Privacy Policy

SorviAI is a business software platform operated by [REGISTERED COMPANY NAME], a company registered in [JURISDICTION] under company number [COMPANY NUMBER], with its registered office at [REGISTERED OFFICE ADDRESS].

In this policy, “we”, “us” and “our” mean that company. “You” means the person reading it, whether you hold a SorviAI account yourself or your details appear in someone else’s account.

We are registered with the UK Information Commissioner’s Office under registration number [ICO REGISTRATION NUMBER]. Our data protection contact is [PRIVACY CONTACT EMAIL], and the contact section lists our regional contacts.

SorviAI is used by organisations to run their business. That means we handle personal information in two very different ways, and your rights depend on which one applies to you.

When we decide, we are the controller

If you sign up for SorviAI, get invited into a workspace, pay us, visit our website or contact our support team, we decide why and how your information is used. In legal terms we are the data controller, and this policy is the document that governs it.

When our customer decides, we are the processor

If your details are inside SorviAI because an organisation put them there, that organisation is the controller and we are only the processor. This applies if you are an employee whose record sits in the Worklink module, a customer or supplier whose contact and invoice records sit in Finance, someone who reported a repair ticket, a shopper who ordered from a storefront, or someone who exchanged emails with a business using our TeamEmail module.

In those cases we hold your information on that organisation’s instructions and under a written agreement with them. We do not decide what is collected, we do not use it for our own purposes, and we cannot change or delete it on our own initiative.

This policy applies to the SorviAI platform and every application within it, together with our public website and our sales and support communications.

What it does not cover

• Online stores run by our customers. Businesses can publish their own storefront using SorviAI. If you are shopping on one of those sites, the business running it is the controller of your information and its own privacy policy applies, not this one.
• Third-party services our customers connect. If a customer links a Microsoft 365 mailbox, a payment gateway or another external account to SorviAI, that provider’s own terms and privacy policy continue to apply to the data held on their systems.
• Other websites we link to. We are not responsible for how they handle your information.

This section covers information we hold as controller, which means information about you as a user or prospective user of SorviAI.

Account and profile information

When you create an account or accept an invitation to a workspace, we collect your email address, first and last name, and optionally your phone number and a profile picture. We record whether your email address has been verified and when, when your account was created and last updated, and which workspaces you belong to.

Authentication and security information

To keep your account secure we hold your password in hashed form, never as readable text. If you enable two-factor authentication we store the secret needed to verify your codes in encrypted form, along with the time you last used a code so that the same code cannot be replayed. We also issue short-lived tokens when you sign in, switch workspace or accept an invitation.

Device, network and activity information

When you take actions in SorviAI we record what was done, when, by which account, together with the IP address and browser user-agent string of the request. This forms the audit log, which lets workspace administrators see who changed what and lets us investigate security incidents.

Where a workspace administrator has turned on IP-based access restriction for attendance check-in, we compare the IP address of a check-in attempt against the addresses that administrator has allowed.

Billing information

We hold your billing contact details, the plan and subscription associated with your workspace, and a record of invoices and payments. [SUBSCRIPTION PAYMENT PROVIDER, AND WHETHER WE EVER SEE CARD NUMBERS]

Support and correspondence

If you contact us for help we keep the messages you send, our replies, and any diagnostic information you choose to share so that we can resolve the issue and improve the product.

Website information

When you visit our public website we collect standard technical information such as IP address, browser type and the pages you viewed, from our server logs. We run no analytics, advertising or marketing scripts on that site, and the one cookie it can set - a “was this helpful?” answer on our articles and guides, stored only if you choose to answer - identifies nobody. Our Cookie Policy sets out the complete position.

Job applications

If you apply for a role through our careers page we hold the name, email address and phone number you give us, the role you applied for, your CV, and an offer letter if you choose to send one. We ask for your consent before you send any of it, and we rely on that consent as our legal basis. Your CV and any offer letter are stored privately, are never published, and are reached only through a link that expires, by the people involved in hiring for that role. We keep an application for 12 months from the day it arrives and then delete it, together with the files. You can withdraw your consent or ask us to delete an application at any time, and we will act on it.

