SortedMate Ltd (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website or use our service.
Information We Collect
Contact Form Data
When you submit our contact form, we collect:
- First name and last name
- Email address
- Phone number (optional)
- Company name (optional)
- Your message
This information is used solely to respond to your enquiry and is stored securely in our database hosted by Supabase.
Account Information
When you create an account, we collect your name, email address, profile photo, and business details (business name, address, VAT number, company registration) to provide our service. Authentication is managed by Clerk.
Business Data
Data you enter into SortedMate (customers, quotes, jobs, invoices, file attachments, site photos) belongs to you and is processed solely to provide our service. See our Data Processing Terms for details on how we handle your clients' data.
Communications Data
When you use our messaging features, we process email content (via Resend), SMS content, and WhatsApp messages (via Twilio) to deliver communications on your behalf.
Payment Information
Subscription payments are processed by Stripe. We store only the last 4 digits of your card and billing address. Full card details are never stored on our servers.
Payment Processing Information (Stripe Connect)
When you enable SortedPay, our integrated payment feature, we collect and process additional information in connection with Stripe Connect:
- Stripe connected account identifiers and onboarding status
- Business verification status (charges enabled, payouts enabled, details submitted)
- Payment transaction data (payment intent IDs, amounts, currency, status)
- Payout status and timing
- Account capabilities and requirements
This information is collected from Stripe via webhook events and API calls. We do not collect or store card numbers, bank account numbers, or other sensitive financial credentials — these are handled exclusively by Stripe.
When you provide personal data in connection with payment processing, Stripe receives that personal data and processes it in accordance with the Stripe Privacy Policy.
AI Interactions
When you use our AI features (quote enhancement, job title suggestions, enquiry parsing, AI assistant), your prompts and generated content are processed by OpenAI. We store conversation history to provide continuity.
Analytics Data
With your consent, we collect anonymised analytics (pages visited, features used, device type) via PostHog to improve our service.
Technical Information
We automatically collect browser type, device type, and IP address (hashed, not stored raw) to ensure security and improve performance.
Integration Data (Optional)
If you connect third-party services (Xero, QuickBooks, Google Calendar, Outlook Calendar), we sync relevant data as directed by you. These integrations are optional and can be disconnected at any time.
Facebook & Instagram (Social Auto-Publishing)
If you connect a Facebook Page so SortedMate can publish posts on your behalf, we collect and store:
- The connected Facebook Page's name and ID, and any linked Instagram business account ID
- A Page/Instagram access token, held encrypted in a secure vault and never exposed to your browser or to other users
- Your Meta user ID, used solely to map Meta data-deletion requests back to your connection
- The posts you approve for publishing and their publish status
We request only the permissions needed to publish content you have approved to your own Page (pages_show_list, pages_read_engagement, pages_manage_posts). We do not read your personal Facebook profile, friends, messages, or ad accounts.
You can delete this data at any time by disconnecting the integration in SortedMate, by removing the app in your Facebook settings, or via our data deletion page.
Marketing Attribution
When you arrive via a marketing campaign, we may capture UTM parameters (source, medium, campaign) from the URL to understand which marketing efforts are effective. This data is associated with contact form submissions only.
How We Use Your Information
Legal Basis for Processing (UK GDPR)
Consent
For analytics cookies and marketing communications
Contract
To provide our service when you have an account, including processing of Stripe Connect data to provide SortedPay payment features
Legitimate interests
To respond to enquiries and ensure security (Legitimate Interest Assessments conducted and available on request)
Legal obligation
When required by law
Data Sharing & Third Parties
We do not sell your personal information. We share data only with trusted service providers who are contractually bound to protect your data, including Stripe Payments UK Ltd, which provides payment processing and connected account services via Stripe Connect. We share your business information, transaction data, and verification status with Stripe to facilitate payment collection from your customers. See the Stripe Privacy Policy for details on how Stripe handles your data. For a full list of providers with details, see our Sub-Processors page.
