Skip to content
Features Docs Pricing Security Blog
Sign in Sign up
Legal

Privacy Policy

Effective: July 19, 2026

Sortly Inc. ("Sortly") respects your privacy. This policy describes what we collect, why, and how you can control it.

1. What we collect

  • Account info: email, name (from Google or provided at signup), hashed password if you sign up with email.
  • Drive metadata: file names, sizes, MIME types, folder structure, owners, sharing status, and Drive-generated thumbnails.
  • File content excerpts: up to 20 KB per file, used to generate AI descriptions. Not persisted unless you toggle metadata-only mode off.
  • Usage data: pages visited, actions taken, credit transactions.
  • Payment data: handled entirely by Stripe. Sortly never sees your card number.

2. How we use it

  • To provide the Service (scanning, AI analysis, move planning).
  • To bill you and prevent fraud.
  • To send transactional emails (verification, receipts, security alerts).
  • To improve Sortly via aggregated, anonymised analytics. We do not sell your data.

3. Third parties (sub-processors)

  • Google — OAuth + Drive API.
  • Stripe — payment processing.
  • OpenRouter / OpenAI — LLM providers for file classification. Only file names, folder paths, and short text/thumbnail excerpts are sent, per your metadata-only setting.
  • SendGrid — transactional email (when configured).

4. Data retention

We retain your account and indexed metadata until you delete your account. Credit ledger and Stripe records are retained for 7 years for tax/legal compliance. File content excerpts are stored only while enrichment is running — they are dropped from active memory after description generation and never persisted beyond the 2 KB sample shown on file cards.

5. Your rights (GDPR, CCPA, LGPD)

  • Access & portability: download all indexed data as JSON from Settings.
  • Deletion: "Delete account" revokes Drive access and deletes your account and indexed Drive data. Financial records that must be retained are de-identified.
  • Correction: update profile information from Settings.
  • Objection: email privacy@example.com to object to specific processing.

6. International transfers

Sortly’s servers are located in the United States. If you access the Service from the EU/UK, your data may be transferred internationally under Standard Contractual Clauses (SCCs).

7. Children

Sortly is not directed at children under 13. If we learn a child under 13 has provided personal data, we will delete it.

8. Changes

We’ll notify you of material changes via email or in-app notice at least 30 days before they take effect.

9. Contact

Privacy questions: privacy@example.com. Mailing address: 123 Example St., San Francisco, CA 94105, USA.

This is a placeholder Privacy Policy. Have it reviewed by privacy counsel and adapted to your specific jurisdictions before commercial launch.