Privacy Policy

SorviAI is a business software platform operated by SORVI AI LTD, a private company limited by shares, registered in England and Wales with company number 16927720, with its registered office at Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS, United Kingdom. Our full company details are in our Impressum.

This is the Germany version of our Privacy Policy. It applies to workspaces set up for Germany and to visitors to our website in Germany. Everyone else is covered by the Global version. Both versions describe the same service and give you the same protection.

In this policy, “we”, “us” and “our” mean that company. “You” means the person reading it, whether you hold a SorviAI account yourself or your details appear in someone else’s account.

We have no establishment in the European Union, so the GDPR applies to us because we offer our service to people and businesses in Germany (GDPR article 3(2)). Without an establishment in the EU we have no lead supervisory authority: in Germany you can complain to the data protection authority of the federal state (Land) where you live or work (section 40 of the Federal Data Protection Act, the BDSG, and GDPR article 77). There is no registration with, and no fee payable to, a German data protection authority, so there is no number to show. We have not appointed a representative in the European Union under GDPR article 27. Our data protection contact is [email protected], which accepts messages in English, and how to contact us gives every way to reach us.

SorviAI is used by organisations to run their business. That means we handle personal information in two very different ways, and your rights depend on which one applies to you.

When we decide, we are the controller

If you sign up for SorviAI, get invited into a workspace, pay us, visit our website, subscribe to our newsletter, apply for a job with us or contact our support team, we decide why and how your information is used. In legal terms we are the data controller, and this policy is the document that governs it.

When our customer decides, we are the processor

If your details are inside SorviAI because an organisation put them there, that organisation is the controller and we are only the processor. This applies if you are an employee whose record sits in the Worklink module, a customer or supplier whose contact and invoice records sit in Finance, someone who reported a repair ticket, a visitor signed in at a business’s front desk, someone who sent an enquiry through a storefront, someone who signs in to a business’s customer or vendor portal, someone who opens a file a business shared with a public link, or someone who exchanged emails with a business using our TeamEmail module.

In those cases we hold your information on that organisation’s instructions. The written terms that govern this are our Data Processing Agreement, which article 28 of the GDPR requires and which forms part of our Terms of Service. We do not decide what is collected, we do not use it for our own purposes, and we do not change or delete it on our own initiative.

This policy applies to the SorviAI platform and every application within it, together with our public website and our sales and support communications.

What it does not cover

• Online stores run by our customers. Businesses can publish their own storefront using SorviAI. Storefronts show the business’s own catalogue and take enquiries; they have no checkout. If you are browsing one of those sites or sending an enquiry through it, the business running it is the controller of your information and its own privacy policy applies, not this one.
• Third-party services our customers connect. If a customer links a Microsoft 365 mailbox, a payment gateway, a carrier account or another external account to SorviAI, that provider’s own terms and privacy policy continue to apply to the data held on their systems.
• Other websites we link to. We are not responsible for how they handle your information.

This section covers information we hold as controller, which means information about you as a user or prospective user of SorviAI.

Account and profile information

When you create an account or accept an invitation to a workspace, we collect your email address, first and last name, and optionally your phone number and a profile picture. Your profile can also hold additional email addresses and phone numbers, your gender, country, state or region, time zone and language, if you or an administrator add them. While you are signing up, before your email address is verified, we hold a short-lived pending sign-up record. We record whether your email address has been verified and when, when your account was created and last updated, and which workspaces you belong to.

Authentication and security information

To keep your account secure we hold your password in hashed form, never as readable text. If you enable two-factor authentication we store the secret needed to verify your codes in encrypted form, your recovery codes, and the time you last used a code so that the same code cannot be replayed. We also issue short-lived tokens when you sign in, switch workspace or accept an invitation.

Device, network and activity information

When you take actions in SorviAI we record what was done, when, by which account, together with the IP address and browser user-agent string of the request. This forms the audit log, which lets workspace administrators see who changed what and lets us investigate security incidents.

