Privacy policy
Effective date: 2 October 2026
Sorted is operated by SMEtools LLC, a Delaware limited liability company, at https://sortedos.com. Contact: support@sortedos.com. Sorted connects a business’s own systems (Odoo, Shopify, Google Ads, Google Analytics 4 and Meta ads) into one dashboard that the client reads on the website and inside the client’s own AI assistant (Claude or ChatGPT) through Sorted’s connector. Each company’s data is kept apart from every other company’s.
What we collect
- Sign-in. When you sign in with Google, Google gives us your name, email address and profile image. We use your verified email address to check that you are an authorised user of a company, and we keep it with your company and role. Your name and image are not saved in our database; they exist only in your sign-in session, which lasts up to 7 days.
- Your business numbers. Every hour Sorted reads the systems you connected and saves a snapshot of figures, charts and tables for your company. From Odoo: ledger, invoicing, bank and cash figures, and the names of the customers and suppliers with the largest balances. From Shopify: order totals, refunds, discounts, counts and statuses (no customer, address or product-name fields). From Google Ads and Meta ads: spend, clicks, impressions, conversions and campaign names and status for the last 30 days. From Google Analytics: sessions, users, key events, revenue and traffic-channel totals for the last 30 days.
- Connections and choices. Which systems are connected, who connected them and when, whether they last worked, your dashboard layout, and any requests you make for a new number (our team reads these to add the number).
- AI assistant access. When you link Sorted to Claude or ChatGPT, we record your email, company and the assistant’s web address so the access can be checked and ended.
- Billing. Card payments are handled by Stripe. Sorted never sees or stores card numbers. We keep Stripe’s customer and subscription IDs, the plan status and renewal date, and we may give Stripe your email address when you subscribe.
Google user data
Sorted accesses only this Google user data:
- Google sign-in: your name, email address and profile image.
- Google Ads: read-only campaign performance and account data. The company’s owner chooses Connect Google Ads and approves the permission https://www.googleapis.com/auth/adwords. We receive a lasting permission token and keep only that. Sorted only asks Google Ads reporting questions; it never creates, edits or deletes anything in your account.
- Google Analytics: report data, read by Sorted’s own Google service account, which you add to your property as a Viewer. You send us only the property number. A member of our team confirms the property is yours before any data is collected.
How it is used: only to show the client’s own dashboard to that client’s authorised users and to their AI assistant. Google user data is not used for advertising, is not sold, is not used to train AI models, and is not read by people except with the client’s permission, for security, or where the law requires.
Sorted's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we protect it
- Connection secrets, such as the Google Ads permission token, are locked with public-key encryption before they are stored. The website holds only the public key, so it can lock a secret but cannot open one; only the collector’s private key can. Our website’s database login cannot read stored secrets at all. (Older connections that our team set up for a client use AES-256-GCM encryption instead.)
- Each company’s rows are fenced off inside the database (row-level security). Database connections are encrypted and verified.
- Only a company’s owner can connect or remove its systems, and this is checked on every request.
- Access keys for the AI connector are stored only as one-way hashes.
Who we share it with
We never sell personal data. We share it only with the services that run Sorted: Vercel (the website), Supabase (the database), GitHub Actions (the hourly collection job) and Stripe (billing, as described above). At the client’s direction, the AI assistant the client chooses (Claude or ChatGPT) receives the figures it asks Sorted for, under that provider’s own terms. Sorted also sends read requests to the systems you connect. We disclose information where the law requires it.
Keeping and deleting data
- A company’s owner can remove any connection at any time on the Connections page. That deletes the stored connection key at once and stops new collection. To also cut the permission on Google’s side, remove Sorted at myaccount.google.com/permissions (Google Ads) or remove Sorted’s reader from your Analytics property.
- Numbers already collected stay in your dashboard history until deleted. All data and stored connection keys are deleted within 30 days of a written request to support@sortedos.com, of the end of the subscription, or of the end of a free trial that was not followed by a subscription.
- To end an AI assistant’s access, ask us. It also ends when the person is removed from the company.
- Records that the law requires us to keep, such as billing records, may be kept longer.
Cookies
We set only the cookies needed to sign you in and keep you signed in, plus a short-lived security cookie while you connect Google Ads. Your browser also stores your language and display choices. We use no advertising or tracking cookies. Page fonts load from Google Fonts.
Your rights, children and changes
You can ask to see, correct or delete your data at support@sortedos.com. Sorted is for businesses and is not directed at children. If we change this policy we will post the new version here with a new effective date.