo you chose next to the original in your SortedMate media.

You can delete this data at any time by disconnecting the integration in SortedMate, by removing the app in your Facebook or Instagram settings, or via our data deletion page.

SortedMate Chrome Extension

Our extension for Google Chrome adds products from supplier websites to your SortedMate quotes. It works only while you are signed in to SortedMate.

What it reads

• Your SortedMate sign-in. The extension reads the sign-in cookie that SortedMate (through Clerk) sets when you sign in at app.sortedmate.com, so you don't have to sign in twice. It reads no cookies from any other website.
• Product pages, only when you ask. When you press "Add this page" in the extension's panel, or the "Add to SortedMate" button on a supplier's site you have switched on, the extension reads that page's product name, product code, price, whether the price includes VAT, the quantity and the page address. Where a supplier shows you your own account price (for example Howdens), it reads that price from the page in your browser; we never sign in to a supplier's website or see your password for it.
• On supplier sites you have switched on, the extension looks at each page to decide whether to show its button. That stays in your browser: nothing from a page leaves your computer until you press "Add this page" or the button. Shops we haven't tested are switched on one site at a time, only when you allow that site in Chrome.

What it keeps on your computer

• Products you have added but not yet put on a quote, kept separately for each account and business. They are deleted when you sign out in the extension, or when someone else signs in on the same computer.
• The supplier and shop sites you have switched on, kept until you switch them off in the extension's settings or remove the extension.
• The panel's remembered choices: the quote you last picked (with its customer's name), sites you marked "Not a shop", sites where you hid the button, and whether you've seen the welcome screen.

What it sends to SortedMate

• The products you choose to add, so we can price them with your trade discount, markup and VAT settings and add them to the quote you pick. They become quote lines in your account and are handled like the rest of your Business Data. To let you pick a quote or a customer, the panel shows your business's quotes and customers from your SortedMate account.
• Usage counts when you add products: the shop's website name (for example diy.com), whether it is a supplier we have tested, what happened (for example "added") and how many lines. These are linked to your business, not to you personally, and never include the product, the price, the page address or your customer. They are sent from our servers to PostHog (EU-hosted product analytics), and we use them to see which shops traders use, so we can test and support more of them (legitimate interests).

What it doesn't do

• It doesn't track your browsing, record the pages you visit or run on every website.
• It runs no analytics or advertising code in your browser and doesn't load code from the internet.
• We don't sell this data, use it for advertising, or use it to decide creditworthiness or lending.

Limited Use. SortedMate's use of information received from the Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

You can remove the extension at any time from Chrome's extensions page (chrome://extensions), which deletes everything it keeps on your computer.

Marketing Attribution

When you arrive via a marketing campaign, we may capture UTM parameters (source, medium, campaign) from the URL to understand which marketing efforts are effective. This data is associated with contact form submissions only.

How We Use Your Information

• Respond to your contact form enquiries
• Provide, maintain, and improve our service
• Process payments and manage subscriptions
• Send transactional emails, SMS, and WhatsApp messages on your behalf
• Provide AI-powered features (quote enhancement, enquiry parsing, job suggestions)
• Sync data with third-party integrations you connect (accounting, calendar)
• Price and add supplier products you choose with our Chrome extension, and count which shops are used with it
• Send important service notifications
• Respond to your support requests
• Understand how our service is used (with consent)
• Detect and prevent fraud and abuse
• Comply with legal obligations (including HMRC record-keeping)

Legal Basis for Processing (UK GDPR)

Data Sharing & Third Parties

We do not sell your personal information. We share data only with trusted service providers who are contractually bound to protect your data, including Stripe Payments UK Ltd, which provides payment processing and connected account services via Stripe Connect. We share your business information, transaction data, and verification status with Stripe to facilitate payment collection from your customers. See the Stripe Privacy Policy for details on how Stripe handles your data. For a full list of providers with details, see our Sub-Processors page.

Core Service Providers

User-Enabled Integrations

These providers only receive your data if you choose to connect the integration:

Meta (Facebook/Instagram) — when you connect a Page or an Instagram account and approve a post, we send that post's text and image to Meta's APIs to publish it on your behalf. Nothing is published without your approval; you can pause auto-posting or disconnect at any time.

We may also share data with legal authorities when required by law.

Cookies & Tracking

Essential Cookies (Required)

These are necessary for the website to function and cannot be disabled.

Analytics Cookies (Optional)

With your consent, we use PostHog to track anonymous usage patterns. You can accept or reject these via the cookie banner, and change your preference at any time using the "Cookie Preferences" link in the footer.

Data Retention & Security

When you delete your account, your personal data and business data will be permanently removed within 30 days. Backup copies are purged within 90 days of deletion.

We implement industry-standard security measures including encryption in transit (TLS) and at rest, secure data centres, and regular security reviews. You can request deletion of your data at any time.

Your Rights (UK GDPR)

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict processing of your data
• Export your data in a portable format
• Object to certain processing
• Withdraw consent where applicable
• Lodge a complaint with the ICO (ico.org.uk)

To exercise these rights, contact us at privacy@sortedmate.com. We will respond to your request within 30 days. In exceptional circumstances, where your request is particularly complex, we may extend this by a further 60 days and will inform you of any such extension.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required under UK GDPR Article 33.

Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, providing details of the breach, its likely consequences, and the measures we have taken or propose to take to address it.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

AI Features

SortedMate uses AI (powered by OpenAI) to provide optional features such as quote enhancement, enquiry parsing, job title suggestions, and a chat assistant. These features process text you provide to generate suggestions, but do not make decisions on your behalf. You always retain full control over whether to accept, modify, or reject AI-generated suggestions. AI interactions are logged for service continuity and are not used to train third-party AI models.

International Transfers

Your core business data is stored in the UK (Supabase, AWS eu-west-2, London). PostHog analytics data is EU-hosted. Several service providers process data in the United States, including Clerk (authentication), Stripe (payments), Twilio (messaging), Resend (email), OpenAI (AI features), and Google (Maps, Calendar, reCAPTCHA).

For transfers to the US, our providers participate in the EU-US Data Privacy Framework (UK Extension) or we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses. Transfer Impact Assessments have been conducted for all transfers to countries without a UK adequacy decision.

Stripe processes data in the EU and US. Transfers are protected under Stripe's Data Processing Agreement, which incorporates UK Standard Contractual Clauses. See Stripe's DPA for details.

Data Protection Contact

While we are not required to appoint a Data Protection Officer, our designated data protection contact is responsible for overseeing data protection matters. You can reach them at privacy@sortedmate.com.

Children's Privacy

Our service is not intended for children under 18. We do not knowingly collect data from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our service. The "Last updated" date at the top indicates when changes were made.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

• Email: privacy@sortedmate.com
• SortedMate Ltd
• 3rd Floor, 86-90 Paul Street
• London, EC2A 4NE
• United Kingdom
• Company Registration No: 16880125
• ICO Registration No: ZC090709