SORTD · LEGAL

Privacy Policy

Last revised: November 6, 2026 · Effective date: November 6, 2026

This Privacy Policy explains how Sortd Inc. ("Sortd", "we", "us") collects, uses, stores, shares and deletes information when you use our website at www.sortd.com and our products, including the Sortd web app, the Sortd for Gmail extension for Chrome and Edge, the Sortd Gmail add-on, our mobile apps, the Sortd API, the Sortd MCP server and webhooks (together, the "Service").

If you have questions, contact us at privacy@sortd.com.

The short version

• Sortd connects to your Google account only with your permission, and uses your Google data only to provide the Sortd features you can see and use.
• We do not sell your data, use it for advertising, or use it to train general-purpose AI models.
• Email content is sent to our AI providers only to run the AI features you turn on, and they don't use it to train their models.
• You decide who else sees your email: teammates you share a board with, and tools you connect through the Sortd API or MCP server.
• You can disconnect Sortd from Google and ask us to delete your data at any time.

Contents

1. Information we collect

Information you give us

• Account information: your name, email address and profile picture, which we receive from Google when you sign in.
• Content you create in Sortd: boards, lists, tasks, comments, team chat messages, notes, sub-tasks, custom fields, reminders, contacts and companies in the CRM (ones you add, and ones created from an email's sender when a board is set to add new senders as contacts), automation rules and settings.
• Support and communications: messages you send to our support team and your replies to our emails.
• Billing: plan and subscription details. Card payments are handled by Stripe, a PCI DSS Level 1 certified provider. Sortd never receives or stores your full card number.

Google user data

When you connect your Google account, Sortd can access some of your Google data with your permission. Section 2 lists exactly what we access, why, and what we store.

Information collected automatically

• Usage and device information: IP address, browser and operating system, device type, pages and features used, and session times.
• Logs: technical logs that help us run the Service, investigate errors and protect it from abuse.
• Cookies and similar technologies: used to keep you signed in, remember your settings and understand how the Service is used. See our Cookie Policy. Our Service does not respond to "Do Not Track" browser signals.
• Product analytics: we use Google Analytics and Mixpanel to understand how features are used. These tools receive usage events, not the content of your emails.
• Email engagement: when we email you, we may record whether the email was opened so we can improve our communications.

2. Google user data

Sortd works inside Gmail. To do that, we ask Google for the permissions below. Sign-in and core Gmail access are needed to use Sortd. The others are asked for only when you first use a feature that needs them, and never before: permanent delete for shared boards, Calendar for the day planner, and Drive for attaching files. Google shows you each request on its consent screen, and you can review or remove Sortd's access at any time at myaccount.google.com/permissions.

What Google data we store

• Your name, email address and profile picture.
• Google access and refresh tokens. These are encrypted before they are stored.
• Email metadata for emails that are linked to tasks or handled by features you turned on: message and thread IDs, sender, recipients, subject, date, labels and a short snippet of the email text.
• Results of AI features: the label, status, urgency or sentiment assigned to an email.
• Drafts you choose to share on a board, so teammates can see and edit them.
• Details of Google Drive files you attach to a task: the file's name, type and link.

Sortd doesn't keep copies of your email bodies or attachments, with two exceptions: a temporary copy made while an email is copied into your board members' mailboxes, deleted within 7 days; and the email text sent to our AI providers, kept for up to 30 days so we can check and fix AI results. Otherwise Sortd reads email from Gmail when needed.

Email tracking. Email tracking is off by default for all users, including users in the European Union. Users can turn it on or off at any time in Sortd’s settings. When it’s on, Sortd adds a small tracking image to emails you send, so you can see when they are opened. Tracking doesn’t trigger for recipients Sortd detects are in the European Union. When a recipient opens a tracked email, Sortd records the time, device type, IP address and approximate location of the open, and shows them to you.

Calendar events are read when you view them and are not stored. We do not access your Google Contacts, Google Meet recordings or transcripts, or other Google services, and in Google Drive we access only the files you attach.

3. How we use information

We use your information only to:

• Provide the Service and the features you choose to use, including shared inboxes, boards, task tracking, automations, AI labels and reminders.
• Sign you in, keep your account secure and prevent fraud and abuse.
• Fix problems and improve features you can see and use in Sortd.
• Provide customer support when you ask for it.
• Bill you for your subscription.
• Send you service messages and, if you have not opted out, product news. You can unsubscribe from marketing emails at any time.
• Meet our legal obligations.