This section covers content that our customers put into their workspace. We process it on their instructions, as described under our two roles. We are telling you what it consists of so that you know what we hold, not because we decide what happens to it.

Business contacts and financial records

Names, job titles, email addresses, phone numbers and postal addresses of a customer’s own clients and suppliers, together with quotes, sales orders, invoices, credit notes, bills, purchase orders, goods receipts, payments, expenses, inventory items, price lists and storefront orders.

Employee records

Customers using the Worklink module can store detailed records about their staff. Depending on what that employer chooses to record, this may include a profile photograph, date of birth, gender, marital status, national identification number, emergency contact name, phone number and relationship, bank name and routing code, uploaded documents such as contracts or right-to-work evidence, and day-to-day attendance, shift, leave and timesheet records.

Mailbox content

Where a customer connects a Microsoft 365 mailbox to the TeamEmail module, we sync and store message content, subject lines, sender and recipient addresses, attachments and threading metadata so that the customer’s team can work on those conversations inside SorviAI. Access is granted by the customer’s own administrator through Microsoft’s consent process and can be revoked by them at any time, which stops any further sync.

Service and repair tickets

Details of reported faults, the device or item concerned, and whatever the person reporting the issue chose to write, along with the contact details needed to keep them updated.

Files and attachments

Any document, image or other file that a user uploads to their workspace.

Data protection law requires us to have a valid reason for each purpose. The table below sets out ours, in the terms used by UK and European law.

Legitimate interests. Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that our use does not override them. You can ask us for a summary of that assessment at any time, and you can object to processing based on legitimate interests as described under your rights.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to third parties for their own marketing. That statement is made deliberately in the language of United States state privacy law as well as plain English, because “sale” and “sharing” are defined broadly there. See sale and sharing in the key terms.

We use a small number of cookies and similar browser storage to make SorviAI work. There are two categories only:

• Strictly necessary. These keep you signed in, maintain your session, route you to the correct workspace and protect against cross-site request forgery. The service cannot function without them, so they are set without asking for consent.
• Preferences. These remember choices such as your light or dark theme setting and your layout preferences. They are written only after you make the choice, and exist purely to make the product behave the way you left it.

We use no analytics, advertising or tracking cookies, on the platform or on our public website, and we allow no third party to set one. That is why you see no consent banner.

Our Cookie Policy lists every cookie we set with its purpose and expiry, describes the browser storage we use, and explains how to clear or block it.

We do not sell your information. We share it only with the suppliers listed below, who process it on our instructions under a written contract, and in the limited legal circumstances set out at the end of this section.

We review this list when our suppliers change. If we add or replace a supplier that processes customer content, we will notify workspace administrators at least [SUB-PROCESSOR CHANGE NOTICE PERIOD] in advance, and a customer who objects may raise it with us under their agreement. The current list is always published at [SUB-PROCESSOR PAGE URL].

Other disclosures

We may also disclose information where we are legally required to, for example in response to a valid court order or a lawful request from a regulator or law enforcement. Where we are permitted to tell you, we will. If our business is sold or reorganised, information may transfer to the acquiring entity, which would remain bound by this policy or a materially equivalent one.

Our primary database and all uploaded files are stored in the United Kingdom. Each customer’s data is held in a separate database schema, which is explained further under how we protect information.

This is true wherever you are. A customer in India or the United States has their workspace stored in the United Kingdom, on the same infrastructure as everyone else, unless we have agreed something different with them in writing.

Transfers out of the United Kingdom

Some of the suppliers named above operate outside the United Kingdom, most notably Groq in the United States. Where information is transferred out of the UK or the European Economic Area, we rely on [TRANSFER MECHANISM] to make sure your information continues to be protected to the standard required by UK and EU law.

Transfers into the United Kingdom

If you are in India or the United States, using SorviAI means your information is transferred to and stored in the United Kingdom. We rely on your agreement with us, or your employer’s, together with the safeguards described under how we protect information. India’s law permits transfer to most countries subject to any restrictions the government sets, and we will update this section if a restriction affects the United Kingdom.

