Privacy policy

Effective date: 25 October 2026

Sorted is operated by SMEtools LLC, a Delaware limited liability company, at https://sortedos.com. Contact: info@sortedos.com. Sorted connects a business’s own systems (Odoo, Shopify, Google Ads, Google Analytics 4 and Meta ads) into one dashboard that the client reads on the website and inside the client’s own AI assistant (Claude or ChatGPT) through Sorted’s connector. Each company’s data is kept apart from every other company’s.

What we collect

• Sign-in. When you sign in with Google, Google gives us your name, email address and profile image. We use your verified email address to check that you are an authorised user of a company, and we keep it with your company and role. Your name and image are not saved in our database; they exist only in your sign-in session, which lasts up to 7 days.
• Your business numbers. Every hour Sorted reads the systems you connected and saves a snapshot of figures, charts and tables for your company. From Odoo: ledger, invoicing, bank and cash figures, and the names of the customers and suppliers with the largest balances. From Shopify: order totals, refunds, discounts, counts and statuses (no customer, address or product-name fields). From Google Ads and Meta ads: spend, clicks, impressions, conversions and campaign names and status for the last 30 days. From Google Analytics: sessions, users, key events, revenue and traffic-channel totals for the last 30 days.
• Connections and choices. Which systems are connected, who connected them and when, whether they last worked, your dashboard layout, and any requests you make for a new number (our team reads these to add the number).
• Teammates. Where an owner has added colleagues, we keep each person’s email address and role, what the owner has allowed that person to see, and a record of who added, changed or removed whom and when. When an owner uses “view as” to see a teammate’s dashboard, our server log records the owner’s and the teammate’s email addresses and the time.
• AI assistant access. When you link Sorted to Claude or ChatGPT, we record your email, company and the assistant’s web address so the access can be checked and ended.
• Billing. Card payments are handled by Stripe. Sorted never sees or stores card numbers. We keep Stripe’s customer and subscription IDs, the plan status and renewal date, and we may give Stripe your email address when you subscribe.

Questions and messagesالأسئلة والرسائل

If you send us a question or message through the form on our website, the form collects your name, work email, company, country, your systems (the ones you tick) and, only if you choose to give it, your WhatsApp number. We use it only to contact you about Sorted. We do not sell it and we do not use it for advertising. We keep it for up to 12 months, or until you ask us to delete it, and we delete it within 30 days of a written request to info@sortedos.com. When a request arrives, a short alert with only the company and country (no name, email or number) may be sent to the Sorted team’s messaging app.إذا أرسلت لنا سؤالاً أو رسالة عبر النموذج في موقعنا، فإن النموذج يجمع اسمك وبريد عملك الإلكتروني وشركتك ودولتك والأنظمة التي تحدّدها، ورقم واتساب فقط إن اخترت تقديمه. نستخدمها فقط للتواصل معك بشأن Sorted. لا نبيعها ولا نستخدمها للإعلانات. نحتفظ بها حتى 12 شهراً، أو إلى أن تطلب حذفها، ونحذفها خلال 30 يوماً من طلب كتابي إلى info@sortedos.com. وعند وصول طلب قد يُرسل تنبيه قصير إلى تطبيق المراسلة الخاص بفريق Sorted يتضمن الشركة والدولة فقط (دون الاسم أو البريد أو الرقم).

Google user data

Sorted accesses only this Google user data:

• Google sign-in: your name, email address and profile image.
• Google Ads: read-only campaign performance and account data. The company’s owner chooses Connect Google Ads and approves the permission https://www.googleapis.com/auth/adwords. We receive a lasting permission token and keep only that. Sorted only asks Google Ads reporting questions; it never creates, edits or deletes anything in your account.
• Google Analytics: report data, read by Sorted’s own Google service account, which you add to your property as a Viewer. You send us only the property number. A member of our team confirms the property is yours before any data is collected.

How it is used: only to show the client’s own dashboard to that client’s authorised users and to their AI assistant. Google user data is not used for advertising, is not sold, is not used to train AI models, and is not read by people except with the client’s permission, for security, or where the law requires.

Sorted's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect it

• Connection secrets, such as the Google Ads permission token, are locked with public-key encryption before they are stored. The website holds only the public key, so it can lock a secret but cannot open one; only the collector’s private key can. Our website’s database login cannot read stored secrets at all. (Older connections that our team set up for a client use AES-256-GCM encryption instead.)
• Each company’s rows are fenced off inside the database (row-level security). Database connections are encrypted and verified.
• Only a company’s owner can connect or remove its systems, and this is checked on every request.
• Access keys for the AI connector are stored only as one-way hashes.

