Privacy Policy
How Sorby collects, uses, shares, and protects personal data, and the rights people have under data-protection law. Applies to visitors of sorby.io, people who create a Sorby account, and people whose data ends up inside a Sorby workspace because a customer entered it.
Last updated: 17 October 2026.
Who we are
Sorby is the company that operates the Sorby Discovery service. The current operating entity, until incorporation, is Sorby's founder, a sole proprietor based in Tbilisi, Georgia. Upon incorporation, the operating entity will become Sorby, Inc., a Delaware C-Corporation. Notice will be given when the operating entity changes; the latest details will be posted on this page.
For all data-protection matters, use our contact form. We are not required to appoint a Data Protection Officer under GDPR Article 37 given our scale and the nature of our processing.
Controller or processor
Sorby plays two roles depending on whose data is involved.
We are the data controller for: visitors to sorby.io (cookies, request logs, contact-form submissions), and people who create a Sorby account (account-level data — name, email, hashed credentials, MFA, sign-in events). This Privacy Policy applies to that processing.
We are the data processor for: workspace content entered by our customers. The customer (your employer, in most cases) is the controller. They decide what data goes in and why; we process it on their documented instructions. Research participants and other end users whose data ends up in a workspace should contact the customer who runs that workspace — see Workspace data subjects below.
What we collect, why, and on what lawful basis
| Category | Examples | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Account data | Name, email, hashed password, MFA secrets, OAuth identifiers | Create and maintain your Sorby account; authenticate sign-in; secure the service | Performance of contract (Art. 6(1)(b)) |
| Workspace membership | Workspace IDs you belong to, your role | Route you to the right workspace and apply correct permissions | Performance of contract (Art. 6(1)(b)) |
| Sign-in and security events | IP, User-Agent, timestamp, success/failure | Detect abuse, investigate incidents, enforce rate limits | Legitimate interest (Art. 6(1)(f)) |
| Application logs (Vercel) | URL paths, request metadata | Debug, monitor uptime, investigate incidents | Legitimate interest (Art. 6(1)(f)) |
| Error reports (Sentry, EU) | Error message and stack trace; URL and method of the failing request with cookies and auth headers stripped; browser and OS metadata. We attach no account id, email or IP | Find and fix bugs | Legitimate interest (Art. 6(1)(f)) |
| Transactional email (Resend) | Recipient address; for invitations the inviter name, workspace name, role and optional note; delivery status | Deliver workspace invitations and account notices | Performance of contract (Art. 6(1)(b)) |
| Workspace content | Whatever the customer enters | Provide the Sorby Discovery service to the customer | The customer's lawful basis applies; not ours |
| Inbound contact | Name, profile link and the contact handle (email, phone or Telegram) you give us at /intro; a hash of your IP for rate limiting. A copy is pushed to the founder as a Telegram message | Respond to your message | Legitimate interest (Art. 6(1)(f)) |
| Cookies (essential) | Session cookies (Clerk), CSRF tokens | Keep you signed in; protect against forgery | Performance of contract — strictly necessary |
| Usage analytics (PostHog, EU) | Random visitor id; page URLs, clicks and scroll depth; on public marketing pages a replay of the visit with every form field masked; for signed-in users the account id, email and workspace id attached to product events | See how sorby.io is read, where sign-up and onboarding lose people, and fix usability problems | Legitimate interest (Art. 6(1)(f)) for cookie-less measurement; consent (Art. 6(1)(a)) before anything is stored on your device |
We do not process special-category personal data (Article 9 GDPR) for our own purposes. We do not knowingly collect personal data from children under 16; if you believe a child has given us personal data, use our contact form and we will delete it.
How we use AI
Sorby uses Anthropic's API for backlog parsing and assistive features. Anthropic does not train its models on data submitted via the API; this is contractual under their commercial terms.
Sorby itself does not train, fine-tune, or build any model on customer content or on personal data we hold as controller. We do not use AI to make solely automated decisions that produce legal or similarly significant effects on you; you have the right not to be subject to such decisions under Article 22 GDPR.