Each time you sign in we also keep a session record with the IP address, your browser’s user-agent string, a location label derived from the IP address (such as the country or network), and when the session was last used. You can see your own sessions in your profile. A session record is deleted after the session expires.

When someone checks in or out in Worklink, the IP address of that check-in and check-out is stored with the attendance record. That record belongs to the employer, and is described under employee records below. Where a workspace administrator has turned on IP-based access restriction for check-in, we also compare the address of each attempt against the addresses that administrator has allowed.

Error monitoring

When something goes wrong in the SorviAI app, an error report goes to our error-monitoring provider, Sentry, which processes it in its EU region in Frankfurt, Germany. A report carries technical details of the request and the fault, and identifies the account involved by its user ID, email address and username, together with the name of the workspace. Some error log lines can also contain the email addresses a message was being sent to.

Sentry’s session replay feature records what happens on screen to help us find the cause of a fault. In the SorviAI app it records 10% of sessions and every session in which an error occurs. It masks what you type into form fields, but it does not mask the text shown on screen or images, so a recording can show the records you had open, such as customer names, invoice lines or employee details. It runs only if you allow analytics in our consent banner, and stops when you withdraw that consent. While it runs, Sentry writes an entry named sentryReplaySession to your browser’s session storage.

Billing information

We hold your billing contact details, the plan and subscription associated with your workspace, and a record of invoices and payments. Subscription payments are processed by Stripe. Card numbers go straight to Stripe and never reach our servers; to show you which card is on file we fetch its brand, last four digits and expiry date from Stripe when the page loads, and we do not store them.

Support and correspondence

If you contact us for help we keep the messages you send, our replies, and any diagnostic information you choose to share so that we can resolve the issue and improve the product. If you report a problem with the bug reporter inside the app, the report reaches our own support desk as a ticket, together with the details the app attaches: the screen you were on, app versions, your browser details, recent failed requests, the Sentry error reference and any screenshot you include. Our support mailbox runs on Microsoft 365.

Website information

When you visit our public website we collect standard technical information such as IP address, browser type and the pages you viewed, from our server logs. We run no advertising scripts on that site. Two third-party scripts load only with your consent in our banner: Google Analytics, if you allow analytics, records the pages you view, the page that referred you, your device and browser details, an approximate location derived from your IP address, and how you engage with the site; the script of Tradedoubler, our affiliate network, loads if you allow affiliate tracking. Both are explained under who we share information with. Our network provider, Cloudflare, sets a short-lived security cookie to tell people from automated traffic; the other cookies the site can set are written only after you act: for example, your answer in the consent banner, your answer to a “was this helpful?” question on our articles and guides, or the country you pick in the country switcher. Our Cookie Policy lists each of them. When you arrive without having picked a country, the site may send you to a country version based on the country Cloudflare derives from your IP address; that country is not stored in a cookie or linked to you.

If you open the chat with our assistant, that conversation is kept in your own browser so a reload does not lose it: it is answered by a script running there, it never reaches us, and closing the chat erases it. The assistant does not ask for or store your email address or phone number. You can also write to a desk from inside that chat, and a message you send that way reaches us exactly as one sent from our contact page does.

A message sent through a contact form arrives with us by email, together with the name and address you give us. Any file you attach is held in private storage and a copy is included in the email to the desk. Attachments are deleted from our storage automatically 30 days after they are uploaded, and the copy in the receiving mailbox is kept as set out under how long we keep information.

Newsletter

If you subscribe to our newsletter we hold your email address, your name if you give it, where you signed up, and a record of your consent: the time you asked to subscribe, the IP address the request came from, and the time you confirmed. We send you a confirmation email first and add you to the list only after you click the link in it, so that nobody can subscribe you without your knowledge. We record whether each issue was delivered to you. Newsletters carry no open tracking. Links in an issue pass through our own short redirect, which counts how often each link is followed without recording who followed it. Every newsletter carries an unsubscribe link, and unsubscribing takes effect at once.

