# Privacy Policy — Sort URL: https://trysort.com/privacy > What personal data Sort collects, how we use it, who we share it with, and the choices you have. Legal # Privacy Policy Last updated 14 October 2026 ## Who we are Sort is provided by Sort Works Ltd, 128 City Road, London, EC1V 2NX, United Kingdom (Registered in England and Wales, company number 16980143). This policy explains what personal data we collect when you use Sort, our website, desktop app and email features, how we use it, who we share it with and the choices you have. For account, billing, website and support data, Sort Works Ltd is the controller. For content that a customer's members put into a workspace, the customer (usually your employer) is the controller and we process that content on its behalf. If your question is about workspace content, you can also contact your workspace owner. ## Information we collect - **Account information:** your email address, name, profile photo, timezone, and the workspaces and teams you belong to, including your role, title and profile details. - **Workspace content:** pages and their version history, comments, files you upload, AI chats, memories you ask the AI to keep, scheduled tasks, notifications and team settings. - **Email:** if your workspace connects its own email domain, the messages and attachments sent to and from its addresses. - **Connected services:** data from services you sign in with or connect to Sort, such as Google. The Connected services section below explains this. - **Usage and technical data:** when you last signed in and were active, AI usage totals (such as token counts), and error reports. We use your IP address briefly to limit abuse, and we do not store it with your account. - **Communications:** messages you send to us, such as support requests, feedback and questions in the chat on our website. - **Billing information:** the contact and invoice details we need to bill your workspace. We do not store payment card numbers. ## How we use information - To provide Sort: sign you in, store and sync your content, and apply workspace and team permissions. - To run the AI features you use, such as answering questions, drafting and editing pages, and searching. - To send emails you need, such as sign-in links, invitations, comment activity and scheduled task results. - To keep Sort secure, prevent abuse, fix errors and improve features. - To provide support and to communicate with you about your account. - To meet our legal obligations, such as tax and accounting rules. We do not sell personal data, use it for advertising, or use your workspace content to train AI models. Our legal bases under UK and EU data protection law are: performance of our contract with you or your organization; our legitimate interests in running, securing and improving Sort; compliance with legal obligations; and your consent where we ask for it. You can withdraw consent at any time. ## AI features When you use an AI feature, the content needed for your request is sent to the AI provider that your workspace uses. This can include your message, relevant pages, files and connected documents. OpenAI is the default provider. A workspace owner can choose Anthropic instead. Search indexing of workspace content always uses OpenAI. These providers process the data to return a result to us. Under their API terms, they do not use it to train their models and keep it only for a limited time, for example to monitor abuse. The AI only uses content that you can access under your workspace and team permissions. ## Connected services You can sign in with other services and connect them to Sort, for example to import knowledge or to let the AI search and read your files. When you connect a service: - You choose what to connect, and the provider's consent screen shows the access Sort asks for. We ask only for the access our features need, and read-only access unless a feature needs more. - We use the data only for features you start, such as importing documents or answering your questions, and we link to the sources the AI used. - We store an encrypted access token, details of the items used (such as name, location, owner, dates and link), and the content that is imported or used in pages and chats you keep. - The data is processed by the providers that run Sort and by your workspace's AI provider, as described in this policy. We do not sell it, use it for advertising or use it to train AI models. - You can disconnect a service at any time. This deletes the stored token and, where the service allows it, revokes our access. **Google.** With Google sign-in we receive your name, email address and profile photo. With Google Drive we read the files and file details you give us access to, to import them into Sort and to let the AI search and read them for you. We do not use Google user data to develop, improve or train generalized AI or machine learning models, and people at Sort do not read it except with your permission, for security or when the law requires it. Sort's use and transfer of information received from Google APIs to any other app will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ## Service providers We share personal data only with providers that help us run Sort, under contracts that protect it: - **Hetzner Online**: Servers and database that run Sort. Finland (EU). - **Cloudflare**: Website hosting, network protection and file storage. Global network. - **Amazon Web Services**: Sending and receiving email. Sweden (EU). - **OpenAI**: AI responses, reading attached files and search indexing of workspace content. United States. - **Anthropic**: AI responses, when a workspace owner chooses Anthropic models. United States. - **Tavily**: Web search and reading web pages for AI answers. United States. - **Sentry**: Error monitoring. Germany (EU). - **Google**: Google sign-in, Google Drive connections and website fonts. United States. We can also share data when the law requires it, to protect the rights and safety of our users or of Sort, or as part of a merger or sale of our business, in which case this policy continues to apply. ## International transfers Some providers process data outside the UK and the European Economic Area, mainly in the United States. When they do, we rely on adequacy decisions such as the UK-US data bridge, or on standard contractual clauses with the UK addendum. ## Retention - We keep account and workspace data while the account or workspace is active. - Deleted pages stay in the workspace trash until they are deleted permanently. Deleted chats and memories are removed at once. - Uploaded files that are never added to content are removed within 7 days. - When a workspace or account is closed, we delete its data within 30 days, unless the law requires us to keep it longer. - Encrypted database backups are kept for 14 days and then deleted. ## Cookies and local storage We use only cookies that Sort needs to work: a sign-in cookie (7 days), a security cookie that protects against forged requests (7 days), short-lived cookies during Google sign-in and Google Drive connection (up to 10 minutes), and a cookie that remembers whether the sidebar is open. The web app also keeps your preferences and a short-lived copy of recently loaded data (up to 1 hour) in your browser. We do not use advertising or analytics cookies. Our website loads fonts from Google Fonts, so your browser sends your IP address to Google when you visit. ## Security We protect data with encryption in transit, encrypted storage for connection tokens and backups, access controls, and workspace and team permissions that the server checks on every request. No system is perfectly secure, and we will notify you and the authorities of a breach when the law requires it. ## Your rights Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. Email [privacy@trysort.com](mailto:privacy@trysort.com) and we will reply within one month. If the request is about workspace content, we may refer it to your workspace owner. You can also complain to the UK Information Commissioner's Office at [ico.org.uk](https://ico.org.uk/make-a-complaint/) or to your local data protection authority. ## Children Sort is for businesses and is not intended for anyone under 18. We do not knowingly collect children's data. ## Changes to this policy We will update this policy when our practices change. We will tell you about important changes by email or in Sort before they take effect, and ask for your consent where the law requires it. ## Contact us Email [privacy@trysort.com](mailto:privacy@trysort.com) or write to Sort Works Ltd, 128 City Road, London, EC1V 2NX, United Kingdom.