Who we share data with
We share personal data only with the following recipients, and only as needed to provide the service:
- Sub-processors that operate the infrastructure — database, hosting, identity, rate limiting, AI inference, usage analytics, error monitoring and transactional email. Current list: /legal/sub-processors.
- Telegram (Telegram Messenger Inc.) — when you submit the contact form at /intro, a copy of your submission (name, profile link, contact handle) is delivered to the founder as a Telegram message so it can be answered quickly. Telegram's own privacy policy (telegram.org/privacy) applies to that message.
- Professional advisers (lawyers, accountants) under confidentiality.
- Authorities where legally required, after challenging requests that do not comply with applicable law.
- An acquirer or successor in the event of a merger, acquisition, or sale of substantially all assets — bound by this Policy or one at least as protective.
We do not sell or share personal data for advertising. We do not enrich, augment, or share customer data with marketing, advertising, or data-broker vendors. The two tools that see how the product is used — PostHog (usage events, EU Cloud, Frankfurt) and Sentry (error reports, EU region, Frankfurt) — receive pseudonymous events, the identifiers described under Cookies and analytics below, and stack traces — never the text of your workspace as such.
Public showcase (customer-initiated publication)
A workspace owner or admin can publish a public showcase: a read-only copy of the workspace's goals home, reachable by anyone who has the secret link — no sign-in required. It shows the workspace's name; active goals with their names, metric names and aggregated progress (baseline, target, current value, confirmed, projected and estimated progress, gap, milestone titles and completion, weeks in flight, due date); the titles of opportunities, solutions and experiments, the pipeline stage and team each one sits in, whether an experiment's result is still to be recorded, and how they link to each other and to goals; coverage figures derived from those links; pipeline stage names; and team names and colours. The snapshot deliberately excludes member names, descriptions, hypotheses, success criteria, individual experiment results (their aggregate appears only as goal progress), prioritization scores, comments, AI-import drafts, work that belongs to closed goals, and item types switched off in the workspace, and the page is marked as not indexable by search engines. Titles and names are published exactly as written: the publishing customer, acting as controller, is responsible for ensuring the published text contains no personal data they do not intend to make public. A showcase published before this update keeps its earlier content (goal names, descriptions, metrics and due dates; solution titles, descriptions, hypotheses and success criteria; team names and colours; pipeline stage names) until it is re-published or revoked. Revoking the showcase in Settings disables the link immediately; copies made while it was live may persist outside our control.
International data transfers
Some sub-processors (Clerk, Anthropic, Upstash, Vercel, Resend, and GitHub for encrypted backups) operate from the United States; PostHog and Sentry are hosted in Frankfurt. Where personal data of EU/EEA or UK residents is transferred outside the EEA or UK, the transfer is covered by the European Commission's Standard Contractual Clauses (2021/914) and, for UK transfers, the UK International Data Transfer Addendum. These clauses are included by reference in our DPA — see /legal/dpa.
The copy of a contact-form submission sent to Telegram, which operates outside the EEA, relies on Article 49(1)(b) GDPR: it is necessary for the pre-contractual step you asked for — being contacted.
How long we keep data
| Category | Retention |
|---|---|
| Account data | Life of your account, plus 30 days after deletion to allow recovery. Then deleted. |
| Workspace membership | Same as the workspace it relates to. |
| Workspace content (we are processor) | Life of the customer subscription + 30-day grace + up to 30 days for backup ageing. After 60 days from termination, no copy exists. |
| Sign-in and security events | 12 months, then deleted. |
| Application logs | 30 days at the hosting provider, then aged out. |
| Error reports | 90 days at Sentry, then deleted. |
| Transactional email | Delivery logs stay with Resend under its retention policy; the invitation record itself lives with the workspace and expires with the invitation. |
| Inbound contact | Up to 24 months, unless earlier deletion is requested. The Telegram copy is deleted by the founder on the same schedule. |
| Backups | Nightly encrypted copy of the production database, kept 7 days; encrypted with a key only Sorby holds before it is stored with GitHub. Supabase-managed backups and Point-in-Time Recovery from the paid database tier. Backups inherit retention from primary data. |
When the retention period ends, data is deleted from primary storage; encrypted backups age out and are overwritten on the schedule above. We also delete data earlier on request — see Your rights.