Marketing email

In Germany, marketing email is governed by section 7 of the Act against Unfair Competition (UWG), which implements article 13 of the ePrivacy Directive (2002/58/EC) and applies to business addresses as well as private ones. We send marketing email only with your prior express consent (section 7 (2) number 2) or, for our own customers, where we collected the address in connection with a sale, the email is about our own similar products, you have not objected, and we told you clearly that you can object at any time when we collected it and in every message (section 7 (3)).

Subscribers who sign up on our website confirm by email before they receive anything. Our earlier launch “notify me” list was single opt-in, and addresses imported from existing lists can be added as confirmed without a confirmation email; we send no marketing to those addresses until they have re-confirmed by email. Every message says who it is from, carries our postal address and gives a working way to opt out.

Job applications

If you apply for a role through our careers page we hold the name, email address and phone number you give us, the role you applied for, your CV, and a cover letter if you choose to send one. We also record the time you gave your consent and the IP address you gave it from, so that we can show the consent was given. We ask for your consent before you send any of it, and we rely on that consent as our legal basis.

Your CV and any cover letter are stored privately, are never published, and are reached only through a link that expires, by the people involved in hiring for that role. The hiring team is told about a new application by email; that email carries your contact details and time-limited links to your files, not the files themselves.

We keep an application for 12 months from the day it arrives and then delete it, together with the files. You can withdraw your consent or ask us to delete an application at any time, and we will act on it.

This section covers content that our customers put into their workspace. We process it on their instructions, as described under our two roles. We are telling you what it consists of so that you know what we hold, not because we decide what happens to it.

Business contacts and financial records

Names, job titles, email addresses, phone numbers and postal addresses of a customer’s own clients and suppliers, together with quotes, sales orders, invoices, credit notes, bills, purchase orders, goods receipts, payments, expenses, inventory items, price lists, tax records and storefront enquiries. The same applies to budgets, statements, stock counts, point-of-sale sales (including walk-in customers), helpdesk contacts, companies and tickets in Escalate, call and meeting records, campaign contacts and repair technicians.

Employee records

Customers using the Worklink module can store detailed records about their staff. Depending on what that employer chooses to record, this may include a profile photograph, date of birth, gender, marital status, a national identification number, a tax identification number and a social security number (each a free-text field the employer may fill or leave empty), emergency contact name, phone number and relationship, bank name, routing code and bank account number, annual pay, present and permanent home addresses, personal email address and mobile number, dependants with their names, relationship and dates of birth, education and work history, an “about me” text, uploaded documents such as contracts or copies of right-to-work documents, performance reviews, training records, company assets issued to the employee, resignation or separation requests with exit-interview answers, and day-to-day attendance, shift, leave and timesheet records. Worklink has no dedicated right-to-work field or document type: such a copy is an ordinary uploaded document.

Every workspace that uses Worklink is set up with a “Sick Leave” leave type, and every leave request needs a reason typed as free text, so an employee or manager can end up writing details of an illness there. A leave request can also carry a supporting document, such as a doctor’s note, if the employee or employer attaches one. Details of an illness are health data.

There is no dedicated field for a national insurance or social security number: such a number goes into one of the free-text identification, tax or social security fields. Those fields are stored, and returned by our programming interface, in plain text to anyone the employer has given access to employee records: there is no separate restriction on them. Detail screens show only the last four characters; the edit form shows the full number.

For every working day, a Worklink attendance record holds:

• the check-in and check-out times, and the hours, breaks and overtime calculated from them;
• whether the employee arrived late or left early, by how many minutes, and any reason the employee gave for being late;
• how the check-in was made (in the web app, from the header, by an administrator, automatically, through a personal link or on a wall-mounted kiosk tablet using the employee’s personal kiosk code), and which kiosk tablet, if one was used;
• the IP address of the check-in and of the check-out.

