Legal
Privacy notice
This notice explains what personal data we collect when you use Sorted Online, why we collect it, how long we keep it, and how to ask for a copy or erasure.
Who is responsible for your data
Sorted Online ("we", "us", "our") is the data controller for the personal data described here. To contact us about privacy, email hello@sortedonline.uk with "data protection" in the subject line.
The data we collect and why
Your sign-up details
When you sign up, you give us the details we need to build your website. We store:
- your business name and trading name, a short description of the business, and the tone you want;
- your name, phone number, and email address;
- your business address, including town or city, county, and postcode;
- any links or social profiles you add, and your opening hours; and
- the exact form you submitted, kept as you submitted it.
We use these details to write and publish your website and to provide the service you asked for. The lawful basis is the contract we have with you.
Your website and its content
The website we generate for you is built from your sign-up details and is stored on our platform. Your website is public, so the details you give us for the site, such as your business name, address, phone number, and email address, are visible to anyone who visits it, and may be indexed by search engines. Do not give us details you do not want published.
To write your website, we send the relevant business details to our artificial-intelligence provider, which is part of our hosting provider, Cloudflare Workers AI. It processes the details to produce the text, and does not use them to train its models.
Domains and email forwarding
If you register or connect a domain, we store the domain name, the registrar's order reference, the price, and the status. If you set up forwarding email, we store the forwarding address you choose and the address it forwards to. We do not store the contents of your email.
Payments
Our payment provider, GoCardless, collects your Direct Debit. We store a reference to your GoCardless customer, mandate, and payment, and the amount, date, and status of each payment. We never see or store your bank account details; GoCardless holds them. We keep payment records to collect the price and to meet our accounting and tax obligations.
Keeping the service safe
When you sign up, we check the request for signs of abuse. As part of that check we keep a one-way hash of your IP address for a few minutes, so we can limit repeated submissions without keeping the address itself. Our hosting provider also processes request data, such as IP addresses and browser details, to deliver pages and protect the service. The lawful basis is our legitimate interest in keeping the service secure and available.
Support
If you email us for help, we keep your message and our replies so we can answer you and keep a record of what we agreed. We may use automated tooling to sort and route the request, and the detail it produces is kept only for a short period.
Cookies and similar technologies
We use a small number of strictly necessary cookies, and no advertising or tracking cookies:
- a security token that protects the sign-up form from cross-site request forgery;
- a sign-up key that makes a resubmitted form update the same record instead of creating a second one;
- a start time, used to tell a real person from an automated submission; and
- a short-lived sign-up session that ties the Direct Debit step to your browser.
These cookies are needed for the service to work and for security, so they do not require consent. They expire within two hours, or within 24 hours for the sign-up session.
How long we keep your data
- Account and website data: for as long as your account is active, plus a short period afterwards while we shut the account down.
- Payment and transaction records: for six years after the end of the financial year they relate to, because the law requires us to keep accounting records.
- Abuse-prevention hash: a few minutes, then it is deleted automatically.
- Support emails: for 24 months after we resolve your request, then the message content is deleted or anonymised.
- Support tooling detail: the notes our automated tooling produces while handling a request are deleted after 30 days.
Who we share it with
We share personal data with the providers that run the service for us. They act on our instructions as processors:
- Cloudflare — hosting, site delivery, DNS, email forwarding, certificates, and the artificial-intelligence service that writes your website.
- GoCardless — UK Direct Debit collection.
- NetEarthOne / LogicBoxes — domain registration and management, where you register a domain through us.
We do not sell your personal data, and we do not share it for advertising. We may share it if the law requires it.
Where your data is held
Our providers run a global network, so your data may be processed outside the United Kingdom and the European Economic Area. Where that happens, the transfer is protected by the UK's international data transfer agreement or by standard contractual clauses. You can ask us for more detail using the contact address above.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data, where we do not have to keep it;
- ask us to restrict or stop certain processing;
- object to processing based on our legitimate interests; and
- receive the data you gave us in a portable format.
To make a request, email hello@sortedonline.uk with "data protection" in the subject line, from the email address on your account. We may ask for one more piece of information to confirm it is you. We answer within one month. There is no charge for the first request, and asking will never affect the service you get.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk.
Changes to this notice
We may update this notice as the service or the law changes. If a change is material, we will tell you before it takes effect. The date at the top of this page shows when it last changed.