Privacy notice

What we collect and why

• Your account: name, email, password (stored only as a secure hash), and, if you give them, your company and role. If you sign in with Google or Microsoft we receive your name and email from them. Basis: our contract with you.
• Your plan and payments: which plan you're on and its status. Stripe handles your card; we never see or store card numbers. Basis: contract, and our legal duty to keep financial records.
• Saved buildings: the buildings in your watchlist. Basis: contract.
• Security: when you sign in we record your IP address and browser type with your session, and we briefly count requests by IP address to stop abuse. Basis: legitimate interests in keeping accounts secure.
• Checker searches: we log the type of search and how many results it found, not your IP address or what you typed. Basis: legitimate interests in improving the service.
• Enquiries and our conversations: what you send us, and our own notes of what we discuss and agree (who, when, any plan or price), so we can reply and follow up. Basis: legitimate interests.
• Support requests: your name, email address, what you ask and our replies, so we can help and keep track of the conversation. Basis: legitimate interests, or our contract with you if you have an account.
• Emails: we send account emails (confirming your email, password resets and changes, plan confirmations, renewal reminders, payment and price-change notices); emails for features on your plan (watchlist alerts and the Monday digest of new EPCs); and one getting-started tips email a few days after you sign up. You can switch off alerts, the digest and tips in Settings, or with the link at the foot of each one. Product updates and MEES news are sent only if you tick the box, and you can stop them the same way. Basis: contract for account and feature emails; legitimate interests for tips; consent for updates.

The Industrial EPC Weekly

If you sign up for our free Monday email, with or without an account, we keep your email address, when you ticked the box and its wording, where on the site you signed up, and when you confirmed. We email you a link to confirm first and send nothing else until you click it; if you don't, we delete the address after 7 days. Each issue also mentions what Sortd Industrial's plans offer. We don't track opens or clicks. Basis: your consent. Every issue has a one-click unsubscribe, and unsubscribing deletes your address.

If we email your business

We sometimes send a short introductory email to firms our service could help, such as commercial agents, surveyors, property investors, developers and contractors. We find the firms on the Companies House register (our software searches it and checks each firm's own website), or add ones we already know of. If the firm's name doesn't lead us to its website, we may use a web search (through Anthropic) to find it. We search for the firm, by its name, company number and registered office, never for a person, and we use a site only if a page on it shows the firm's company number, full company name or registered office postcode. We email only limited companies and LLPs, and only named people there: we use a person's own work address only when we know their name and the address matches it (such as jane.smith@), never a shared inbox such as info@ or sales@. The name comes from the Companies House register (current officers), from beside the address on the firm's own website, from Hunter.io, or from whoever gave us the address. The address must be one the firm publishes on its own website or elsewhere on the public web (we use Hunter.io to find these, which tells us the page), or that someone gave us, including a colleague's automatic reply that names you as the person to contact instead. Each email says where we got the address. Before our first email we may ask Hunter.io whether the address accepts mail; we send it only the address. We don't use LinkedIn or bought lists, and we don't track whether you open our emails or who clicks. Links to our site in these emails carry campaign tags that name the type of firm, which email it was and which version of our message, not you, so we can count visits from our emails in total and see which message works best. If you then create an account, it records that your first visit came from one of our emails, and we link the account to our CRM record of you (or, if we don't have one, of your firm, by your email address's domain) so we can see whether our emails led to sign-ups and purchases.

