Privacy Policy

SorviAI is a business software platform operated by SORVI AI LTD, a private company limited by shares, registered in England and Wales with company number 16927720, with its registered office at Unit 5a Victoria Road, Stoke-On-Trent, England, ST4 2HS, United Kingdom. Our full company details are in our legal notice.

This is the Global version of our Privacy Policy. It applies to every workspace that is not set up for the United Kingdom, and to visitors to our website outside the United Kingdom. Workspaces set up for the United Kingdom are covered by the United Kingdom version. Both versions describe the same service and give you the same protection.

In this policy, “we”, “us” and “our” mean that company. “You” means the person reading it, whether you hold a SorviAI account yourself or your details appear in someone else’s account.

We are registered with the Information Commission (the ICO) under registration number ZC254426. You can check that entry on the ICO’s public register of fee payers. Because we are a UK company, the ICO regulates us. Our data protection contact is [email protected], and how to contact us gives every way to reach us.

SorviAI is used by organisations to run their business. That means we handle personal information in two very different ways, and your rights depend on which one applies to you.

When we decide, we are the controller

If you sign up for SorviAI, get invited into a workspace, pay us, visit our website, subscribe to our newsletter, apply for a job with us or contact our support team, we decide why and how your information is used. In legal terms we are the data controller, and this policy is the document that governs it.

When our customer decides, we are the processor

If your details are inside SorviAI because an organisation put them there, that organisation is the controller and we are only the processor. This applies if you are an employee whose record sits in the Worklink module, a customer or supplier whose contact and invoice records sit in Finance, someone who reported a repair ticket, a visitor signed in at a business’s front desk, someone who sent an enquiry through a storefront, someone who signs in to a business’s customer or vendor portal, someone who opens a file a business shared with a public link, or someone who exchanged emails with a business using our TeamEmail module.

In those cases we hold your information on that organisation’s instructions. The written terms that govern this are our Data Processing Agreement, which article 28 of the GDPR and of UK GDPR requires and which forms part of our Terms of Service. We do not decide what is collected, we do not use it for our own purposes, and we do not change or delete it on our own initiative.

This policy applies to the SorviAI platform and every application within it, together with our public website and our sales and support communications.

What it does not cover

• Online stores run by our customers. Businesses can publish their own storefront using SorviAI. Storefronts show the business’s own catalogue and take enquiries; they have no checkout. If you are browsing one of those sites or sending an enquiry through it, the business running it is the controller of your information and its own privacy policy applies, not this one.
• Third-party services our customers connect. If a customer links a Microsoft 365 mailbox, a payment gateway, a carrier account or another external account to SorviAI, that provider’s own terms and privacy policy continue to apply to the data held on their systems.
• Other websites we link to. We are not responsible for how they handle your information.

This section covers information we hold as controller, which means information about you as a user or prospective user of SorviAI.

Account and profile information

When you create an account or accept an invitation to a workspace, we collect your email address, first and last name, and optionally your phone number and a profile picture. Your profile can also hold additional email addresses and phone numbers, your gender, country, state or region, time zone and language, if you or an administrator add them. While you are signing up, before your email address is verified, we hold a short-lived pending sign-up record. We record whether your email address has been verified and when, when your account was created and last updated, and which workspaces you belong to.

Authentication and security information

To keep your account secure we hold your password in hashed form, never as readable text. If you enable two-factor authentication we store the secret needed to verify your codes in encrypted form, your recovery codes, and the time you last used a code so that the same code cannot be replayed. We also issue short-lived tokens when you sign in, switch workspace or accept an invitation.

Device, network and activity information

When you take actions in SorviAI we record what was done, when, by which account, together with the IP address and browser user-agent string of the request. This forms the audit log, which lets workspace administrators see who changed what and lets us investigate security incidents.

Each time you sign in we also keep a session record with the IP address, your browser’s user-agent string, a location label derived from the IP address (such as the country or network), and when the session was last used. You can see your own sessions in your profile. A session record is deleted after the session expires.