Worklink also shows each employee’s live presence status (whether they are checked in and when they were last active) to users with access, and it marks employees as absent automatically each day when no check-in is recorded, for the employer to review. The personal check-in link works without signing in.

Worklink uses no biometrics: no fingerprints and no facial recognition. It does not record location coordinates or photographs at check-in; the only image it holds is an optional profile picture. The IP address is stored on every check-in and check-out; there is currently no setting to turn that off.

If you are an employer

You are the controller of your employees’ records, and the employment and data protection law of your own country decides what you may record and for how long. Record a national identification or social security number only where you need it, for example for payroll or tax. Health information, such as the reason for sick leave, is special category data under article 9 of the GDPR, and your national law may add conditions of its own. Many countries also set how long working-time records must be kept, and some require you to consult a works council or other employee representatives before you introduce a system that records attendance.

In Germany, for example, a works council has a right of co-determination before you introduce or use a technical system able to monitor employees’ behaviour or performance (Works Constitution Act, BetrVG, section 87 (1) number 6), which Worklink’s attendance records and presence status are; agree its use with the works council first. Working time must be recorded (Federal Labour Court, 13 September 2022, 1 ABR 22/21), and records of hours worked beyond the daily limit kept for at least two years (Working Hours Act, ArbZG, section 16 (2)). For the legal basis of employee data, rely on the GDPR (article 6, or article 88 with a works agreement), not on a general national employment clause. We provide no template works agreement or impact assessment pack for Worklink today, and our error-monitoring session replay (see error monitoring) can record the employee screens it shows. Our Data Processing Agreement sets out what we do for you as your processor.

Visitors at a business’s front desk

A business using Worklink’s visitor desk can record each visitor’s name, phone number, email address, company, purpose of visit, the person they are visiting, badge, notes, check-in and check-out times and the office they visited. It can also record the type and number of an identity document the visitor shows, such as a passport or residence permit number. The document number is masked in responses from our programming interface. The business is the controller of these records.

Mailbox content

Where a customer connects a Microsoft 365 mailbox to the TeamEmail module, we sync and store message content, subject lines, sender and recipient addresses, attachments and threading metadata so that the customer’s team can work on those conversations inside SorviAI. Access is granted by the customer’s own administrator through Microsoft’s consent process and can be revoked by them at any time, which stops any further sync.

Emails a workspace sends

When a workspace sends a document by email from SorviAI, such as an invoice or a quote, we keep a send log: the sender, the recipients, the subject, the full rendered message, the time it was sent and whether it was delivered. Document emails are sent through Twilio SendGrid with open and click tracking switched on by default: each carries a tracking pixel, and its links are rewritten to pass through SendGrid. SendGrid records on its own systems when a message is opened and when a link is clicked. Our send log has fields for open and click times, but nothing fills them today, so those results do not reach SorviAI. Customer portal emails and workspace invitations are sent without tracking.

Service and repair tickets

Details of reported faults, the device or item concerned, and whatever the person reporting the issue chose to write, along with the contact details needed to keep them updated. The business’s staff can add comments to a ticket; those comments are internal to the business, and the person who reported the fault does not see the ticket or its comments in SorviAI.

Files and attachments

Any document, image or other file that a user uploads to their workspace, including files stored in Nest.

Files shared through a public link

A business using Nest can share a file with someone outside the business by creating a public link. Public links are allowed unless a workspace administrator switches them off. The person creating a link can protect it with a password, set it to expire, make it view-only, and revoke it at any time.

If you open a file through one of these links, we record each view, each download and each failed password attempt, with the time, the IP address the request came from and your browser’s user-agent string. The purpose is to let the business see how its link has been used and to detect abuse of the link, such as someone guessing its password. The business that created the link is the controller of this record and can see it; we keep it as its processor, until the link or the file is deleted. Revoking a link does not delete it.

Data protection law requires us to have a valid reason for each purpose. The table below sets out ours, in the terms used by the GDPR (article 6).