We keep the firm's name, company number and website; the person's name and role, and where the name came from; the address and where we got it; and the emails we send and any reply. We also keep a record of the firm and the person in our own customer records (our CRM): name, role, business address and where we found it, and a timeline of the emails we sent and any reply, and where the conversation stands, so we can follow up properly and don't start a second conversation with the same person by mistake. Our software writes the emails from our own sentences, with the firm's name and town, the person's first name and our own figures from the EPC register (including how many new EPCs were lodged in the area). An AI model (Anthropic) helps sort replies and reads the home page of the firm's website to check that the firm does commercial or industrial work; if we switch it on, it may also add one sentence to a first email based on a phrase from that home page. A person approves every email until we choose to let emails that pass all our checks go without a person reading them; some, such as a note after you've told us "not now", are always read by a person first. If you tell us "not now", we may write once more, about three months later. Basis: legitimate interests in telling businesses about a service relevant to their work. You can object at any time: reply "no" or use the link in the email, and we won't email you again. We then delete what we held about you, including your record in our CRM, except your address, where we got it and the dates we emailed you and you opted out, which we keep so we can keep that promise. If you also have an account with us, or we know you other than through these emails (for example, you got in touch with us yourself), we keep those records, marked so we never send you another introductory email, and delete our introductory emails and your replies to them.

Building data we show

The checker shows information from the government's Energy Performance of Buildings register, including addresses. The government treats address-level energy data as personal data. We show it to help owners, occupiers, investors and advisers understand the energy efficiency of buildings in the sale and rental markets. Basis: legitimate interests. Owners can withdraw a certificate from the register through the government's opt-out service, or ask us to stop showing it, and we will.

Who we share it with

We don't sell personal data. These providers process it for us, under contract:

• Vercel: website hosting and page-view analytics.
• Supabase: database.
• Stripe: payments (Stripe also carries out its own fraud checks).
• Resend: sending email.
• Google and Microsoft: only if you choose to sign in with them. Google also runs our own email (Google Workspace).
• Anthropic: finding a firm's own website by searching the web for the firm, checking that a firm fits from its website's home page, sorting the replies to introductory emails and, if we switch it on, one sentence in a first email (business details, that page and reply text only).
• Hunter.io: finding business email addresses published on the web, and checking that an address accepts mail before our first email to it (the address only).

Some of these providers process data outside the UK, including in the US. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge) or the ICO's international data transfer agreement.

How long we keep it

• Account data: while your account is open. When you delete it, it's removed within 30 days.
• Payment and billing records: 6 years, as UK tax law requires.
• Session records: until you sign out or the session expires (at most 30 days).
• Enquiries and our notes of conversations: 2 years after we were last in touch.
• Support requests: 2 years after the ticket is resolved.
• The Industrial EPC Weekly: until you unsubscribe; unconfirmed sign-ups, 7 days.
• Introductory emails to businesses, and the details we used (including our CRM record of you, unless you have an account or we know you other than through these emails): 2 years after we were last in touch. If you ask us not to contact you, we keep your address, where we got it and the dates on a do-not-contact list for as long as we send introductory emails, so we can keep that promise.

Cookies

We use only essential cookies, to keep you signed in. We don't use advertising or tracking cookies. Stripe sets its own cookies on its checkout pages to prevent fraud.

We use Vercel Web Analytics to see how the site is used. It counts page views and a few named events (an account created, an enquiry sent, a checker search and roughly how many results it found) without cookies and without storing personal data. Page addresses are sent without their query strings, apart from campaign tags.

We also count page views ourselves, without cookies: the page (with any building or account identifiers taken out), the site you came from, campaign tags and whether you're on a phone, tablet or computer. To count a visitor once a day without a cookie, we combine your IP address and browser type with a code that changes every day and keep only the scrambled result, so we can't identify you or recognise you on another day; the IP address itself isn't stored. We keep these counts for 25 months. If your browser sends Do Not Track or Global Privacy Control, we don't count your visits. Basis: legitimate interests in understanding how the site is used.

When you create an account, we record with it how your first visit reached us, if we know: the campaign tags on the link you followed (for example from one of our emails, posts or ads), the site you came from, and the first page you saw. Nothing is stored in your browser to do this: the page keeps it in memory while you look around in the same tab, and passes it on when you sign up. If your browser sends Do Not Track or Global Privacy Control, we don't record it. Basis: legitimate interests in knowing which of our marketing works.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or withdraw consent. You can delete your account yourself from Settings. Contact us at hello@sortd-app.com; we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change this notice in a way that affects you, we'll email you before the change applies.