When someone checks in or out in Worklink, the IP address of that check-in and check-out is stored with the attendance record. That record belongs to the employer, and is described under employee records below. Where a workspace administrator has turned on IP-based access restriction for check-in, we also compare the address of each attempt against the addresses that administrator has allowed.

Error monitoring

When something goes wrong in the SorviAI app, an error report goes to our error-monitoring provider, Sentry, which processes it in its EU region in Frankfurt, Germany. A report carries technical details of the request and the fault, and identifies the account involved by its user ID, email address and username, together with the name of the workspace. Some error log lines can also contain the email addresses a message was being sent to.

Sentry’s session replay feature records what happens on screen to help us find the cause of a fault. In the SorviAI app it records 10% of sessions and every session in which an error occurs. It masks what you type into form fields, but it does not mask the text shown on screen or images, so a recording can show the records you had open, such as customer names, invoice lines or employee details. It runs only if you allow analytics in our consent banner, and stops when you withdraw that consent. While it runs, Sentry writes an entry named sentryReplaySession to your browser’s session storage.

Billing information

We hold your billing contact details, the plan and subscription associated with your workspace, and a record of invoices and payments. Subscription payments are processed by Stripe. Card numbers go straight to Stripe and never reach our servers; to show you which card is on file we fetch its brand, last four digits and expiry date from Stripe when the page loads, and we do not store them.

Support and correspondence

If you contact us for help we keep the messages you send, our replies, and any diagnostic information you choose to share so that we can resolve the issue and improve the product. If you report a problem with the bug reporter inside the app, the report reaches our own support desk as a ticket, together with the details the app attaches: the screen you were on, app versions, your browser details, recent failed requests, the Sentry error reference and any screenshot you include. Our support mailbox runs on Microsoft 365.

Website information

When you visit our public website we collect standard technical information such as IP address, browser type and the pages you viewed, from our server logs. We run no advertising scripts on that site. If you allow analytics in our consent banner, Google Analytics also records the pages you view, the page that referred you, an approximate location derived from your IP address, your device and browser details, and how you engage with the site, such as scrolling, following links that leave it, searching it, downloading files and playing videos. Nothing from Google loads before you allow it. The script of Tradedoubler, our affiliate network, loads only if you allow affiliate tracking. Both are explained under who we share information with. Our network provider, Cloudflare, sets a short-lived security cookie to tell people from automated traffic; the other cookies the site can set are written only after you act: for example, your answer in the consent banner, your answer to a “was this helpful?” question on our articles and guides, or the country you pick in the country switcher. Our Cookie Policy lists each of them. When you arrive without having picked a country, the site may send you to a country version based on the country Cloudflare derives from your IP address; that country is not stored in a cookie or linked to you.

If you open the chat with our assistant, that conversation is kept in your own browser so a reload does not lose it: it is answered by a script running there, it never reaches us, and closing the chat erases it. The assistant does not ask for or store your email address or phone number. You can also write to a desk from inside that chat, and a message you send that way reaches us exactly as one sent from our contact page does.

A message sent through a contact form arrives with us by email, together with the name and address you give us. Any file you attach is held in private storage and a copy is included in the email to the desk. Attachments are deleted from our storage automatically 30 days after they are uploaded, and the copy in the receiving mailbox is kept as set out under how long we keep information.

Newsletter

If you subscribe to our newsletter we hold your email address, your name if you give it, where you signed up, and a record of your consent: the time you asked to subscribe, the IP address the request came from, and the time you confirmed. We send you a confirmation email first and add you to the list only after you click the link in it, so that nobody can subscribe you without your knowledge. We record whether each issue was delivered to you. Newsletters carry no open tracking. Links in an issue pass through our own short redirect, which counts how often each link is followed without recording who followed it. Every newsletter carries an unsubscribe link, and unsubscribing takes effect at once.

