SORTY PRIVACY POLICY

Last updated: July 13, 2026

Last updated: 13 July 2026

INTRODUCTION

AETRYX LTD ("we", "us", "our"), a private limited company registered in the United Kingdom under company number 17320081, with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, operates Sorty — an AI-powered browser extension and web dashboard for tab management, task tracking, and focus ("Sorty", the "Service"). We take your privacy seriously.

This policy explains how we collect, use, and protect your personal data when you use the Sorty Chrome extension, the app.sorty.dev dashboard, and our website at sorty.dev.

As the data controller, AETRYX LTD is responsible for your personal data under UK GDPR and the Data Protection Act 2018.

WHAT IS PERSONAL DATA?

Personal data is any information relating to an identified or identifiable individual.

WHAT DATA DO WE COLLECT?

We collect the following categories of data:

• Account data: your name, email address, and authentication data, via Supabase Auth (including Google or GitHub sign-in if you choose those options).

• Payment data: if you subscribe to Sorty Pro (or another paid plan), Stripe processes your payment details directly. We do not store your full card number on our servers — we retain only subscription status, plan tier, and billing history metadata provided to us by Stripe.

• Browser and tab data: with your permission, Sorty reads open tab titles, URLs, and page content to power tab sorting, AI chat, page summaries, and Tab Memory. This is processed to deliver the feature you triggered and, where you use AI features, is sent to our AI providers (see "AI processing" below).

• Content you create: tasks, notes, web clips, and project data you create inside Sorty are stored so the product can function and sync across your devices.

• Files you upload: documents, images, or other files you add to Sorty are stored via Supabase Storage.

• Usage and diagnostic data: feature usage, session length, error logs, and internal routing/decision logs used to keep the Service reliable, to enforce plan usage limits (e.g. daily AI message limits), and to improve how requests are classified and routed inside Sorty.

• Integrations you connect: if you connect Spotify or other third-party integrations, we store the minimum tokens/data required to operate that integration, per that provider's own terms.

We do not intentionally collect sensitive personal data (e.g. health, religious belief, biometric data) or data relating to children. Sorty is not directed at, and should not be used by, anyone under the age of 16.

HOW DO WE COLLECT YOUR DATA?

We collect data when you: create an account; install and use the Sorty extension; interact with the app.sorty.dev dashboard; contact us; or subscribe to a paid plan.

We may also receive data about you from third parties: if you sign in with Google or GitHub, we receive your basic profile information (name, email address, and avatar where provided) from that provider in accordance with your account permissions.

HOW AND WHY DO WE USE YOUR DATA?

We only use your data where we have a lawful basis to do so:

• To provide the Service — organising tabs, storing tasks/notes, running the AI chat, and syncing your data across devices. Legal basis: performance of our contract with you (our Terms of Use).

• To operate your subscription and process payments via Stripe. Legal basis: performance of a contract, and our legitimate interest in receiving payment for services rendered.

• To keep the Service secure and working properly, including enforcing Free/Pro plan usage limits and detecting abuse. Legal basis: our legitimate interests, balanced against your rights.

• To review operational and diagnostic logs (including how AI requests are classified and routed) so we can fix bugs, improve reliability, and refine Sorty's internal request-routing logic. We do not use this for advertising or for training foundation AI models. Legal basis: our legitimate interests in operating and improving the Service, balanced against your rights.

• To respond to support and privacy requests and to communicate essential service updates (e.g. changes to this policy, planned downtime). Legal basis: legitimate interests / performance of contract.

• To send you optional product updates or marketing, only if you have opted in. Legal basis: consent, which you may withdraw at any time.

AI PROCESSING

Certain Sorty features (AI chat, tab sorting, page summaries, focus-mode suggestions, and related helpers) send relevant content — such as tab titles, page text, or your chat messages — to our AI providers in order to generate a response or complete the action you requested.

Our current AI providers are:

• Anthropic, PBC (Claude API) — used for higher-capability and specialised Sorty AI tasks.

• Google LLC / Alphabet Inc. (Gemini API) — used for selected Sorty AI tasks as part of Sorty's model-routing stack.

We do not send this content for purposes other than fulfilling your request and operating the Service. We do not use your prompts or model outputs to train our own foundation models, and we do not opt your Sorty API traffic into provider programmes that use customer prompts for model training.

Under Anthropic's commercial API terms, Anthropic does not use API inputs or outputs to train its models by default. Anthropic's standard commercial API retention for inputs/outputs is limited (typically up to 7 days for abuse monitoring and operational purposes, unless a different contractual retention arrangement applies to our account).

Under Google's paid Gemini API / related paid-service terms, Google does not use prompts or responses to train its models. Google may retain limited logs for abuse detection, security, and service operation as described in Google's applicable terms and data-processing addenda.

AETRYX LTD may review Sorty-side operational logs (for example error traces and routing decisions such as which model tier handled a request) to debug incidents and improve Sorty's routing tree. That review is limited to product operation and improvement; it is not advertising use and not foundation-model training.

Each provider's processing is governed by our agreement with that provider and their published data-handling commitments for API / cloud customers.

DO WE SHARE YOUR PERSONAL DATA?

