Privacy Policy

1. Who we are

[Company Name] ("we", "us", or "our") operates Sortdaily (the "Service"). This Privacy Policy explains what information we collect, why we collect it, who we share it with, and what choices you have. It applies to everyone who uses the Service.

2. Information you give us

• Account information: your name, email address, and basic profile details supplied by your sign-in provider (for example Google) when you log in with OAuth. We never receive or store your password for that provider.
• Bill and subscription data: names, categories, amounts, currencies, billing frequency, due dates, renewal dates, your renew-or-cancel decisions, and any notes you write.
• Uploaded documents: PDFs, photographs, and scans of bills, invoices, statements, or contracts that you choose to upload.
• Assistant conversations: the questions you ask, the documents in context, and the answers generated for you.
• Support messages: anything you send us by email or through the app.

3. Information collected automatically

• Usage data: which pages and features you use, and when.
• Device and log data: IP address, browser type, operating system, and error diagnostics, used for security and troubleshooting.
• Cookies and similar technologies, described in our Cookie Policy.

4. Information we do not collect

We do not ask for or store full payment card numbers, bank login credentials, or government identification numbers. Sortdaily never connects to your bank and never moves money. If that ever changes, we will update this Policy and tell you before the change takes effect.

5. How we use your information

We do not sell your personal information, financial data, or uploaded documents, and we do not share them for cross-context behavioural advertising.

• To run the Service: showing your bills, calculating monthly and annual totals, and generating in-app renewal reminders.
• To process documents you upload so that bill details can be suggested for your review.
• To answer your questions about a specific document, and about the data saved in your own dashboard.
• To sign you in and keep your account secure.
• To respond to your support requests.
• To fix problems, improve the Service, and keep it reliable.
• To meet legal obligations and to enforce our Terms of Service.

6. AI processing and the Grok API

Three features use an external AI provider: document field extraction, questions about a specific document, and the dashboard chat assistant. To provide them, the relevant content (the text or image of the document you selected, your question, and, for the chat assistant, a summary of your saved bill and subscription data) is transmitted to the Grok API operated by xAI (or a successor provider) for processing.

AI output can be wrong. Extracted amounts, dates, and terms are suggestions for you to check, never confirmed facts, and are never saved without your explicit confirmation. Always verify important details against the original document.

• Data is sent only when you actively use one of these features. Simply browsing your dashboard sends nothing to the AI provider.
• We send only what is needed to answer the request, and we do not send your email address or sign-in identifiers as part of the prompt.
• The AI provider processes this data under its own terms and privacy documentation, including any retention practices. We encourage you to read xAI's privacy documentation.
• Answers and extracted fields are returned to you and stored in your account so you can see your history.

7. Who else we share information with

• Service providers who help us operate the Service, such as cloud hosting, database, file storage, and authentication providers, under contracts requiring them to protect your data.
• Stripe, Inc., our payment processor. When you subscribe, Stripe collects and processes your payment details and handles billing on our behalf. Sortdaily never receives or stores your full card number. Stripe is responsible for the security of card data under the PCI DSS standard. We only receive limited billing information, such as your Stripe customer and subscription identifiers, your plan, your subscription status, and the dates of your trial and next payment. Stripe's own privacy policy governs its use of your information.
• Legal and safety authorities, where required by law or to protect the rights, property, or safety of you, us, or others.
• A successor organisation, in the event of a merger, acquisition, or sale of assets, subject to confidentiality protections and notice to you.

8. Legal bases for processing (EU and UK users)

• Performance of a contract: providing the dashboard, storage, and assistant features you asked for.
• Legitimate interests: keeping the Service secure, preventing abuse, and improving reliability.
• Consent: optional analytics cookies and any optional communications. You can withdraw consent at any time.
• Legal obligation: keeping records where the law requires it.

9. How long we keep your data

We keep your account information, bill and subscription records, uploaded documents, and assistant history for as long as your account is active. You can delete individual bills, documents, and conversations at any time from inside the app.

If you close your account or ask us to delete it, we delete or anonymise your personal data within [X days], except where we must keep something longer for legal, security, or fraud-prevention reasons. Backups are purged on our normal backup rotation.

10. Your rights

Depending on where you live, including under the GDPR in the EU and UK, and the CCPA/CPRA in California, you have the following rights over your personal information:

To exercise any of these rights, email [Contact Email]. We will respond within the time required by law (generally 30 days under GDPR, 45 days under CCPA). We may need to verify your identity first. If you are in the EU or UK, you also have the right to complain to your local data protection authority.

• Access: ask what personal data we hold about you.
• Correction: ask us to fix data that is wrong or incomplete.
• Deletion: ask us to erase your personal data.
• Portability and export: receive a copy of your data in a machine-readable format.
• Restriction and objection: ask us to pause or stop certain processing.
• Withdraw consent: at any time, where processing relies on consent.
• Opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of, but you may still tell us your preference.
• Non-discrimination: we will never give you a worse service for exercising any of these rights.
• Authorised agents: you may use an authorised agent to make a request on your behalf.

11. Security

We use technical and organisational measures designed to protect your information, including encryption in transit, access controls that restrict every record to the account that owns it, private document storage, and third-party OAuth sign-in so we never handle your password. No system is perfectly secure, and we cannot guarantee absolute security.

Please protect your side too: keep your sign-in account secure, turn on two-step verification with your provider, and sign out on shared devices.

12. International transfers

Our hosting, storage, and AI providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses for these transfers.

13. Children's privacy

The Service is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal information from children. If we learn we have, we will delete it.

14. Cookies

We use a small number of cookies for sign-in, session security, remembering your preferences, and basic analytics. Full details, including the third-party cookies set by our OAuth sign-in provider, are in our Cookie Policy.

15. Changes to this Policy

We may update this Privacy Policy. Material changes will be announced in the app before they take effect, and the date at the top of this page will always show the most recent revision.

16. Contact us

For any privacy question or request: [Company Name], [Contact Email], [Mailing Address]. If we have appointed one, our data protection contact can be reached at the same address.