We do not:

• sell your data, or transfer it to advertising platforms, data brokers or information resellers;
• use your Google user data to serve ads, including retargeting, personalised or interest-based advertising;
• use your Google user data to decide creditworthiness or for lending;
• use your Google Workspace or Gmail data to develop, improve or train generalised AI or machine learning models.

4. AI features

Some Sortd features use AI to read your email. They are off unless you or your team turn them on, and some are available only on certain plans:

• AI Board Tags set each card on a shared board with its reply status (for example To Respond or Awaiting reply), sentiment and urgency.
• AI Inbox Labels sort your own Gmail into labels such as Read, Respond, Revisit, Review, Relax, Reconsider and R.I.P., and mark email as pinned (waiting on me) or urgent.

When a feature is on, the relevant email content (for example the subject, sender, recipients and the text of recent messages in the thread) is sent to one of our AI providers, only to return the label or status to Sortd:

• TypeSafe AI, Inc., whose Jev model classifies email.
• OpenAI, which also classifies email. OpenAI may keep this content for up to 30 days to monitor for abuse, then deletes it.

Neither provider uses your content to train its models. Sortd keeps the text sent to and returned by these providers for up to 30 days so we can check and fix AI results, then deletes it. When you turn a feature off, Sortd stops sending your email for that feature.

Sortd does not use your email to train AI models, and no person at Sortd reads your email to run these features.

5. Sharing with your team

Sortd is built for teams, and you choose what to share:

• Boards: when you add an email to a task on a shared board, the members of that board can see that task and the email linked to it. With board sync, a copy of the email thread is placed in each member's own Gmail mailbox so they can open and reply to it there.
• Shared drafts: if you share a draft on a board, board members can see and edit it.
• Team administrators: administrators of your Sortd team can manage members, boards and settings, and can see team-level usage.

Leaving a board, or being removed from one, stops new email from that board being shared with you, and Sortd deletes the copies it placed in your mailbox. Emails you added to a shared board were shared with its members, much like forwarding them, so they stay with the team after you leave.

6. Tools you connect: Sortd API, MCP server and webhooks

You can connect other tools to Sortd, such as an AI assistant (for example Claude or ChatGPT through the Sortd MCP server), an automation tool such as Zapier, or your own software through the Sortd API or webhooks.

• A tool can access your Sortd data only after you approve it, either by creating an API key or by approving the connection on Sortd's consent screen.
• You choose what each connection can do. For example, reading email message bodies, creating drafts, sending email and deleting data are separate permissions you grant one by one.
• Sortd sends a connected tool only the data you allowed, when the tool asks for it. Webhooks send updates you subscribed to, to the web address you entered.
• When you connect your own AI assistant, Sortd sends your data to that assistant only when it asks and only within the permissions you granted. Sortd does not pass that data to its own AI providers, and your assistant's provider is not a Sortd sub-processor.
• Once a connected tool receives your data, its own terms and privacy policy apply to it. Please review them before connecting.
• You can remove a connection at any time: delete the API key or webhook in Sortd settings and access stops immediately, or email privacy@sortd.com and we will revoke an app's access for you.

New API keys are only shown to you once and are stored in a form that cannot be read back.

7. Other sharing

Apart from your team, tools you connect and our sub-processors, we share information only:

• when you ask us to or give us your consent;
• in aggregated or de-identified form that cannot identify you (this never includes Google user data in identifiable form);
• when we believe in good faith that the law requires it, for example to respond to a valid court order, and in that case we share only what is required;
• to protect the security of the Service, our users or the public, for example to investigate abuse;
• as part of a merger, acquisition or sale of assets. Google user data will be transferred in that case only after we have your explicit prior consent.

8. Sub-processors

We use the companies below to run the Service. Each may process personal data only on our instructions and only to provide its service to Sortd.

We also use New Relic, Inc. (application monitoring and error reporting, USA) and Clearbit, a HubSpot, Inc. service (looking up a company's name and logo from the domain of a contact's email address, USA).

We will update this list before a new sub-processor starts handling personal data.