Marketing email, wherever you are

The rules on marketing email differ by country: in the European Union, the national laws made under article 13 of the ePrivacy Directive (2002/58/EC); in the United Kingdom, the Privacy and Electronic Communications Regulations 2003 (PECR); in the United States, the CAN-SPAM Act. We follow the strictest of them for everyone. We send marketing email only with your prior consent or, for our own customers, where we collected the address in a sale or negotiation, the email is about our own similar products, and we offered a way to opt out when we collected it and in every message.

Subscribers who sign up on our website confirm by email before they receive anything. Our earlier launch “notify me” list was single opt-in, and addresses imported from existing lists can be added as confirmed without a confirmation email; we send no marketing to those addresses until they have re-confirmed by email. Every message says who it is from, carries our postal address and gives a working way to opt out.

Job applications

If you apply for a role through our careers page we hold the name, email address and phone number you give us, the role you applied for, your CV, and a cover letter if you choose to send one. We also record the time you gave your consent and the IP address you gave it from, so that we can show the consent was given. We ask for your consent before you send any of it, and we rely on that consent as our legal basis.

Your CV and any cover letter are stored privately, are never published, and are reached only through a link that expires, by the people involved in hiring for that role. The hiring team is told about a new application by email; that email carries your contact details and time-limited links to your files, not the files themselves.

We keep an application for 12 months from the day it arrives and then delete it, together with the files. You can withdraw your consent or ask us to delete an application at any time, and we will act on it.

This section covers content that our customers put into their workspace. We process it on their instructions, as described under our two roles. We are telling you what it consists of so that you know what we hold, not because we decide what happens to it.

Business contacts and financial records

Names, job titles, email addresses, phone numbers and postal addresses of a customer’s own clients and suppliers, together with quotes, sales orders, invoices, credit notes, bills, purchase orders, goods receipts, payments, expenses, inventory items, price lists, tax records and storefront enquiries. The same applies to budgets, statements, stock counts, point-of-sale sales (including walk-in customers), helpdesk contacts, companies and tickets in Escalate, call and meeting records, campaign contacts and repair technicians.

Employee records

Customers using the Worklink module can store detailed records about their staff. Depending on what that employer chooses to record, this may include a profile photograph, date of birth, gender, marital status, a national identification number, a tax identification number and a social security number (each a free-text field the employer may fill or leave empty), emergency contact name, phone number and relationship, bank name, routing code and bank account number, annual pay, present and permanent home addresses, personal email address and mobile number, dependants with their names, relationship and dates of birth, education and work history, an “about me” text, uploaded documents such as contracts or copies of right-to-work documents, performance reviews, training records, company assets issued to the employee, resignation or separation requests with exit-interview answers, and day-to-day attendance, shift, leave and timesheet records. Worklink has no dedicated right-to-work field or document type: such a copy is an ordinary uploaded document.

Every workspace that uses Worklink is set up with a “Sick Leave” leave type, and every leave request needs a reason typed as free text, so an employee or manager can end up writing details of an illness there. A leave request can also carry a supporting document, such as a doctor’s note, if the employee or employer attaches one. Details of an illness are health data.

There is no dedicated field for a national insurance or social security number: such a number goes into one of the free-text identification, tax or social security fields. Those fields are stored, and returned by our programming interface, in plain text to anyone the employer has given access to employee records: there is no separate restriction on them. Detail screens show only the last four characters; the edit form shows the full number.

For every working day, a Worklink attendance record holds:

• the check-in and check-out times, and the hours, breaks and overtime calculated from them;
• whether the employee arrived late or left early, by how many minutes, and any reason the employee gave for being late;
• how the check-in was made (in the web app, from the header, by an administrator, automatically, through a personal link or on a wall-mounted kiosk tablet using the employee’s personal kiosk code), and which kiosk tablet, if one was used;
• the IP address of the check-in and of the check-out.

Worklink also shows each employee’s live presence status (whether they are checked in and when they were last active) to users with access, and it marks employees as absent automatically each day when no check-in is recorded, for the employer to review. The personal check-in link works without signing in.