We share personal data only with service providers who need it to operate Sorty on our behalf, including:

• Supabase (database, authentication, and file storage) • Railway (application server hosting) • Anthropic (AI processing — Claude API) • Google / Alphabet (AI processing — Gemini API) • Stripe (payment processing) • Resend (transactional email, e.g. account, billing, and support notifications)

We require these providers to protect your data and to use it only on our instructions. We do not sell your personal data. We will share data with legal or regulatory bodies if required by law.

INTERNATIONAL TRANSFERS

Some of our service providers process data outside the United Kingdom, including in the European Economic Area and the United States. Where we transfer personal data outside the UK, we rely on one or more of the following safeguards, as applicable to each provider:

• the UK International Data Transfer Agreement / Addendum (IDTA) • the European Commission's Standard Contractual Clauses (SCCs) as adopted for UK transfers via the IDTA • and/or a provider's certified participation in an adequacy mechanism such as the EU-US / UK-US Data Privacy Framework, where that provider offers it

In practice, for Sorty's current stack this typically means:

• Supabase — transfers under Supabase's Data Processing Addendum and SCCs / UK IDTA terms • Railway — transfers under Railway's Data Processing Addendum and SCCs / equivalent contractual safeguards • Anthropic — transfers under Anthropic's commercial terms and data-processing commitments for API customers • Google (Gemini) — transfers under Google's Cloud / Gemini API terms and Cloud Data Processing Addendum (or the Gemini API terms applicable to paid services) • Stripe — transfers under Stripe's Data Processing Agreement and SCCs / DPF participation where applicable • Resend — transfers under Resend's Data Processing Addendum / SCCs (Sorty's Resend region for sorty.dev is eu-west-1)

We do not claim that Sorty keeps all personal data exclusively inside the UK.

BROWSER PERMISSIONS

The Sorty Chrome extension requests the following permissions, used only as described:

• tabs / activeTab — to read tab titles and URLs for sorting, grouping, and Tab Memory • storage — to save your preferences and cached data locally (chrome.storage.local) for performance and offline resilience • scripting / content script access — to read page content when you trigger a summary, clip, or AI action on that page

We do not read or process page content in the background without a triggered feature, and we do not sell browsing data to advertisers.

CHROME WEB STORE DISCLOSURES

In line with the Chrome Web Store User Data Policy:

• We do not sell user data to third parties • We do not use or transfer user data for purposes unrelated to Sorty's single purpose (tab, task, and focus management) • We do not use or transfer user data to determine creditworthiness or for lending purposes • We do not use browsing data for advertising

AUTOMATED DECISION-MAKING

We do not use your personal data to make solely automated decisions that have legal or similarly significant effects on you. AI features in Sorty produce suggestions and content at your request; they do not make binding decisions about you.

THIRD-PARTY LINKS

The Service may include links to third-party websites or content. We have no control over these and recommend reviewing their own privacy policies before providing any data to them.

IS YOUR DATA SECURE?

We take data security seriously. Measures in place include Row Level Security policies on our database (so users can only access their own data), encrypted connections (HTTPS/TLS), and restricted employee access on a need-to-know basis. See our internal Security Practices document for further detail.

HOW LONG DO WE KEEP YOUR DATA?

• Account, task, note, and project data: retained for as long as you maintain a Sorty account, or until you delete it

• Tab Memory history: retained per your plan's Tab Memory window (currently 7 days on Free; unlimited on paid plans — see current plan details on sorty.dev / app.sorty.dev)

• Chat history sent to AI features: retained only as long as needed to provide the feature and maintain your chat history within the product, unless you delete a conversation

• Billing records: retained for 6 years after your relationship with us ends, to meet UK tax and accounting obligations

You can delete your account and associated data at any time from Settings → Account → Delete Account in the app.sorty.dev dashboard.

YOUR LEGAL RIGHTS

Under UK GDPR, you have the right to:

• Request a copy of the personal data we hold about you • Ask us to correct inaccurate personal data • Ask us to delete your personal data in certain circumstances • Request that we restrict processing of your personal data • Request that we transfer your personal data to you or a third party • Withdraw consent where consent is our legal basis for processing • Object to processing for direct marketing purposes • Object to processing based on our legitimate interests

More information on these rights is available on the Information Commissioner's Office website: https://ico.org.uk/

HOW TO EXERCISE YOUR RIGHTS

To exercise any of these rights, contact us at privacy@sorty.dev. There is no fee to exercise your rights, though we may need to verify your identity first. We aim to respond within one month; complex requests may take longer, and we will tell you if that is the case.

CHANGES TO THIS POLICY

We review and update this policy periodically. Please check this page whenever you use Sorty, particularly before major feature releases.

Questions about this policy or your data rights: privacy@sorty.dev

AETRYX LTD Company number: 17320081 71-75 Shelton Street, Covent Garden London, United Kingdom, WC2H 9JQ

COMPLAINTS

We would appreciate the chance to resolve any concerns directly first — contact us at privacy@sorty.dev. You also have the right to complain to the Information Commissioner's Office at any time: https://ico.org.uk/make-a-complaint/