9. Google API Services User Data Policy

Sortd's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We use Google user data only to provide or improve user-facing features that are visible and prominent in Sortd.
• We transfer Google user data only to provide or improve those features and with your consent (for example to teammates on a board you share, or to a tool you connect), for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent.
• We do not use or transfer Google user data for serving ads, and we do not sell it.
• We do not use Google Workspace API data to develop, improve or train generalised AI or machine learning models.
• No person at Sortd reads your Google user data unless:
  • you have given us your agreement to view specific messages, for example when you ask support to look at a particular email;
  • it is necessary for security purposes, such as investigating a bug or abuse;
  • it is necessary to comply with applicable law; or
  • the data has been aggregated and anonymised and is used for internal operations in line with applicable privacy laws.
• Our employees, contractors and sub-processors are required to follow these rules.

10. Retention and deletion

• While your account exists, we keep your account information and Sortd content so the Service works. We don't delete accounts automatically.
• Disconnecting Google: if you remove Sortd's access in your Google account, Sortd can no longer access your Google data and the Google tokens it holds stop working. They are replaced if you sign in again, and deleted when your data is deleted. Your Sortd account stays until you delete it.
• Email linked to tasks: the email details stored with a task (see section 2) are kept while the task exists and deleted with it. Email content stays in Gmail.
• Temporary copies of email made for board sync are deleted within 7 days, and email text sent to AI providers within 30 days. Application logs are deleted within 90 days, and security audit logs within 2 years. We keep some longer only when we need them to investigate a security issue or meet a legal requirement.
• Billing records are kept for as long as tax and accounting laws require.

Closing or deleting your account. Remove account in Sortd's settings signs you out, removes you from your teams and revokes Sortd's access to your Google account. Your data is kept so you can sign in again later (cancel any paid subscription first). To permanently delete your account and data, email privacy@sortd.com. After we verify the request, we:

• revoke Sortd's access to your Google account and delete your Google tokens;
• remove your name, email address, profile picture and settings, and replace them with "Anonymised User";
• delete your profile from the support, messaging and analytics services we use; and delete the boards and tasks only you can see, together with the email details, AI results and other records Sortd holds about your email.

Tasks and cards added to a team's shared boards, including the email details linked to them, stay with that team, shown as created by "Anonymised User". We complete deletion within 30 days of your request and confirm by email. Copies in our database backups are deleted within a further 7 days, when those backups expire.

11. Security

• All data is encrypted in transit using TLS.
• Google access and refresh tokens are encrypted at rest. Data is stored with AWS and MongoDB in the United States.
• Access to production systems is limited to staff who need it, protected by multi-factor authentication, and logged.
• Sortd completes an annual independent security assessment under Google's Cloud Application Security Assessment (CASA) programme.
• We operate a vulnerability disclosure programme. See our Security page for details.

No system is completely secure. If we learn of a security breach that affects your personal data, we will notify you and the relevant authorities as the law requires.

12. Your choices and rights

• Access and correction: you can see and update your account information in Sortd, or ask us for a copy of your personal data.
• Deletion: you can ask us to delete your account and data, as described in section 10.
• Google access: you can remove Sortd's access to your Google account at any time at myaccount.google.com/permissions.
• AI features: you can turn AI Board Tags and AI Inbox Labels off at any time.
• Connected tools: you can remove API keys and webhooks at any time in Sortd, and ask us to revoke an app or MCP connection.
• Marketing: you can unsubscribe using the link in any marketing email or by contacting us.
• EU, UK and other regions: depending on where you live, you may have further rights, such as the right to object to processing, restrict it or move your data to another service. See our GDPR page.

To use any of these rights, contact privacy@sortd.com. We will respond within 30 days.

13. International transfers

Sortd stores and processes data in the United States. If you use Sortd from another country, your information will be transferred to and processed in the United States.

14. Children

Sortd is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 13 (or under 16 where local law requires). If we learn that we have, we will delete it. If you believe a child has given us personal data, contact privacy@sortd.com.

15. Beta and experimental features

We may offer beta or experimental features. These are always opt-in. If a beta feature uses your data in a way this policy does not describe, we will explain it and ask for your consent before you turn it on. You can withdraw that consent at any time.

16. Changes to this policy

We will update the date at the top of this policy when it changes. If we make a significant change, we will tell you in the Service or by email before it takes effect. If we change how Sortd uses your Google user data, we will ask for your consent before the new use begins.

17. Contact us

Email: privacy@sortd.com