Cookie Policy

This policy explains how SorviAI uses cookies and similar technologies on our platform and on our public website. It sits alongside our Privacy Policy, which explains what we do with personal information more generally. Where this policy uses terms such as controller and processor, they carry the meaning given in the Privacy Policy.

It covers the SorviAI platform and every application within it, the Portal our customers’ own customers and suppliers sign in to, and our public website. The section on storefronts run by our customers explains the one important thing it does not cover. The company responsible is SORVI AI LTD, Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS. Our full company details are on our company information page.

A cookie is a small text file that a website asks your browser to store and sends back on later visits. Cookies are how a website recognises that two requests came from the same person, which is what keeps you signed in as you move between pages.

Similar technologies do the same job in a different way. The two we use are:

• Local storage. A larger, longer-lived store in your browser. Unlike a cookie, it is not automatically attached to every request we make, so it never travels to a third party by accident. We use it for preferences, a copy of your profile, some unfinished work, and, on this website, a conversation you have opened with our assistant. If you allow affiliate tracking, Tradedoubler’s script keeps a few entries here too.
• Session storage. The same idea, but cleared as soon as you close the tab. We use it for short-lived steps such as returning you to the right screen after a settings page, for a held point-of-sale transaction you have recalled, and, if you allow analytics, for keeping a Session Replay recording together.

Reading counts as much as writing. Some of our code reads information your browser already holds, such as your screen size when you file a VAT return with HMRC. PECR covers gaining access to information on your device as well as storing it, so we list that read here too. Throughout this policy we use “storage” to mean all of these, and we say specifically which one applies in the tables below.

Website storage generally falls into the categories below. SorviAI sets the first two without asking, runs the next two only with your consent, and does not use the last.

The first time you visit our public website or open the SorviAI app, a consent banner asks which optional storage you allow. Nothing optional runs until you answer.

• Equal choices. “Accept all” and “Reject all” sit side by side with the same weight, so refusing takes no more effort than accepting. “Manage choices” (“Manage” in the app) lets you switch each optional category on or off, and both start switched off.
• Shared by the website and the app. Your answer is kept in the sorvi_consent cookie on sorviai.com and its subdomains, so a choice made on the website holds in the app, and the other way round.
• Yours to change. “Cookie settings”, in the website footer and in the user menu of the SorviAI app, reopens your choices at any time. Withdrawing consent deletes the affiliate cookies and storage, switches Google Analytics off and deletes its cookies, and stops Session Replay.
• A record of your answer. Each time you answer, we also keep a record of it on our servers: a random consent ID, which optional categories you allowed, the button you used, whether you answered on the website or in the app, the page you were on (without anything after a question mark in its address), which version of the banner you saw, and the time. It holds no name, account, IP address or browser details. The same ID sits in the sorvi_consent cookie, and “Cookie settings” shows it to you, so you can quote it if you ask us about your choices. We keep the record because UK GDPR requires us to be able to show that consent was given, and we delete it six years after your last answer, or sooner if you ask us to and quote your ID.
• Renewed after 180 days. Your answer lasts that long. After it lapses, or sooner if we change what we ask for, such as adding a category, the banner asks again. Rewording the banner does not make it ask again. On 9 October 2026 it asked everyone afresh, because Google Analytics joined the Analytics category.

There is no advertising category, because SorviAI shows no adverts. Affiliate tracking is a different thing: it tells us which partner sent you so we can pay them, and we use none of it to target adverts or to sell data. The website and the app work fully whatever you choose, and there is no cookie wall. Emails are covered separately, under emails sent from SorviAI.

These are true cookies, sent with requests to our servers. This is the complete list. Every one is first-party: it belongs to a SorviAI address, and no website outside SorviAI can read it. Most are tied to the exact address you are visiting; the few shared across sorviai.com and its subdomains say so.