If you let your own AI assistant help you connectإذا استعنت بمساعدك الذكي الخاص في الربط

A company’s owner may choose to let their own AI assistant help connect their systems. The assistant works in the owner’s own browser and only when the owner asks it to. It asks for the owner’s yes only for important steps (money, deletion, changes the owner did not ask for, and making a key). For Odoo it uses a key on the owner’s own user and creates no new user. The owner types every password and sign-in code. With the owner’s yes the assistant makes a key and passes it to Sorted with Sorted’s own connection tool. The key is part of the assistant’s call, so it can remain in that conversation’s history with the AI provider the owner chose; the assistant does not repeat it back to the owner, and Sorted locks it on arrival so that only Sorted’s collector can read it. Sorted only reads your systems and never changes them.يجوز لمالك الشركة أن يختار الاستعانة بمساعده الذكي الخاص لربط أنظمته. يعمل المساعد داخل متصفح المالك نفسه وبطلبه فقط، ولا يطلب موافقة المالك إلا في الخطوات المهمة (المال والحذف وأي تغيير لم يطلبه المالك وإنشاء مفتاح). ومع Odoo يستخدم مفتاحاً على مستخدم المالك نفسه ولا ينشئ مستخدماً جديداً. ويكتب المالك بنفسه كل كلمة سر ورمز دخول. وبموافقة المالك ينشئ المساعد مفتاحاً ويسلّمه إلى Sorted عبر أداة الربط الخاصة بـ Sorted. المفتاح جزء من طلب المساعد، فقد يبقى في سجل تلك المحادثة لدى مزوّد الذكاء الاصطناعي الذي اختاره المالك؛ ولا يكرره المساعد للمالك، وتقوم Sorted بقفله فور وصوله بحيث لا يقرأه إلا جامع البيانات التابع لـ Sorted. وSorted يقرأ بيانات أنظمتك فقط ولا يغيّر فيها شيئاً.

Who we share it with

We never sell personal data. We share it only with the services that run Sorted: Vercel (the website), Supabase (the database), GitHub Actions (the hourly collection job), Stripe (billing, as described above) and PostHog (product analytics, hosted in the United States, as described under Cookies and product analytics). At the client’s direction, the AI assistant the client chooses (Claude or ChatGPT) receives the figures it asks Sorted for, under that provider’s own terms. Sorted also sends read requests to the systems you connect. We disclose information where the law requires it.

Keeping and deleting data

• A company’s owner can remove any connection at any time on the Connections page. That deletes the stored connection key at once and stops new collection. To also cut the permission on Google’s side, remove Sorted at myaccount.google.com/permissions (Google Ads) or remove Sorted’s reader from your Analytics property.
• Numbers already collected stay in your dashboard history until deleted. Business data and stored connection keys are deleted within 30 days of a written request to info@sortedos.com, of the end of the subscription, or of the end of a free trial that was not followed by a subscription.
• To prevent repeated free trials, we keep a limited record of a previous signup after business data is deleted: keyed one-way hashes of the Google account identifier, email address and signup IP, the workspace identifier, and the date and version of the consent you accepted. This record does not contain your dashboard figures or software connection keys. Contact us at info@sortedos.com to ask about this record or request its removal.
• We keep the address you sign in with and the time, for 35 days, to count how often a login is used.نحتفظ بالعنوان الذي تسجّل به الدخول ووقت الدخول لمدة 35 يوماً، لنحسب كم مرة يُستخدم الدخول.
• To end an AI assistant’s access, ask us. It also ends when the person is removed from the company.
• Records that the law requires us to keep, such as billing records, may be kept longer.

Cookies and product analytics

We set only the cookies needed to sign you in and keep you signed in, plus a short-lived security cookie while you connect Google Ads. Your browser also stores your language and display choices. We use no advertising cookies. Page fonts load from Google Fonts.

