Privacy Policy

We act in two capacities, and the rules differ for each:

• Controller — for the account, billing, usage, and support information of our Operators and their personnel, and for our website visitors. We decide how and why this information is processed, and this Policy governs it.
• Processor / service provider — for the data an Operator and its customers put into the Service ("Customer Data"), including the Operator's own customers' contact details, enquiries, quotes, jobs, photos, and messages. Here the Operator is the controller and decides the purposes; we process Customer Data on the Operator's instructions to provide the Service. If you are an Operator's customer, please direct privacy requests to that Operator; we will assist them as required.

• Account and profile data: name, email, phone, password (stored only as a secure hash), organisation details, role, and preferences.
• Business and operational data you enter: customers and contacts, leads and enquiries, quotes, orders, jobs, schedules, time and costs, invoices and credit notes, files, photos, and notes — which may include personal information about your customers and staff.
• Payment data: handled by our payment processor (Stripe). We receive limited billing details and subscription status; we do not store full card numbers.
• Communications: messages you send through or to us, including support requests and content of emails/SMS sent via the Service.
• Location/address data: addresses you enter and map/address lookups (via Google Maps Platform), used to display and verify job locations and to compute travel times and route order; the resulting coordinates are also processed by the route-computation providers listed in section 5.
• Usage, device, and log data: IP address, device and browser type, pages and actions, timestamps, and error diagnostics, collected to operate, secure, and improve the Service.
• AI inputs and outputs: the text and context you submit to AI features and the suggestions returned (see section 5).

We use personal information to: provide, operate, secure, and improve the Service; create and manage accounts; process payments and subscriptions; send transactional and service messages; provide AI features; deliver support; detect and prevent fraud, abuse, and security incidents; comply with legal obligations (including tax and accounting); and, where permitted, send product updates.

Where the EU/UK GDPR applies, our legal bases are: performance of a contract (to provide the Service you request); our legitimate interests (to secure, maintain, and improve the Service and communicate with Operators), balanced against your rights; compliance with a legal obligation; and consent where required (for example certain cookies or marketing). For Customer Data we process as a processor, the Operator is responsible for the lawful basis.

We do not sell personal information. We share it only with: (a) the sub-processors listed in section 5, to run the Service; (b) third-party products an Operator chooses to connect (for example accounting software); (c) professional advisers, and authorities where required by law or to protect rights and safety; and (d) a successor in a merger, acquisition, or asset sale, subject to this Policy. Operators control sharing within their own workspace through the roles and integrations they configure.

We use the following providers to deliver the Service. Each processes personal information only as needed for its function and under contractual data-protection obligations. An entry marked as a notified addition is one we have given notice we intend to use and are not yet using. Locations are indicative and should be confirmed; several providers operate globally.

• Stripe — payment processing and subscription billing (United States / Ireland). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Neon — managed PostgreSQL database hosting (Sydney (ap-southeast-2); EU region for EEA customer data). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Cloudflare R2 — storage of uploaded files, photos, logos, and generated PDFs (global; EU-jurisdiction storage for EEA customer data). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Vercel — application hosting, content delivery, and performance measurement (United States / global). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Resend — transactional and notification email delivery (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Mobile Message — SMS delivery for Australian numbers, including sender-ID registration (Australia). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• 46elks — SMS delivery for Swedish and Norwegian numbers (Sweden (EEA)). Transfers: Within the EEA — no transfer mechanism required.
• Twilio — SMS and voice message delivery and dedicated phone numbers for Australian and US numbers (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Anthropic — AI features; processes inputs only to return outputs and not to train its models (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Intercom, Inc. — customer support: help centre, in-app and email support messaging, and AI-assisted answers to support enquiries (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Sentry — error and crash monitoring / diagnostics (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Inngest — background jobs and scheduled tasks (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Google Maps Platform and Google Cloud Route Optimization (Google Cloud EMEA Limited) — address geocoding, travel-time and route computation, and map display; receives job and customer addresses and their coordinates, worker start and end coordinates (an employee's home coordinate where a worker starts from home), and the visit and worker identifiers that label them (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Hetzner Online GmbH — hosting of GoSorted's self-hosted route-computation service (notified addition under section 5 — engaged only once the notice period ends); receives customer address coordinates, worker start coordinates and the accompanying visit and worker identifiers in transit for the duration of a route calculation (Germany (EEA)). Transfers: Within the EEA — no transfer mechanism required.
• Xero (and, where the customer enables it, QuickBooks Online or MYOB) — accounting integration connected by the customer (global). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Google and Apple — optional single sign-on, only where the customer chooses it (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• GoDaddy.com, LLC — domain registration and DNS, and reseller administration of the Microsoft 365 tenant that hosts our support mailbox (support@gosorted.co) (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).
• Microsoft Corporation — hosting of our support mailbox (support@gosorted.co) on Exchange Online; receives and stores inbound support email, including the sender's name, email address and what they write to us (United States). Transfers: Standard Contractual Clauses (plus the EU-US Data Privacy Framework where the provider is certified).

A current list of sub-processors is available on request via the contact details below.

5a. AI processing

When an AI feature is used — by you inside the Service, or when questions are generated from an enquiry someone submits through an Operator's form — the relevant input and context are sent to our AI provider (Anthropic) to generate the suggestion. We instruct our AI provider to process this to return the output, and not to use your data to train its models. Anthropic processes it in the United States and retains it under its own policy, for up to 30 days in the ordinary course and longer where its trust-and-safety processes require; we have not agreed a zero-retention arrangement, so that retention is not something we control. AI outputs are suggestions you should review; do not treat them as professional advice.