On the SorviAI platform and the Portal

The prefixes on the first four names are instructions to your browser: a cookie named __Host- or __Secure- is refused over an unencrypted connection, and a __Host- cookie cannot be set or read by any other subdomain, which keeps one workspace’s session off another workspace’s address. Earlier versions of the app kept sign-in tokens in local storage. The current version keeps them only in the cookies above, where page scripts cannot reach them, and deletes the old auth_tokens entry when you sign out.

On a shared file page

A business using Nest can send you a public link to a file. That page opens in the SorviAI app without a sign-in. The page itself sets no cookie of its own and writes nothing to your browser: a password you type is sent once to check it and is not stored. Because the page runs inside the app, the app’s own start-up still applies: on first load it writes the sorvi-storage-cleanup:v1 marker described under necessary storage, it fetches the app’s fonts from Google Fonts, Cloudflare sets __cf_bm, and, if you have allowed analytics, Sentry Session Replay can record the visit as it does elsewhere in the app. Each view and download is recorded on our servers with your IP address and browser details, for the business that shared the file; our Privacy Policy explains that record.

On this public website

Our public website sets no other cookies. The preference cookies wait until you act, and the affiliate and analytics cookies until you consent. If you have not picked a country, the site may redirect you on arrival using the country Cloudflare derives from your IP address; that is not stored. Outside cookies, the site keeps the conversation with our assistant, if you open it, until you close the chat, and Tradedoubler’s local storage, if you allow affiliate tracking. Our own staff sign in to two internal content tools; those set session cookies for staff only, on separate internal addresses.

On storefronts

This is where most of SorviAI’s browser storage lives. It stays on your device and is read by the application running in your browser. We describe it all here, even though none of it is technically a cookie, because PECR covers it in the same way.

Necessary storage

Preference storage

These remember a choice you made in the interface. Nothing here is written until you act, none of it leaves your device, and losing all of it costs you nothing beyond your layout settings. We describe it by category, because a key is added each time a screen gains a preference. The first table covers most keys; the second lists the keys in the current build that do not follow those patterns.

Work in progress and copies of business data

A few screens keep unfinished work in your browser so that a reload, a closed tab or an expired sign-in does not throw it away. Unlike the preferences above, these can hold business or personal information: a customer’s name on a held sale, the text of a reply you have not sent. They never leave your device through this storage, but anyone using the same browser profile after you could see them.

Your business records themselves live on our servers. These entries are working copies, and on a shared computer the safe habit is to sign out and clear site data for SorviAI when you finish. Signing out does not clear the entries in this table today.

Affiliate storage

Analytics storage

The assistant on this website

The chat that opens from “Need help? Let’s chat” is a scripted assistant that runs entirely in your browser. It answers from a fixed script, so the conversation itself is never sent to us, to any model, or to any other company, and no record of it exists on our servers. The one thing that does reach us is a message you choose to write and send through the “Write to us” form it can open. Nothing is written to your browser until you open the chat yourself, and closing the chat erases what was written. The entry holds nothing that identifies you, and anything unused for more than 24 hours is discarded rather than restored.

One identifier that deserves a specific mention

If your organisation has connected our HMRC tax filing feature, we generate a random device identifier and store it as hmrc_device_id in local storage. It is written only in a workspace connected to HMRC, the first time someone there uses that feature. HMRC requires software that talks to its Making Tax Digital VAT service to send information identifying the device the request came from, as part of its fraud prevention rules.

That information is wider than the identifier alone. Each time you use the HMRC feature (looking up your VAT obligations, liabilities or payments, or submitting a return) our code reads your browser’s user agent, time zone, screen size and colour depth, display scaling factor and window size, and sends them with the identifier to our servers. Our servers add your public IP address and port with a timestamp, a hashed form of your user ID and our own public IP address, and pass all of it to HMRC. When a connected VAT page opens, your VAT obligations are fetched automatically, so opening that page counts as using the feature. None of it is read or sent at any other time, used for any other purpose, or shared with anyone except HMRC. We treat this storage and reading as strictly necessary: the VAT filing you asked for cannot be made without it. The identifier stays in your browser until you clear site data.