Legitimate interests. Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that our use does not override them. You can ask us for a summary of that assessment at any time, and you can object to processing based on legitimate interests as described under your rights.

Using information for a new purpose. We use information only for the purpose we collected it for, or for a new purpose the law treats as compatible with it (GDPR article 6(4)). We will tell you before we use your information for anything else.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to third parties for their own marketing.

We use a small number of cookies and similar browser storage to make SorviAI work, and two optional kinds that run only with your consent. A consent banner asks on your first visit to our website or the SorviAI app, and “Cookie settings”, in the website footer and the app’s user menu, lets you change your answer at any time. There are four categories.

• Strictly necessary. These keep you signed in, maintain your session, route you to the correct workspace and protect against cross-site request forgery. Our network provider, Cloudflare, also sets a cookie named __cf_bm on our website and on workspace addresses to tell people from automated traffic; it expires after 30 minutes of inactivity, and a cookie named sorvi_consent records your answer in the consent banner, with a random consent ID that links it to the record of that answer we keep on our servers. The service cannot function without these, so they are set without asking for consent.
• Preferences. These remember choices such as your light or dark theme setting and your layout preferences, and on our public website the country you picked and the conversation you opened with our assistant. They are written only after you act, and exist purely to make things behave the way you left them. European regulators treat storage that only remembers a choice you made as part of the service you asked for (Article 29 Working Party, Opinion 04/2012). In Germany such storage is strictly necessary for a service you expressly asked for (TDDDG, section 25 (2) number 2), so it needs no consent.
• Affiliate. If a partner’s link brought you to our website and you allow affiliate tracking, we keep the Tradedoubler click reference in a cookie named sorvi_tduid for 90 days, and Tradedoubler’s own script sets its tduid cookie and some local storage. Nothing is stored before you agree, and withdrawing deletes it. How the reference is used is explained under who we share information with.
• Analytics and diagnostics. On our public website this is Google Analytics, which counts visits and the pages read and sets two cookies, _ga and _ga_2L8QNHVNBH, for up to two years; it does not run in the SorviAI app. In the app it is Sentry Session Replay, a screen recording used to debug faults, described under error monitoring above, which masks form inputs but not on-screen text or images and writes sentryReplaySession to session storage. Both run only if you allow analytics, and withdrawing stops them and deletes what they stored.

We show no adverts and set no advertising cookies, on the platform or on our public website. Our analytics cookies wait for your consent, so we rely on no analytics exemption in any country; session replay is not simple statistics and no such exemption would cover it. Document emails that workspaces send are tracked by default, as described under emails a workspace sends; our newsletter carries no open tracking.

The SorviAI app currently loads its typefaces from Google Fonts, and loads the component that displays PDF previews, flag images, emoji images and the animation player from the jsDelivr content network, with unpkg as a fallback for the animation player. Opening the app, or the screen that needs one of these, sends your IP address and browser details to those providers. When you preview a Word, Excel or PowerPoint attachment, the app hands a signed, time-limited link to the file to the Google Docs Viewer (docs.google.com), which fetches the file to display it. None of these sets a cookie through our app.

Our Cookie Policy lists every cookie we set with its purpose and expiry, describes the browser storage we use, and explains how to clear or block it.

We do not sell your information. We share it only with the suppliers listed below, who process it on our instructions, with our affiliate network if you allow affiliate tracking, with Google if you allow analytics on our website, and in the limited legal circumstances set out at the end of this section.

Our sub-processors

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

Services a customer chooses to connect

These providers are not our sub-processors. A customer switches each one on for its own workspace, and the data they receive is sent at that customer’s direction and under that provider’s own terms.

