Privacy notice

Who we are

SortProof is operated by GBK Solutions Ltd, a company registered in England and Wales (company number 14434333). The registered office is 20 Bouverie Court, Leeds, LS9 8LB. VAT number 453889542. ICO registration CSN3569463.

We are the controller for account details, checker results you ask us to email, support messages, marketing choices, and the billing records we store. When an organisation uses SortProof, we process that organisation’s content on its instructions. The terms set out those instructions. This notice describes the live service. It is not legal advice.

What we collect

• Checker. Answers stay in your browser until you ask for an emailed report. We then store the email address, the answers, the result, whether you opted in to marketing, and salted hashes of the network address and browser. Those records are deleted after 30 days.
• Accounts. Name, email address, a hash of the password, email verification, authenticator settings where you turn them on, organisation membership, and role.
• Organisation content. Sites, assessments, documents, collectors, collection records, compliance packs, comments, and the activity the product records.
• Billing. Stripe takes the card payment. We store the plan, the subscription status, and the Stripe customer and subscription identifiers. We do not store the full card number.
• Support. The contact form stores your email address, the topic, the message, and the page address, so we can reply.
• Assistant. Questions and answers in the in-product assistant are kept for 90 days and then deleted. The assistant’s default provider stays on our network.
• Usage counts. The public site is counted without a cookie. A daily salt produces a key that changes the next day. The count leaves out the network address, the browser, and any account id. Counts under 10 are shown as “<10”.

Why we use it

• Contract. To provide the checker, the workspace, packs, reminders, and the billing you ask for.
• Legitimate interests. To keep accounts secure, scan uploads for malware, limit abuse, and fix faults. Error reports may include a page address and a technical message.
• Consent. Marketing email is sent only after you opt in, on the checker or in Settings. You can turn it off in Settings. Service emails, such as sign-in links and payment receipts, continue.
• Legal obligation. To keep the tax and accounting records that apply to payments.

Who else handles it

The companies that process personal information for us are listed on the subprocessors page. Uploaded files are scanned by ClamAV on a scanner we run ourselves. We do not sell personal information.

How long we keep it

• Checker submissions: 30 days, then deleted, so the result link can keep working until then.
• Assistant conversations: 90 days, then deleted.
• Organisation records and documents: while the account is active and for 7 years after it closes, then deleted.
• An owner can schedule deletion sooner. Deletion waits 30 days so it can be cancelled. Packs already downloaded stay with the person who downloaded them.
• Support messages are kept so we can handle the request and keep a record of it.

Your rights

Under UK GDPR you can ask for a copy of your personal information, a correction, deletion, restriction, or transfer, and you can object to processing based on legitimate interests. You can withdraw marketing consent at any time in Settings.

Settings can download a copy of your account. Owners can also export the organisation. The download link works once and expires after 24 hours. Owners can schedule organisation deletion from Settings, which asks you to sign in again.

You can also write to GBK Solutions Ltd, 20 Bouverie Court, Leeds, LS9 8LB, or use the contact form and choose Privacy. Include the email address on the account. You can complain to the Information Commissioner’s Office. Our ICO registration number is CSN3569463. The ICO explains how to complain at ico.org.uk/make-a-complaint.

Where it is stored

The application, database, and file store run on DigitalOcean in London (LON1). Encrypted database backups are stored in Amsterdam (AMS3), in the European Economic Area. The UK recognises that region as adequate.

Email is sent by Postmark in the United States. Cloudflare provides DNS, a firewall, and the Turnstile check, and traffic can pass through its global network. Stripe processes card payments as its own controller, in the European Union and the United States. Error reports may be sent to Sentry. This page does not state a Sentry region.

Providers outside the United Kingdom publish their own international transfer terms. Those terms are the mechanism for that provider, for example the UK Addendum to the EU Standard Contractual Clauses where the provider offers it. A separate signed transfer schedule is not attached to this page.