We allow no third party to place advertising cookies in SorviAI. Tradedoubler sets cookies for affiliate tracking, and Google Analytics for audience measurement, each only with your consent. The other suppliers below are worth naming because they set a security cookie or receive some technical information from your browser.

• Tradedoubler, our affiliate network, runs the programme through which partners earn commission for referring customers to SorviAI. Only after you allow affiliate tracking does this website load Tradedoubler’s script from svht.tradedoubler.com. The script sets the tduid cookie and the local storage listed above, and contacts clk.tradedoubler.com, tbs.tradedoubler.com, tbl.tradedoubler.com and swrap.tradedoubler.com, which sends Tradedoubler your IP address and browser details. If you then create a workspace and complete its first paid subscription, our servers send Tradedoubler the click reference, the subscription number as the order number, and the first payment amount, excluding VAT, with its currency. We never send your name, email address or card details, and later payments are not reported. Withdrawing consent deletes the cookies and storage. Anything Tradedoubler keeps on its own addresses is covered by its own privacy and cookie policies.
• Google Analytics measures how many people visit this website and what they read there. It runs on our public website only, not in the SorviAI app. Nothing from Google loads until you switch analytics on; then the script, fetched from Google, sets the _ga and _ga_2L8QNHVNBH cookies listed above and sends Google the pages you view (including moves between pages), the page that referred you, an approximate location derived from your IP address, your device and browser details, and session and engagement events such as scrolling, clicks on links that leave our site, searches on the site, file downloads and video plays. Google states that Google Analytics does not log or store IP addresses. We use it for audience measurement only: its advertising features are always switched off, Google Signals is not enabled, and we do no remarketing. Event-level data is kept for 14 months; reports built from it are aggregated and are not subject to that limit. Switching analytics off tells the script consent is withdrawn, disables it and deletes its cookies.
• Cloudflare sits in front of every SorviAI address as part of our hosting and sets the __cf_bm cookie described above, to protect the service from automated traffic. Cloudflare states that it does not use it to track people from site to site.
• Sentry collects error reports when something in the product goes wrong. A report contains technical details of the failure, which may include the page you were on, and identifies the account by its user ID, email address and username, with the workspace name. Sentry’s session replay feature records what happens on screen in the SorviAI app on 10% of sessions and every session with an error. It masks what you type into form fields, but not the text shown on screen or images, and it runs only if you allow analytics. It writes sentryReplaySession to session storage. Sentry does not set cookies and is not used to track you. We block error reports originating from browser extensions and unrelated third-party scripts so that they are never sent.
• Microsoft handles sign-in when your organisation connects a Microsoft 365 mailbox. That sign-in happens on Microsoft’s own pages, under Microsoft’s cookie policy, before you are returned to SorviAI.
• YouTube supplies the videos in our help guides, on our About page and in the Weekly Tales on our What’s New page, through its youtube-nocookie.com player. Opening one of those pages does not load the player: each video shows only a preview image served by us, and the player is fetched only after you choose to press play. A “Watch on YouTube” link opens YouTube itself, under YouTube’s own cookie policy.
• Google Fonts supplies the typefaces the SorviAI app uses, including on its sign-in and sign-up pages. Your browser fetches them from Google when the app opens, which sends Google your IP address and browser details. No cookie is set through our app.
• jsDelivr supplies the component that displays PDF previews in the app, flag images, emoji images and the animation player, with unpkg as a fallback for the animation player. Each is fetched when a screen needs it, which sends the content network your IP address and browser details. No cookie is set through our app.
• Google Docs Viewer displays previews of Word, Excel and PowerPoint attachments. When you preview one, the app gives docs.google.com a signed, time-limited link to the file, and your browser loads the viewer from Google, which sends Google your IP address and browser details. No cookie is set through our app.