Our affiliate network

Partners can earn commission for referring customers to SorviAI through Tradedoubler, our affiliate network. If you arrive through a partner’s link and allow affiliate tracking, Tradedoubler’s script on our website receives your IP address and browser details and sets the cookie and storage our Cookie Policy lists. When you create a workspace, we keep the click reference with it. When that workspace’s first paid subscription is completed, our servers send Tradedoubler the click reference, the subscription number as the order number, and the first payment amount, excluding tax, with its currency, so the partner can be paid. We do not send your name, email address or payment card details, and later payments are not reported.

Withdrawing consent through “Cookie settings” deletes the cookies and storage in your browser. It does not reach a click reference already stored with a workspace; if you want that removed, write to us at [email protected].

Google Analytics on our website

We use Google Analytics to measure how people use our public website, sorviai.com: how many visit, which pages they read and how they found us. It does not run in the SorviAI app. Nothing loads from Google for it until you allow analytics in our consent banner. Once you do, Google’s script sets the cookies our Cookie Policy lists and sends Google the pages you view, the page that referred you, your device and browser details, and events from your visit, such as scrolls, clicks on links to other websites, searches on the site, file downloads and video engagement. Google derives an approximate location from your IP address, and states that Google Analytics 4 does not log or store IP addresses. We use it for audience measurement only: advertising features stay switched off, and we use neither Google Signals nor remarketing. The data is processed in the United States, and Google LLC is certified under the EU-US Data Privacy Framework.

Withdrawing consent through “Cookie settings” switches Google Analytics off and deletes its cookies. Visits measured before then stay in our Google Analytics property for the period set out under how long we keep information.

Changes to our suppliers

We review these lists when our suppliers change. If we add or replace a supplier that processes customer content, we will announce it on the Compliance page, which holds the maintained list, and email workspace account owners at least 30 days in advance, and a customer who objects may raise it with us under the Data Processing Agreement. There is no separate subscription for these notices.

Other disclosures

We may also disclose information where we are legally required to, for example in response to a valid court order or a lawful request from a regulator or law enforcement. We are a UK company, so such requests normally reach us under the law of the United Kingdom; a request from a German or other EU authority normally reaches us through the UK authorities, under mutual legal assistance arrangements. We disclose only what we are compelled to disclose, and where we are permitted to tell you or the customer concerned, we will. Our Abuse Policy describes how we handle these requests. If our business is sold or reorganised, information may transfer to the acquiring entity, which would remain bound by this policy or a materially equivalent one.

The SorviAI application and its database run on DigitalOcean in its London region, behind Cloudflare’s network, and uploaded files are stored in DigitalOcean’s London region. Each customer’s data is held in a separate database schema, which is explained further under how we protect information. A customer in Germany has their workspace on the same infrastructure as everyone else, unless we have agreed something different with them in writing. No EU hosting region is offered today.

Transfers into the United Kingdom

Using SorviAI from Germany means your information is transferred to and stored in the United Kingdom, because that is where the service runs. That transfer rests on the European Commission’s adequacy decision for the United Kingdom, renewed on 19 December 2025 and valid until 27 December 2031, so no further safeguard is needed.

Transfers onward from the United Kingdom

Some of the suppliers named above operate outside the United Kingdom, and some of our staff provide support from India. Each rests on its own footing.

• Suppliers in the European Economic Area and Switzerland. Sentry processes our error reports in Frankfurt, Germany, and Stripe’s contracting entity is in Ireland, both inside the European Union. GeoNames is in Switzerland, which the European Commission recognises as adequate. No extra safeguard is needed.
• Suppliers in the United States. Each of our US suppliers is certified under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), and we rely on that certification for the data it covers. DigitalOcean, Twilio and Sentry’s parent are certified for non-HR data only. For HR data, such as the Worklink records a customer keeps, Twilio’s data protection addendum provides the transfer terms, while DigitalOcean holds the data in London and its agreement adds no separate safeguard if that data is reached from the United States. The supplier table shows which applies to each.
• Access by our team in India. Some of our team work from India and can reach customer data to run and support the service. Everyone on that team is employed by SORVI AI LTD, so they are part of the same company. The European Data Protection Board (Guidelines 05/2021) does not treat access by a company’s own employees as a transfer to another organisation, and the data stays on our systems in London under this policy. Before anyone works for us in India as a contractor or through another company, we will put the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in place with them, backed by a transfer risk assessment that covers access by Indian public authorities.