Worklink uses no biometrics: no fingerprints and no facial recognition. It does not record location coordinates or photographs at check-in; the only image it holds is an optional profile picture. The IP address is stored on every check-in and check-out; there is currently no setting to turn that off.

If you are an employer

You are the controller of your employees’ records, and the employment and data protection law of your own country decides what you may record and for how long. Record a national identification or social security number only where you need it, for example for payroll or tax. Health information, such as the reason for sick leave, is special category data under article 9 of the GDPR, and your national law may add conditions of its own. Many countries also set how long working-time records must be kept, and some require you to consult a works council or other employee representatives before you introduce a system that records attendance. Our Data Processing Agreement sets out what we do for you as your processor.

Visitors at a business’s front desk

A business using Worklink’s visitor desk can record each visitor’s name, phone number, email address, company, purpose of visit, the person they are visiting, badge, notes, check-in and check-out times and the office they visited. It can also record the type and number of an identity document the visitor shows, such as a passport or residence permit number. The document number is masked in responses from our programming interface. The business is the controller of these records.

Mailbox content

Where a customer connects a Microsoft 365 mailbox to the TeamEmail module, we sync and store message content, subject lines, sender and recipient addresses, attachments and threading metadata so that the customer’s team can work on those conversations inside SorviAI. Access is granted by the customer’s own administrator through Microsoft’s consent process and can be revoked by them at any time, which stops any further sync.

Emails a workspace sends

When a workspace sends a document by email from SorviAI, such as an invoice or a quote, we keep a send log: the sender, the recipients, the subject, the full rendered message, the time it was sent and whether it was delivered. Document emails are sent through Twilio SendGrid with open and click tracking switched on by default: each carries a tracking pixel, and its links are rewritten to pass through SendGrid. SendGrid records on its own systems when a message is opened and when a link is clicked. Our send log has fields for open and click times, but nothing fills them today, so those results do not reach SorviAI. Customer portal emails and workspace invitations are sent without tracking.

Service and repair tickets

Details of reported faults, the device or item concerned, and whatever the person reporting the issue chose to write, along with the contact details needed to keep them updated. The business’s staff can add comments to a ticket; those comments are internal to the business, and the person who reported the fault does not see the ticket or its comments in SorviAI.

Files and attachments

Any document, image or other file that a user uploads to their workspace, including files stored in Nest.

Files shared through a public link

A business using Nest can share a file with someone outside the business by creating a public link. Public links are allowed unless a workspace administrator switches them off. The person creating a link can protect it with a password, set it to expire, make it view-only, and revoke it at any time.

If you open a file through one of these links, we record each view, each download and each failed password attempt, with the time, the IP address the request came from and your browser’s user-agent string. The purpose is to let the business see how its link has been used and to detect abuse of the link, such as someone guessing its password. The business that created the link is the controller of this record and can see it; we keep it as its processor, until the link or the file is deleted. Revoking a link does not delete it.

Data protection law requires us to have a valid reason for each purpose. The table below sets out ours, in the terms used by UK and European law.

Legitimate interests. Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that our use does not override them. You can ask us for a summary of that assessment at any time, and you can object to processing based on legitimate interests as described under your rights.

Recognised legitimate interests (United Kingdom). Since the Data (Use and Access) Act 2025, UK law lists a small number of “recognised legitimate interests”, such as helping a public body with crime prevention, safeguarding or an emergency, for which no balancing test is needed. We rely on one only in the row above, and only for the disclosure the request needs. Marketing, internal administration and network security are named in the law as examples of processing that may be a legitimate interest, but they are not recognised legitimate interests: for those we still weigh your interests against ours.

Using information for a new purpose. We use information only for the purpose we collected it for, or for a new purpose the law treats as compatible with it (GDPR article 6(4); UK law, as amended in 2025, also lists some compatible purposes). We will tell you before we use your information for anything else.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to third parties for their own marketing. That statement is made deliberately in the language of United States state privacy law as well as plain English, because “sale” and “sharing” are defined broadly there. See sale and sharing in the key terms. Affiliate attribution through Tradedoubler, described under who we share information with, and Google Analytics on our website run only if you opt in through our consent banner.