Apart from Tradedoubler’s script and Google Analytics, which both wait for your consent, our public website embeds no third-party advertising, social media or analytics scripts, and no other third-party video, chat or webinar embeds. Its fonts are served from our own servers. Our own assistant is not an embed: it is our code, running in your browser, answering from a script we wrote.

Our customers send invoices, quotes and other documents to their own customers through SorviAI. Those emails are sent through Twilio SendGrid with open and click tracking switched on by default: each carries a tracking pixel, and its links are rewritten to pass through SendGrid. SendGrid records on its own systems when a message is opened and when a link is clicked. Our send log has fields for those times, but nothing fills them today, so the results do not reach SorviAI or the business that sent the email. Customer portal emails and workspace invitations are sent without tracking. The ICO treats a tracking pixel as storage and access on the recipient’s device, within PECR, and recipients are not asked for consent to it today.

Our own newsletter carries no open tracking. Its links pass through a short redirect on our website that counts how often each link is followed, without recording who followed it and without storing anything on your device.

Stated plainly, so there is no ambiguity.

• We do not use cookies or storage to serve you adverts, in SorviAI or anywhere else.
• We do not sell browser storage data, and we share none of it with data brokers or advertising networks. The affiliate click reference goes to Tradedoubler only with your consent, and only so the partner who referred you can be paid.
• We do not track you across other websites. Affiliate tracking is the only exception, and it is yours to refuse: if you allow it, Tradedoubler can link the partner link you followed to a subscription you buy from us. We embed nothing else that would let a third party follow you.
• We do not use fingerprinting to identify your device. The only device details we read are those HMRC’s fraud prevention rules require, read only when you use the HMRC feature and sent only to HMRC.
• We do not keep your business records in your browser. They live on our servers. The work-in-progress copies listed above are the exceptions.
• We do not send your conversation with our assistant anywhere. If you use the assistant to write to one of our desks, that message and anything you attach to it reach us, because sending them is what you asked for.
• We do not put anything in your browser on this public website before you ask us to, except the __cf_bm security cookie Cloudflare sets on every visit.
• We do not run analytics without your consent, even the kind of statistical analytics that UK law now allows without it. Google Analytics on this website waits for you to allow analytics, and we use it to measure our audience, never for adverts or remarketing.

Businesses can use SorviAI to publish their own online catalogue on their own web address. Storefronts take enquiries: you can put products in an enquiry basket and ask the business about them, but there is no checkout and no payment on the storefront. If you are browsing one of those sites, the business running it decides what cookies that site uses, and its own cookie policy applies rather than this one.

The enquiry basket cookie described under cookies we set is the one piece of storage that comes from our platform on those sites, and it exists purely to keep the basket working. The storefront loads its fonts from its own address and sets no analytics or advertising cookies. Anything beyond that, including any analytics or advertising the store owner chooses to add, is their decision and their responsibility to disclose. Some storefront themes include a cookie policy page, a privacy notice and other legal pages as templates for the store owner to complete; the store owner is responsible for making those pages accurate for their own site.

You are in control of what your browser keeps. There are four levels.

• Change your consent. Open “Cookie settings” in the website footer or in the user menu of the SorviAI app, and switch affiliate tracking or analytics on or off. Turning a category off deletes its cookies and storage straight away.
• Clear your preferences without signing out. Most of the preference storage can be reset by changing the setting again in the interface, for example switching the theme back or choosing a different view. A conversation with our assistant clears the same way, by closing the chat.
• Clear everything for SorviAI. Every modern browser lets you delete cookies and site data for a single website. Doing this signs you out, resets your preferences to their defaults and removes any work in progress kept in the browser. Nothing in your workspace is affected, because your business records are stored on our servers.
• Block storage entirely. You can configure your browser to refuse cookies and site storage. Be aware that this will prevent you from signing in to SorviAI at all, because there would be nowhere to keep your session.