For information from Germany and the rest of the European Economic Area, GDPR chapter V applies to each onward transfer. Where a transfer rests on contract terms rather than on adequacy or certification, we will assess, before relying on it, that your information remains protected to that standard. You can ask us for a copy of the safeguards that apply by writing to the address in how to contact us.

We keep information only as long as we need it for the purposes set out under how we use information, or as long as the law requires. Where nothing deletes something automatically, the row says so.

Information we have deleted can remain in a backup copy until that copy is overwritten in the seven-day rotation. We do not separate it out in the meantime, and we do not use backups for anything other than recovering from a failure.

No system is perfectly secure, but these are the specific measures we take, and the limits we know about.

• Separation between customers. Every customer’s data lives in its own database schema, not in shared tables filtered by a column. Separation is enforced by the database itself, so a fault in application code cannot leak one customer’s records into another’s workspace.
• Encryption. Traffic between your browser and our servers is encrypted in transit. At rest, DigitalOcean encrypts the database volumes (LUKS, AES-XTS with 512-bit keys) and its database backups (AES-256), and states that files in its object storage are encrypted at rest.
• Private file access. Uploaded files are private by default and are served through signed links that expire, so a copied link does not grant lasting access. Files that a customer deliberately publishes, such as company logos and storefront product images, are served from public addresses that do not expire.
• Two-factor authentication. Every user can switch it on for their own account, with recovery codes. The secret used to verify your codes is stored encrypted, and each code can only be used once. Workspace administrators cannot yet require it of their users, it is not offered to Portal users, and hardware security keys and single sign-on are not supported.
• Short-lived sessions. Access tokens expire after 60 minutes and must be renewed.
• Role-based access control. Workspace administrators grant permissions per application, so a user only reaches the modules and records their role allows.
• Audit logging. Many actions are recorded with the account, timestamp, IP address and browser, so unusual activity can be traced. Coverage is incomplete: Repairs records only deletions, only a few settings screens write audit records, sign-ins through the public login, workspace selection and sign-in link exchange write no audit entry, and failed sign-ins are not logged with the account and IP address. The audit log is not yet tamper-evident, and an audit entry is not written in the same database transaction as the change it records, so a failed write can lose the entry.
• Staff access. When a member of our support staff opens a workspace as a customer’s user, which a senior engineer must approve and which is done only to resolve a support request, investigate a credible abuse report or meet a legal duty, the start of that session is recorded in the same transaction as the access, in our own platform audit log rather than the customer’s, and a banner shows in the customer’s interface. The individual actions taken during that session are not separately logged. Our director and one or two senior engineers can also connect to production databases directly; that list is reviewed every quarter, and those connections leave no audit record.
• If a breach happens. Where a personal data breach affects a customer’s data, we will tell that customer’s workspace administrators within 48 hours of confirming it, so that they can meet their own 72-hour deadline to notify their supervisory authority. Where a breach affects information we control, we notify the competent German state data protection authority, through its online breach notification form, and any other EU supervisory authority the law requires us to notify (with no establishment in the European Union, we have no lead authority), within 72 hours of becoming aware of it unless it is unlikely to result in a risk to you, and we tell you directly if it is likely to result in a high risk to you.

Our Security page describes each measure in more detail, and the same statements form the security annex of our Data Processing Agreement, so we list only what is true today.

Under the GDPR you have the rights below. The section on German law sets out what German law adds on top.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to correct anything inaccurate or incomplete.
• Erasure. Ask us to delete your information, where we have no continuing lawful reason to keep it.
• Restriction. Ask us to pause our use of your information while a concern is resolved.
• Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format.
• Objection. Object to processing we carry out on the basis of legitimate interests, and object at any time to direct marketing.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
• No penalty for asking. We will not deny you service, charge you a different price or give you a worse experience because you exercised a right.