We use a small number of cookies and similar browser storage to make SorviAI work, and two optional categories, affiliate and analytics, that run only with your consent. A consent banner asks on your first visit to our website or the SorviAI app, and “Cookie settings”, in the website footer and the app’s user menu, lets you change your answer at any time. There are four categories.

• Strictly necessary. These keep you signed in, maintain your session, route you to the correct workspace and protect against cross-site request forgery. Our network provider, Cloudflare, also sets a cookie named __cf_bm on our website and on workspace addresses to tell people from automated traffic; it expires after 30 minutes of inactivity, and a cookie named sorvi_consent records your answer in the consent banner, with a random consent ID that links it to the record of that answer we keep on our servers. The service cannot function without these, so they are set without asking for consent.
• Preferences. These remember choices such as your light or dark theme setting and your layout preferences, and on our public website the country you picked and the conversation you opened with our assistant. They are written only after you act, and exist purely to make things behave the way you left them. European regulators treat storage that only remembers a choice you made as part of the service you asked for (Article 29 Working Party, Opinion 04/2012), and UK PECR, as amended in 2025, allows it expressly, so it needs no consent.
• Affiliate. If a partner’s link brought you to our website and you allow affiliate tracking, we keep the Tradedoubler click reference in a cookie named sorvi_tduid for 90 days, and Tradedoubler’s own script sets its tduid cookie and some local storage. Nothing is stored before you agree, and withdrawing deletes it. How the reference is used is explained under who we share information with.
• Analytics and diagnostics. Both run only if you allow analytics. On our public website, Google Analytics counts visits and the pages read, using the _ga and _ga_2L8QNHVNBH cookies, which last up to two years; switching analytics off deletes them. In the SorviAI app, Sentry Session Replay is a screen recording used to debug faults, described under error monitoring above. It masks form inputs but not on-screen text or images, and writes sentryReplaySession to session storage.

We show no adverts and set no advertising cookies, on the platform or on our public website. Google Analytics is used for audience measurement only, with its advertising features switched off. We rely on no analytics exemption in any country: Google Analytics waits for your consent, and session replay is not simple statistics, so no such exemption would cover it. Document emails that workspaces send are tracked by default, as described under emails a workspace sends; our newsletter carries no open tracking.

The SorviAI app currently loads its typefaces from Google Fonts, and loads the component that displays PDF previews, flag images, emoji images and the animation player from the jsDelivr content network, with unpkg as a fallback for the animation player. Opening the app, or the screen that needs one of these, sends your IP address and browser details to those providers. When you preview a Word, Excel or PowerPoint attachment, the app hands a signed, time-limited link to the file to the Google Docs Viewer (docs.google.com), which fetches the file to display it. None of these sets a cookie through our app.

Our Cookie Policy lists every cookie we set with its purpose and expiry, describes the browser storage we use, and explains how to clear or block it.

We do not sell your information. We share it only with the suppliers listed below, who process it on our instructions, with our affiliate network if you allow affiliate tracking, with Google if you allow analytics on our website, and in the limited legal circumstances set out at the end of this section.

Our sub-processors

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

Services a customer chooses to connect

These providers are not our sub-processors. A customer switches each one on for its own workspace, and the data they receive is sent at that customer’s direction and under that provider’s own terms.

Our affiliate network

Partners can earn commission for referring customers to SorviAI through Tradedoubler, our affiliate network. If you arrive through a partner’s link and allow affiliate tracking, Tradedoubler’s script on our website receives your IP address and browser details and sets the cookie and storage our Cookie Policy lists. When you create a workspace, we keep the click reference with it. When that workspace’s first paid subscription is completed, our servers send Tradedoubler the click reference, the subscription number as the order number, and the first payment amount, excluding tax, with its currency, so the partner can be paid. We do not send your name, email address or payment card details, and later payments are not reported.

Withdrawing consent through “Cookie settings” deletes the cookies and storage in your browser. It does not reach a click reference already stored with a workspace; if you want that removed, write to us at [email protected].