Core Service Providers
| Provider | Location | Purpose |
|---|---|---|
| Supabase | EU | Database, storage & serverless functions |
| Clerk | US | Authentication & identity management |
| Stripe | US/EU | Subscription billing, payment processing & connected account payment facilitation (Stripe Connect) |
| Twilio | US/EU | SMS & WhatsApp messaging |
| Resend | US | Transactional email delivery |
| PostHog | EU | Product analytics (with consent) |
| Vercel | Global | Website hosting & CDN |
| OpenAI | US | AI text generation features |
| US | Maps, Calendar sync & reCAPTCHA |
User-Enabled Integrations
These providers only receive your data if you choose to connect the integration:
| Provider | Location | Purpose |
|---|---|---|
| Xero | AU/UK | Accounting sync |
| QuickBooks | US | Accounting sync |
| Microsoft | US/EU | Outlook Calendar sync |
| Meta (Facebook/Instagram) | US/EU | Publish approved posts to your Facebook Page & linked Instagram |
Meta (Facebook/Instagram) — when you connect a Page and approve a post, we send that post's text and image to Meta's Graph API to publish it to your Page on your behalf. Nothing is published without your approval; you can pause auto-posting or disconnect at any time.
We may also share data with legal authorities when required by law.
Data Retention & Security
| Data Category | Retention Period |
|---|---|
| Contact form data | 2 years |
| Account & profile data | Account lifetime + 30-day deletion window |
| Financial records (quotes, invoices) | 7 years after account closure (HMRC requirement) |
| Client data (names, addresses, phone numbers) | Account lifetime + 30-day deletion window |
| Communications (email/SMS delivery logs) | 90 days |
| Analytics data | 12 months |
| Audit logs | 1 year rolling |
| Integration data (calendar, accounting) | While integration is active |
| Stripe Connect data (account status, transactions) | Account lifetime + 7 years (HMRC). Raw event data: 90 days |
When you delete your account, your personal data and business data will be permanently removed within 30 days. Backup copies are purged within 90 days of deletion.
We implement industry-standard security measures including encryption in transit (TLS) and at rest, secure data centres, and regular security reviews. You can request deletion of your data at any time.
Your Rights (UK GDPR)
To exercise these rights, contact us at privacy@sortedmate.com. We will respond to your request within 30 days. In exceptional circumstances, where your request is particularly complex, we may extend this by a further 60 days and will inform you of any such extension.
Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required under UK GDPR Article 33.
Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, providing details of the breach, its likely consequences, and the measures we have taken or propose to take to address it.
Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.
AI Features
SortedMate uses AI (powered by OpenAI) to provide optional features such as quote enhancement, enquiry parsing, job title suggestions, and a chat assistant. These features process text you provide to generate suggestions, but do not make decisions on your behalf. You always retain full control over whether to accept, modify, or reject AI-generated suggestions. AI interactions are logged for service continuity and are not used to train third-party AI models.
International Transfers
Your core business data is stored in the EU (Supabase, AWS eu-west-1, Ireland). PostHog analytics data is also EU-hosted. Several service providers process data in the United States, including Clerk (authentication), Stripe (payments), Twilio (messaging), Resend (email), OpenAI (AI features), and Google (Maps, Calendar, reCAPTCHA).
For transfers to the US, our providers participate in the EU-US Data Privacy Framework (UK Extension) or we rely on the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses. Transfer Impact Assessments have been conducted for all transfers to countries without a UK adequacy decision.
Stripe processes data in the EU and US. Transfers are protected under Stripe's Data Processing Agreement, which incorporates UK Standard Contractual Clauses. See Stripe's DPA for details.
Data Protection Contact
While we are not required to appoint a Data Protection Officer, our designated data protection contact is responsible for overseeing data protection matters. You can reach them at privacy@sortedmate.com.
Children's Privacy
Our service is not intended for children under 18. We do not knowingly collect data from children.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through our service. The “Last updated” date at the top indicates when changes were made.
Contact Us
If you have questions about this Privacy Policy or wish to exercise your rights, contact us:
SortedMate Ltd
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
Company Registration No: 16880125
ICO Registration No: ZC090709