Support enquiries you send through the in-app assistant are answered in the first instance by an AI system, using our AI provider (Anthropic); you can ask for a person at any point. What you type goes to Anthropic on the same terms as the paragraph above, including that retention. If you ask for a person, or email us at support@gosorted.co, your message is handled in our support platform (Intercom, listed above in this section). We may in future replace the in-app assistant with that platform's own AI assistance; we will update this section when we do.

5b. Changes to this list

When we add a provider to the list above, or remove one, we record it here, most recent first, under the date the list itself changed. We started this record on 3 September 2026 and entered the two earlier changes into it at that point; changes before August 2026, and edits to the wording of an entry that was already listed, are not recorded here.

• 3 September 2026 — GoDaddy.com, LLC and Microsoft Corporation were added to the list above. Together they carry our support mailbox (support@gosorted.co): the mailbox is hosted on Microsoft's Exchange Online, and GoDaddy registers the domain, runs its DNS and administers the Microsoft 365 tenant. Both have done so since before this list named either of them, so this entry corrects an omission rather than announcing providers we are about to start using: no notice period is running, and none could cure processing that has already happened. Your right under section 5 of the DPA to object to a sub-processor on reasonable data-protection grounds is unaffected.
• 31 August 2026 — Intercom was added to the list above, for customer support — the help centre, in-app and email support messaging, and AI-assisted answers to support enquiries. The 30-day notice period in section 5 of the DPA is a protection for the customer, and where a customer had already confirmed in writing that Intercom could be engaged immediately, that customer gave the protection up and no waiting period applied to them; that confirmation is the only basis on which the period was not observed. For a customer who gave no such confirmation the 30-day period runs from 31 August 2026, the date Intercom appeared in the list above. Please read that together with a fact the period does not change: support email for every customer arrives in one shared mailbox, which has been handled in Intercom since 31 August 2026, so we cannot hold one customer's support messages out of it. If you want to object, or to agree a different way of contacting support, write to privacy@gosorted.co.
• 16 August 2026 — Google Maps Platform was added to the list above. It was already in use, so that entry too corrected an omission rather than announcing a new engagement. Hetzner Online GmbH was added in the other sense — as a notified addition under section 5 of the DPA, not engaged until its notice period has ended, which is why it is still marked as one in the list above. Mapbox was removed: it had been listed but was never used, and no personal data ever reached it. The amendment carrying these changes is dated 15 August 2026 and published on 16 August 2026; where a notice period runs from it, it runs from the later date.

We give these notices both to our Operators under section 5 of the Data Processing Addendum, for the Customer Data we process on their behalf, and in our own right for the account, billing, and support information we hold as controller — including information about people who are not our Operators at all, such as someone who emails our support address before becoming a customer, which no Operator's waiver of that notice period reaches. To object to a provider on reasonable data-protection grounds, contact privacy@gosorted.co. Changes are published here, so this section is the current position.

We are based in the United Arab Emirates, and our providers operate in countries including the United States, the European Union, and Australia. This means personal information may be transferred to and processed in countries other than your own, which may have different data-protection laws. Where we transfer personal information from the EU/EEA, the UK, or other regulated regions to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) and additional measures as required. You may request information about these safeguards using the contact details below.

We use a small number of cookies and similar technologies: strictly necessary ones to keep you signed in and secure your session; and limited diagnostic/performance technologies (for example via Sentry and Vercel Speed Insights) to keep the Service reliable. Where required by law, we will request consent for non-essential cookies through a consent banner, and you can withdraw consent at any time. You can also control cookies through your browser settings.

We keep personal information for as long as needed to provide the Service and for the purposes described here. As a guide: account and Customer Data are retained for the life of the account and for 30 days after closure to allow export and recovery; financial and tax records are retained for 7 years or as required by law; backups are retained for up to 90 days and then cycle out; and diagnostic logs are retained for a shorter period. We then delete or de-identify the information, subject to legal-retention requirements and technical backup cycles.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption of sensitive stored secrets, hashing of passwords, database-level tenant isolation so each Operator can access only its own data, role-based access controls, least-privilege access for our team, and monitoring. No system is perfectly secure, but we work to protect personal information and to respond promptly to incidents, including notifying you and any regulator where the law requires.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with a regulator. We do not sell or "share" personal information for cross-context behavioural advertising as defined under US state laws, and we do not discriminate against you for exercising your rights.

• EU/EEA and UK (GDPR): rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to your supervisory authority.
• Australia (Privacy Act / APPs): rights to access and correct your personal information, and to complain to the Office of the Australian Information Commissioner (OAIC).
• United States (e.g. California CCPA/CPRA and similar state laws): rights to know, access, delete, correct, and to opt out of sale/sharing (we do not sell/share as defined).
• United Arab Emirates (PDPL): rights as provided under UAE data-protection law.

To exercise a right, contact us using the details below; we may need to verify your identity. If your information is held within an Operator's workspace as Customer Data, we will refer your request to that Operator (the controller) and assist as required.

The Service is for businesses and is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will take appropriate steps.

We may send Operators service messages (which are necessary and not optional) and, where permitted, product updates. You can opt out of non-essential marketing at any time using the unsubscribe link or by contacting us. You are responsible for obtaining any consent required to send messages to your own customers through the Service.

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice (for example by email or in-app). Your continued use after the change takes effect means you accept the updated Policy.

Controller: Levain Invest L.L.C-FZ (operating as GoSorted), The Meydan Hotel, Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates (commercial licence no. 2416266.01).

Privacy contact: privacy@gosorted.co. You can also reach us via the support page.

If you are in the EU/EEA, UK, or Australia and believe we have not addressed your concern, you may complain to your local supervisory authority or, in Australia, to the OAIC.