Analytics on our website

We use Google Analytics to measure how many people visit our public website and which pages they read. It does not run in the SorviAI app. Its script loads from Google only after you allow analytics in the consent banner, and then sends Google the details listed under website information, linked to the random ID in its _ga cookie. Google states that Google Analytics does not log or store IP addresses. We use it for audience measurement alone: its advertising features are always switched off, Google Signals is not enabled, and we do no remarketing. Event-level data is kept for 14 months; the aggregated reports built from it are not subject to that limit. Google processes this data in the United States, and Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension.

Withdrawing consent through “Cookie settings” tells Google Analytics that consent is withdrawn, disables it and deletes its cookies from your browser.

Changes to our suppliers

We review these lists when our suppliers change. If we add or replace a supplier that processes customer content, we will announce it on the Compliance page, which holds the maintained list, and email workspace account owners at least 30 days in advance, and a customer who objects may raise it with us under the Data Processing Agreement. There is no separate subscription for these notices.

Other disclosures

We may also disclose information where we are legally required to, for example in response to a valid court order or a lawful request from a regulator or law enforcement. We are a UK company, so such requests reach us under UK law, for example the Investigatory Powers Act 2016, the Crime (Overseas Production Orders) Act 2019 or the UK-US Data Access Agreement; a request from another country normally reaches us through the UK authorities, under mutual legal assistance arrangements. We disclose only what we are compelled to disclose, and where we are permitted to tell you or the customer concerned, we will. Our Abuse Policy describes how we handle these requests. If our business is sold or reorganised, information may transfer to the acquiring entity, which would remain bound by this policy or a materially equivalent one.

The SorviAI application and its database run on DigitalOcean in its London region, behind Cloudflare’s network, and uploaded files are stored in DigitalOcean’s London region. Each customer’s data is held in a separate database schema, which is explained further under how we protect information. This is true wherever you are: a customer in France, Germany, India, Ireland, the Netherlands or anywhere else has their workspace on the same infrastructure as everyone else, unless we have agreed something different with them in writing.

Transfers into the United Kingdom

If you are outside the United Kingdom, using SorviAI means your information is transferred to and stored in the United Kingdom, because that is where the service runs. If you are in the European Economic Area, that transfer rests on the European Commission’s adequacy decision for the UK, renewed on 19 December 2025 and valid until 27 December 2031, so no further safeguard is needed. If you are elsewhere, we rely on your agreement with us, or your employer’s, together with the safeguards described under how we protect information, and your local law continues to apply alongside this policy.

Transfers onward from the United Kingdom

Some of the suppliers named above operate outside the United Kingdom, and some of our staff provide support from India. Each rests on its own footing.

• Suppliers in the European Economic Area and Switzerland. Sentry processes our error reports in Frankfurt, Germany, and Stripe’s contracting entity is in Ireland, both inside the European Union. GeoNames is in Switzerland, which both the European Commission and the UK recognise as adequate. No extra safeguard is needed.
• Suppliers in the United States. Each of our US suppliers is certified under the EU-US Data Privacy Framework and its UK Extension (the UK “data bridge”), and we rely on that certification for the data it covers. The same applies to Google Analytics data from our website, through Google LLC’s certification. DigitalOcean, Twilio and Sentry’s parent are certified for non-HR data only. For HR data, such as the Worklink records a customer keeps, Twilio’s data protection addendum provides the transfer terms, while DigitalOcean holds the data in London and its agreement adds no separate safeguard if that data is reached from the United States. The supplier table shows which applies to each.
• Access by our team in India. Some of our team work from India and can reach customer data to run and support the service. Everyone on that team is employed by SORVI AI LTD, so they are part of the same company. Neither the ICO nor the European Data Protection Board (Guidelines 05/2021) treats access by a company’s own employees as a transfer to another organisation, and the data stays on our systems in London under this policy. Before anyone works for us in India as a contractor or through another company, we will put transfer terms in place with them (the EU Standard Contractual Clauses, and the International Data Transfer Agreement or the UK Addendum for UK data), backed by a transfer risk assessment that covers access by Indian public authorities.

