Privacy Policy

SORSORA SIA, registered in Latvia under number 40203780280, operates Sorsora. For questions about anything below, write to admin@sorsora.com.

For your account and how you use the product, we are the controller: we decide why that data is processed.

For the records, files and customer data your organisation stores in its workspace, we are a processor acting on your organisation’s instructions — your organisation decides what goes in and how long it stays. If you reached us through a Customer Hub run by one of our customers, ask them for their own privacy notice.

• Account data — name, email address, password hash, language and theme preference, organisation membership and role.
• Workspace content — the records, form submissions, files and assistant conversations your organisation stores.
• Technical data — IP address, browser and device information, timestamps, the pages and actions you trigger, and error reports.
• Billing data — plan, invoices, VAT identification number and payment status. Card details go directly to our payment provider; we never see or store them.
• Support data — whatever you choose to send us in a message.

• To provide the service, your account and support — performance of a contract, Art. 6(1)(b) GDPR.
• To keep the service secure, prevent abuse, debug faults and improve the product in aggregate — our legitimate interests, Art. 6(1)(f).
• To invoice you and keep accounting and tax records — legal obligation, Art. 6(1)(c).
• For anything optional you opt into, such as product announcements — consent, Art. 6(1)(a), which you can withdraw at any time.

We set only the cookies the product needs: keeping you signed in, remembering your organisation and theme, and protecting forms against abuse. There are no advertising or cross-site tracking cookies, which is why you are not asked for cookie consent.

We use a short list of processors, each under a data processing agreement and permitted to act only on our instructions: cloud hosting and database, email delivery, payment processing, error monitoring, and the AI providers named below. The current list is available on request. We do not sell personal data.

Sorsora Ai works only for people who have allowed it. Before your content goes to an AI provider for the first time you are asked for permission, and you can withdraw it at any time under AI data sharing in your account settings. Sorsora Ai then stays off for you, and everything else works as before.

With that permission, what you type, attach and say to Sorsora Ai, and the records it looks up to answer you, are sent to OpenAI, which writes the answers, reads the files and handles voice. OpenAI may keep what it receives for up to 30 days to monitor for abuse, and then deletes it. When you ask for an image, your description of it is sent to Google. Requests can pass through Vercel’s AI Gateway on the way. The terms we use these providers under exclude training their models on this content. They may process it outside the EEA, under the safeguards described in the next section.

An organisation can also build AI steps into its own workflows. Those run for the organisation, on the records in its workspace, and are the organisation’s decision rather than each person’s.

We host in the European Union wherever we can. Where a processor operates outside the EEA, the transfer is covered by an adequacy decision or by the European Commission’s Standard Contractual Clauses together with additional safeguards.

Account and workspace data for as long as the organisation’s account is open, then for 30 days so an accidental deletion can still be reversed, after which it is removed from live systems and ages out of backups within a further 90 days. Invoices and accounting records are kept for as long as tax law requires. Security logs are kept for 12 months.

The GDPR lets you ask for a copy of your data (Art. 15), correct it (16), have it erased (17), restrict or object to processing (18 and 21), receive it in a portable format (20), and withdraw any consent you have given. Write to admin@sorsora.com and we will respond within one month. Where your organisation is the controller, we pass the request on to them.

We do not make decisions about you with legal or similarly significant effects by automated means. Assistant output is a suggestion for a person to act on.

Data is encrypted in transit and at rest, access is limited to the people who need it and is logged, and organisations are isolated from one another at the database level. If a breach is likely to put your rights at risk we notify the supervisory authority within 72 hours and tell you without undue delay.

Tell us first — we would rather fix it. You may also complain to the data protection authority in the EU country where you live or work; ours is Datu valsts inspekcija in Latvia (dvi.gov.lv).

Material changes are announced by email to account owners and take effect no earlier than 30 days after that notice.