You can ask us for a copy of the safeguards that apply by writing to the address in the contact section.

We keep information only as long as we need it for the purposes set out under how we use information, or as long as the law requires.

Where we cannot delete information immediately, for example because it exists in a backup, we isolate it and delete it when that backup is next rotated.

No system is perfectly secure, but these are the specific measures we take.

• Separation between customers. Every customer’s data lives in its own database schema, not in shared tables filtered by a column. Separation is enforced by the database itself, so a fault in application code cannot leak one customer’s records into another’s workspace.
• Encryption. Traffic between your browser and our servers is encrypted in transit. Uploaded files are encrypted at rest.
• Private file access. Uploaded files are private by default and are served through signed links that expire, so a copied link does not grant lasting access. Files that a customer deliberately publishes, such as storefront product images, are served from public addresses that do not expire.
• Two-factor authentication. Available on every account. The secret used to verify your codes is stored encrypted, and each code can only be used once.
• Short-lived sessions. Access tokens expire after 60 minutes and must be renewed.
• Role-based access control. Workspace administrators grant permissions per application, so a user only reaches the modules and records their role allows.
• Audit logging. Actions are recorded with the account, timestamp, IP address and browser, so unusual activity can be traced. Staff access to workspace content is itself logged.

These are the rights we honour for everyone, wherever you are. The section on where you are sets out what your own country’s law adds on top, because the wording and the deadlines differ.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to correct anything inaccurate or incomplete.
• Erasure. Ask us to delete your information, where we have no continuing lawful reason to keep it.
• Restriction. Ask us to pause our use of your information while a concern is resolved.
• Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format.
• Objection. Object to processing we carry out on the basis of legitimate interests, and object at any time to direct marketing.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
• No penalty for asking. We will not deny you service, charge you a different price or give you a worse experience because you exercised a right.

To exercise any of these, write to the address in the contact section. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if that happens. We do not charge a fee unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, to make sure we are not disclosing your information to someone else.

SorviAI is used by businesses in the United Kingdom, the European Economic Area, India and the United States. We apply one standard of protection to everyone, which is the strictest of the four. What changes by region is the name of the law, some of the wording for your rights, and who you can complain to.

SorviAI includes optional AI features that help generate and edit document templates. When a user chooses to use one of these features, the content they submit is sent to Groq, an AI provider based in the United States, and processed by a large language model to produce the result.

The feature only runs when a user actively triggers it. Content is not sent to any AI provider in the background, and we do not feed your workspace, your customer records or your employee records to a model.

[AI PROVIDER RETENTION AND MODEL-TRAINING POSITION]

We do not make decisions about you by automated means alone that produce legal effects or otherwise significantly affect you.

SorviAI is business software sold to organisations. It is not directed at children and we do not knowingly collect information from anyone under 16, or under 18 where our customer is in India, whose law treats everyone under 18 as a child and prohibits tracking or targeted advertising to them. We do neither to anyone.

If you believe a child has provided us with personal information, contact us at the address in the contact section and we will delete it.

We update this policy when the way we handle information changes. The effective date and version at the top always tell you which version you are reading.

If a change materially affects your rights or how we use your information, we will give workspace owners at least [POLICY CHANGE NOTICE PERIOD] notice by email and show a notice inside the product before the change takes effect. Minor corrections take effect when published.

Previous versions remain available at [ARCHIVE URL].

For anything about this policy or your personal information, contact us using the details below. One address reaches us wherever you are, and we answer in English. We aim to acknowledge every privacy enquiry within [ACKNOWLEDGEMENT TIME] working days, and to answer fully within the deadline your own law sets.

Regional contacts

Some of the regional laws set out above require a named contact inside the region. Where one is required of us, it is listed here.

Complaints

If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the regulator for your region, listed under where you are. In the United Kingdom that is the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

The words in this policy that carry a specific legal meaning, in plain language.