To exercise any of these, write to [email protected], in English. We handle each request by hand: there is no self-service tool that gathers everything we hold about one person, so a member of our team searches each system and assembles the answer. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if that happens. We do not charge a fee unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, to make sure we are not disclosing your information to someone else. We ask only for what we need to do that. Under the GDPR the one-month period runs from when we receive your request. When you ask for a copy of your information, we carry out a reasonable and proportionate search for it.

If your information is in a workspace run by your employer or another organisation, that organisation is the controller: send your request to them, and we will help them answer it.

The GDPR applies to us under article 3(2), because we offer our service to people and businesses in Germany. In Germany it applies together with the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), with section 25 of the Telecommunications Digital Services Data Protection Act (TDDDG) on cookies and other storage on your device, and with section 7 of the Act against Unfair Competition (UWG) on marketing email.

Browser privacy signals

Our website and the SorviAI app do not currently read Do Not Track or Global Privacy Control signals from your browser. We do not sell or share personal information, and we run no advertising tracking, so there is no sale, sharing or targeted advertising for such a signal to switch off. Google Analytics on our website and Session Replay, described under error monitoring, wait for your answer in the consent banner; a browser signal does not give that answer for you.

Our supervisory authorities in Germany

We have no establishment in the European Union, so no single EU authority leads on our processing. In Germany the data protection authority of each federal state supervises businesses (section 40 BDSG), and you can complain to the authority where you live or work; each EU authority is competent for people in its own country. We have not appointed a representative in the European Union under GDPR article 27, so you and the authorities contact us directly at [email protected].

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

We do not make decisions about you based solely on automated processing that produce legal effects or otherwise significantly affect you. One automated step exists: Worklink marks an employee as absent each day when no check-in is recorded. The employer reviews and can correct that record, and it is not a decision about the employee on its own.

SorviAI is business software sold to organisations. It is not directed at children and we do not knowingly collect information from anyone under 16, the age Germany applies for consenting to online services (GDPR article 8). We do not track anyone for advertising or target advertising at anyone, children included.

A storefront is run by our customer. If a storefront is likely to be used by children, the children’s privacy rules that apply to it are the business’s to follow.

If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

We update this policy when the way we handle information changes. The effective date and version at the top always tell you which version you are reading.

If a change materially affects your rights or how we use your information, we will give workspace owners at least 30 days notice by email before the change takes effect. Minor corrections take effect when published. Version 1.3 adds Google Analytics on our website, which runs only if you allow analytics. It replaces version 1.2, effective 7 October 2026, which added the record we keep of your answers in the cookie consent banner and the automatic deletion of contact form attachments after 30 days. Version 1.1, effective 5 October 2026, added the consent banner and affiliate attribution through Tradedoubler and put Session Replay behind your consent. Every later version will be published here with its date, and earlier versions will be kept at this address.

For anything about this policy or your personal information, contact us using the details below. One address reaches us; please write in English. We acknowledge every privacy enquiry within 2 working days, and answer fully within one month, the deadline the GDPR sets.

Who is responsible for data protection

If you are unhappy with how we have handled your personal information, please complain to us first, using the form on our contact page or by emailing [email protected]. We will acknowledge your complaint within 2 working days, look into it, and respond without undue delay, and within one month, telling you what we have done and what happens next.

You also have the right to complain to a supervisory authority at any time, whether or not you have complained to us. In Germany that is the data protection authority of the federal state (Land) where you live or work. The Federal Commissioner for Data Protection and Freedom of Information (BfDI) lists every state authority with its contact details at www.bfdi.bund.de. If you live or work in another EU country, or the issue arose there, you can complain to the authority there instead; the European Data Protection Board lists them at edpb.europa.eu.

The words in this policy that carry a specific legal meaning, in plain language.