Sorted uses PostHog (US cloud) for product analytics, so we can see how the site is used and where people get stuck. Until you answer the cookie notice, your visit is counted without any cookie or stored identifier: page views and the named steps below only, held in your browser’s memory for that visit and not linked to you. If you press Decline, or your browser sends Do Not Track, nothing is sent. What is collected: page views (the page path only, without anything after a ? or #), and a short list of named steps: a click on a “Start free trial” button (only which button), sign-up started and completed, the steps of setting up a company, a payment page opened, a system connected (only its kind, for example Odoo or Shopify), an AI assistant connected (only which assistant), and a teammate invited. If you press OK, a first-party cookie and local storage hold a random browser identifier, and a signed-in company is recognised only by a one-way hash, never its name, its id or an email address. On the sign-up page and the company set-up pages only, and only if you pressed OK, we record a session replay (how the page was used: clicks, scrolling and page changes) in which every piece of text and everything typed is hidden, pictures are left out, and the company’s short name is removed from page addresses; no replay is recorded anywhere else, including the dashboard. We do not use form-field capture or automatic click capture. No client business data is ever sent to PostHog: not figures, balances, invoices, customer or supplier names, email addresses, company names, or anything from Odoo, Shopify, Google or Meta, and nothing from the AI assistant’s conversations or tools. The few steps our server reports (sign-up completed, set-up steps, payment page opened, system or assistant connected, teammate invited) are sent unless you pressed Decline or your browser sends Do Not Track, with the company hash only; nothing is sent from billing events or any background job.تستخدم Sorted خدمة PostHog (السحابة الأمريكية) لتحليلات المنتج، لنعرف كيف يُستخدم الموقع وأين يتعثّر الناس. قبل أن تجيب على إشعار ملفات تعريف الارتباط نحسب زيارتك دون أي ملف تعريف ارتباط ودون معرّف مخزَّن: مشاهدات الصفحات والخطوات المسمّاة أدناه فقط، وتبقى في ذاكرة المتصفح أثناء الزيارة ولا تُربط بك. وإذا ضغطت «رفض» أو أرسل متصفحك إشارة «عدم التتبع» فلا يُرسل شيء. ما يُجمع: مشاهدات الصفحات (مسار الصفحة فقط دون أي شيء بعد علامة ؟ أو #)، وقائمة قصيرة من الخطوات المسمّاة: الضغط على زر «ابدأ تجربتك المجانية» (أيّ زر فقط)، وبدء التسجيل وإتمامه، وخطوات إعداد الشركة، وفتح صفحة الدفع، وربط نظام (نوعه فقط مثل Odoo أو Shopify)، وربط مساعد ذكي (أيّ مساعد فقط)، ودعوة زميل. إذا ضغطت «حسنًا» يحفظ ملف تعريف ارتباط من الطرف الأول وذاكرة المتصفح معرّفًا عشوائيًا للمتصفح، ولا تُعرَف الشركة المسجّلة إلا ببصمة أحادية الاتجاه، وليس باسمها ولا رقمها ولا بريد إلكتروني. في صفحة التسجيل وصفحات إعداد الشركة فقط، وفقط إذا ضغطت «حسنًا»، نسجّل إعادة عرض للجلسة (كيف استُخدمت الصفحة: النقرات والتمرير والانتقال بين الصفحات) تُخفى فيها كل النصوص وكل ما يُكتب، وتُستبعد الصور، ويُحذف الاسم المختصر للشركة من عناوين الصفحات؛ ولا يُسجَّل أي شيء في أي مكان آخر، ومنه لوحة المتابعة. لا نلتقط حقول النماذج ولا النقرات تلقائيًا. لا تُرسل أي بيانات تجارية للعميل إلى PostHog أبدًا: لا أرقام ولا أرصدة ولا فواتير ولا أسماء عملاء أو موردين ولا عناوين بريد ولا أسماء شركات ولا أي شيء من Odoo أو Shopify أو Google أو Meta، ولا شيء من محادثات المساعد الذكي أو أدواته. الخطوات القليلة التي يبلغ عنها خادمنا (إتمام التسجيل وخطوات الإعداد وفتح صفحة الدفع وربط نظام أو مساعد ودعوة زميل) تُرسل ما لم تضغط «رفض» أو يرسل متصفحك إشارة «عدم التتبع»، وببصمة الشركة فقط؛ ولا يُرسل شيء من أحداث الفوترة ولا من أي مهمة في الخلفية.

Your rights, children and changes

You can ask to see, correct or delete your data at info@sortedos.com. Sorted is for businesses and is not directed at children. If we change this policy we will post the new version here with a new effective date.