How we protect data
Our security model is documented at /security. Headlines: TLS 1.2+ in transit, AES-256 at rest, role-based access, MFA available to every user, append-only audit log, app-layer plus defence-in-depth tenant isolation, 72-hour breach notification.
If we discover a personal-data breach affecting you, we will notify the relevant supervisory authority within 72 hours where required by Article 33 GDPR, and we will notify you directly without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
Your rights
Under the GDPR and UK GDPR you have the right to:
Access (Art. 15)
Receive a copy of the personal data we hold about you.
Rectification (Art. 16)
Correct inaccurate or incomplete data.
Erasure (Art. 17)
Have your data deleted ("right to be forgotten").
Restriction (Art. 18)
Restrict processing in certain circumstances.
Portability (Art. 20)
Receive a portable copy in a structured, machine-readable format.
Object (Art. 21)
Object to processing based on legitimate interest, including profiling.
Withdraw consent
Withdraw consent at any time where consent is the lawful basis (without affecting lawfulness before withdrawal).
No solely automated decisions (Art. 22)
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions today.
Lodge a complaint
With your data-protection supervisory authority. EU: edpb.europa.eu; UK: ico.org.uk.
If you live in California, you have similar rights under the CCPA/CPRA, including the right to know, delete, correct, and opt-out of "sale" or "sharing" — we do not sell or share personal data for cross-context behavioural advertising.
To exercise any of these, use our contact form. We will verify your identity and reply within 30 days. You will not be charged for a request unless it is manifestly unfounded or excessive.
Workspace data subjects
If you are a research participant or other end user whose data was entered into a Sorby workspace by one of our customers, the customer is the data controller and we are the processor. Send your request to that customer. If you contact us directly, we will tell you who controls the workspace your data is in (where we can identify them), forward the request, and assist the customer in fulfilling it. We will not action the request ourselves, because we are not the controller.
Cookies and analytics
Strictly necessary cookies — session cookies and CSRF tokens placed by our authentication provider, Clerk, that keep you signed in and protect your form submissions. These do not require consent under EU law because they are strictly necessary to provide the service you have asked for.
Usage analytics (PostHog) — we use PostHog, hosted in the EU (Frankfurt), to see how sorby.io is read and where sign-up and onboarding lose people. Until you accept the banner, PostHog stores nothing on your device: it keeps a random visitor id in memory for the length of the page and forgets it when you leave. If you accept, that id is kept in a cookie and local storage so your visits can be linked. If you decline, no analytics events are sent at all. You can change your mind by clearing site data in your browser; doing so will also sign you out of Sorby.
On our public marketing pages (the home page, /about, /compare, /roadmap, /intro, /security and /legal) PostHog also records a replay of the visit — scrolling, clicks and mouse movement — with every form field masked. Nothing inside a Sorby workspace, on the sign-in and sign-up pages, in the onboarding wizard or on a public showcase is ever recorded. Signed-in users are identified to PostHog by their account id and email so that product usage can be understood per account; product events carry item types and workspace ids, never the text you write.
Marketing
We send transactional emails (sign-up confirmation, security notices, billing) on the lawful basis of performance of contract or legitimate interest. We do not send marketing emails to people who have not opted in. Every marketing email includes a one-click unsubscribe link and unsubscribing is honoured immediately.
Changes to this Policy
We will update this Policy when our practices, sub-processors, or legal obligations change. Material changes are announced by updating the Last updated date at the top of this page and emailing every workspace admin with an active subscription, at least 30 days before the change takes effect. Previous versions are available on request via our contact form.
Contact
For privacy questions, data-subject requests, or security disclosures, use our contact form.