The relevant settings live under Privacy in Chrome, Edge and Brave, under Privacy and Security in Firefox, and under Settings then Privacy in Safari. Your browser’s own help pages give current step-by-step instructions.

Some browsers and extensions can send a Do Not Track or Global Privacy Control signal asking sites not to track you, or not to sell or share your information.

Our website and the SorviAI app do not currently read these signals. We do not sell or share your information or use it for advertising. Affiliate tracking, Google Analytics and Session Replay already wait for your answer in the consent banner, but a browser signal does not give that answer for you: choose “Reject all”, or use “Cookie settings”, to refuse them.

This is the United Kingdom version of our Cookie Policy. It applies to workspaces set up for the United Kingdom and to visitors to our website in the United Kingdom. Everyone else is covered by the Global version.

PECR and UK GDPR apply in the same way in England, Wales, Scotland and Northern Ireland.

PECR regulation 6 was amended by the Data (Use and Access) Act 2025, with the changes in force since 5 February 2026. The rule itself has not changed: storing or reading information on your device needs your consent, given with clear information, unless an exemption applies. What changed is the list of exemptions and the penalties.

How our storage fits the UK rule

Affiliate tracking (sorvi_tduid, Tradedoubler’s tduid cookie and its local storage) and Sentry Session Replay with its sentryReplaySession entry are not in this table, because no exemption covers them. Google Analytics, with its _ga and _ga_2L8QNHVNBH cookies, is left out too, because we do not use the exemption described next. All of them run only after you consent in the banner. The tracking pixel in document emails also needs consent, and today it is used without asking for it.

Analytics

Since the 2025 amendments, UK law allows storage used only to collect statistics that help a website owner improve its service, without consent, provided people are told clearly and given a simple, free way to object. We do not rely on that exemption. Google Analytics, which measures visits to this website, runs only after you allow analytics in the banner, and nothing from Google loads before then. Session Replay is a debugging recording rather than simple statistics, so the exemption does not cover it, which is why it waits for your consent.

Consent and the ICO’s guidance

The ICO’s guidance expects a consent request to make refusing as easy as accepting, with no pre-ticked boxes, nothing optional written before you choose, a record of your choice, and a way to change your mind as easily as you gave it. Our banner follows that guidance: “Accept all” and “Reject all” carry equal weight, both optional categories start switched off, nothing optional runs before you answer, the sorvi_consent cookie records your answer, and “Cookie settings” reopens it whenever you want to withdraw.

Enforcement

The 2025 amendments raised the fines the ICO can impose for breaches of PECR to the UK GDPR level: up to £17.5 million or 4% of worldwide annual turnover, whichever is higher.

We update this policy whenever the storage we use changes. The effective date and version at the top tell you which version you are reading. If we ever add storage that is not strictly necessary or a preference you chose, we will tell you here first and ask for your consent before setting it where the law requires consent. We announce changes on this page and by email to workspace account owners. Version 1.3 adds Google Analytics on our website, which runs only if you allow analytics. It replaces version 1.2, effective 7 October 2026, which added the record we keep of each answer you give in the consent banner and showed your consent ID in Cookie settings. Version 1.1, effective 5 October 2026, added the consent banner and affiliate tracking and put Session Replay behind your consent. Every later version will be published here with its date, and earlier versions will be kept at this address.

If you have a question about anything in this policy, or you think we have set something we have not disclosed, please tell us. One address reaches us wherever you are, and we answer in English.

If you want to complain about how we have handled your information, use the form on our contact page or email [email protected]. We acknowledge every data protection complaint within 30 days and respond without undue delay, as our Privacy Policy explains.

You can also complain to the Information Commission (the ICO), at ico.org.uk. The ICO will normally expect you to have come to us first, but nothing here stops you going to it directly.

The words in this policy that carry a specific meaning, in plain language.