For information from the United Kingdom, a transfer is lawful where the protection it receives abroad is not materially lower than in the UK (the “data protection test” of the Data (Use and Access) Act 2025). For information from the European Economic Area, GDPR chapter V applies to each onward transfer. Where a transfer rests on contract terms rather than on adequacy or certification, we will assess, before relying on it, that your information remains protected to that standard. You can ask us for a copy of the safeguards that apply by writing to the address in how to contact us.

We keep information only as long as we need it for the purposes set out under how we use information, or as long as the law requires. Where nothing deletes something automatically, the row says so.

Information we have deleted can remain in a backup copy until that copy is overwritten in the seven-day rotation. We do not separate it out in the meantime, and we do not use backups for anything other than recovering from a failure.

No system is perfectly secure, but these are the specific measures we take, and the limits we know about.

• Separation between customers. Every customer’s data lives in its own database schema, not in shared tables filtered by a column. Separation is enforced by the database itself, so a fault in application code cannot leak one customer’s records into another’s workspace.
• Encryption. Traffic between your browser and our servers is encrypted in transit. At rest, DigitalOcean encrypts the database volumes (LUKS, AES-XTS with 512-bit keys) and its database backups (AES-256), and states that files in its object storage are encrypted at rest.
• Private file access. Uploaded files are private by default and are served through signed links that expire, so a copied link does not grant lasting access. Files that a customer deliberately publishes, such as company logos and storefront product images, are served from public addresses that do not expire.
• Two-factor authentication. Every user can switch it on for their own account, with recovery codes. The secret used to verify your codes is stored encrypted, and each code can only be used once. Workspace administrators cannot yet require it of their users, it is not offered to Portal users, and hardware security keys and single sign-on are not supported.
• Short-lived sessions. Access tokens expire after 60 minutes and must be renewed.
• Role-based access control. Workspace administrators grant permissions per application, so a user only reaches the modules and records their role allows.
• Audit logging. Many actions are recorded with the account, timestamp, IP address and browser, so unusual activity can be traced. Coverage is incomplete: Repairs records only deletions, only a few settings screens write audit records, sign-ins through the public login, workspace selection and sign-in link exchange write no audit entry, and failed sign-ins are not logged with the account and IP address. The audit log is not yet tamper-evident, and an audit entry is not written in the same database transaction as the change it records, so a failed write can lose the entry.
• Staff access. When a member of our support staff opens a workspace as a customer’s user, which a senior engineer must approve and which is done only to resolve a support request, investigate a credible abuse report or meet a legal duty, the start of that session is recorded in the same transaction as the access, in our own platform audit log rather than the customer’s, and a banner shows in the customer’s interface. The individual actions taken during that session are not separately logged. Our director and one or two senior engineers can also connect to production databases directly; that list is reviewed every quarter, and those connections leave no audit record.
• If a breach happens. Where a personal data breach affects a customer’s data, we will tell that customer’s workspace administrators within 48 hours of confirming it, so that they can meet their own 72-hour deadline to notify their supervisory authority. Where a breach affects information we control, we notify the ICO, and any other supervisory authority the law requires us to notify, within 72 hours of becoming aware of it unless it is unlikely to result in a risk to you, and we tell you directly if it is likely to result in a high risk to you.

Our Security page describes each measure in more detail, and the same statements form the security annex of our Data Processing Agreement, so we list only what is true today.

Under the data protection law that applies to you, you have the rights below, and we honour them for everyone, wherever you are. The section on where you are sets out what your own country’s law adds on top, because the wording and the deadlines differ.

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to correct anything inaccurate or incomplete.
• Erasure. Ask us to delete your information, where we have no continuing lawful reason to keep it.
• Restriction. Ask us to pause our use of your information while a concern is resolved.
• Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format.
• Objection. Object to processing we carry out on the basis of legitimate interests, and object at any time to direct marketing.
• Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
• No penalty for asking. We will not deny you service, charge you a different price or give you a worse experience because you exercised a right.

To exercise any of these, write to [email protected]. We handle each request by hand: there is no self-service tool that gathers everything we hold about one person, so a member of our team searches each system and assembles the answer. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if that happens. We do not charge a fee unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, to make sure we are not disclosing your information to someone else. We ask only for what we need to do that. Under the GDPR the one-month period runs from when we receive your request. Under UK law, as amended in 2025, it runs from when we have what we need to verify you, and it pauses while we wait for a clarification we reasonably need. When you ask for a copy of your information, we carry out a reasonable and proportionate search for it.

If your information is in a workspace run by your employer or another organisation, that organisation is the controller: send your request to them, and we will help them answer it.

We are a UK company, so UK data protection law always applies to what we do. We give everyone the rights and protection the GDPR sets, which is the standard this policy is written to. What changes by region is the name of the law, some of the wording for your rights, and who you can complain to. Where your local law gives you more than this policy, your local law prevails.

Browser privacy signals

Our website and the SorviAI app do not currently read Do Not Track or Global Privacy Control signals from your browser. We do not sell or share personal information, and we run no advertising tracking, so there is no sale, sharing or targeted advertising for such a signal to switch off. Google Analytics on our website and Session Replay, described under error monitoring, run only if you allow analytics in the consent banner; a browser signal does not give or refuse that answer for you.

Our regulator

The Information Commissioner’s Office became the Information Commission on 30 September 2026 under the Data (Use and Access) Act 2025. It is still known as the ICO, and it regulates us in the United Kingdom. That does not stop you complaining to the authority in your own country.

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

We do not make decisions about you based solely on automated processing that produce legal effects or otherwise significantly affect you. One automated step exists: Worklink marks an employee as absent each day when no check-in is recorded. The employer reviews and can correct that record, and it is not a decision about the employee on its own.

SorviAI is business software sold to organisations. It is not directed at children and we do not knowingly collect information from anyone under 16, or under 18 where the law of the country concerned treats everyone under 18 as a child. We do not track anyone for advertising or target advertising at anyone, children included.

A storefront is run by our customer. If a storefront is likely to be used by children, the children’s privacy rules of the country where it operates, such as the ICO’s Age Appropriate Design Code in the United Kingdom, apply to the business running it.

If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

We update this policy when the way we handle information changes. The effective date and version at the top always tell you which version you are reading.

If a change materially affects your rights or how we use your information, we will give workspace owners at least 30 days notice by email before the change takes effect. Minor corrections take effect when published. Version 1.3 adds Google Analytics on our website, which runs only if you allow analytics. It replaces version 1.2, effective 7 October 2026, which added the record we keep of your answers in the cookie consent banner and the automatic deletion of contact form attachments after 30 days. Version 1.1, effective 5 October 2026, added the consent banner and affiliate attribution through Tradedoubler and put Session Replay behind your consent. Every later version will be published here with its date, and earlier versions will be kept at this address.

For anything about this policy or your personal information, contact us using the details below. One address reaches us wherever you are, and we answer in English. We acknowledge every privacy enquiry within 2 working days, and answer fully within the deadline your own law sets.

Who is responsible for data protection

If you are unhappy with how we have handled your personal information, please complain to us first, using the form on our contact page or by emailing [email protected]. We will acknowledge your complaint within 2 working days, look into it, and respond without undue delay, and within one month, telling you what we have done and what happens next.

You also have the right to complain to a supervisory authority at any time, whether or not you have complained to us. In the European Economic Area that is the data protection authority where you live, where you work or where the issue arose; the European Data Protection Board lists them at edpb.europa.eu. In the United Kingdom it is the Information Commission (the ICO), at ico.org.uk or on 0303 123 1113, which will normally expect you to have raised the matter with us first. Elsewhere, it is the regulator named by your local law, under where you are.

The words in this policy that carry a specific legal meaning, in plain language.