Privacy Policy

Last updated: March 4, 2026

A&B Solutions Inc. ("we", "us", "our") operates Sorto, a desktop file organization application. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

Account information: When you create an account, we collect your email address, a hashed password, and optionally your display name. Authentication is handled by Supabase.

Subscription & billing data: If you subscribe to a paid plan, payment is processed by Paddle.com (our Merchant of Record). We receive your subscription status, plan type, billing period, and Paddle customer identifier — but we do not receive or store your credit card details.

Team data: If you create or join a team, we store the team name, member email addresses, roles, and invitation records.

Usage & operational data: We track usage metrics including the number of files processed per month (with timestamps) for the purpose of enforcing plan limits. We also collect operational telemetry about processing batches — file counts, processing duration, error counts, and worker counts — to maintain service reliability. This telemetry does not include any document content.

Local data: Sorto stores the following data locally on your machine: your authentication session (encrypted), a 7-day log of renamed files (including file paths) for undo purposes, application settings, and local processing statistics. No client financial data, vendor data, or document content is stored locally beyond the duration of active processing.

No profiling: Sorto does not build profiles of your clients or vendors. Every document is processed fresh with no client data retained between sessions.

2. What We Do NOT Collect

3. How We Use Your Information

4. Third-Party Services

Sorto uses the following third-party services:

Data transfers: Your data is processed by third parties located in the United States (OpenAI, Supabase, GitHub) and the United Kingdom (Paddle). By using Sorto, you consent to this cross-border transfer of data. We require that our service providers maintain appropriate security measures to protect your information.

5. Data Retention

We retain different types of data for different periods:

Aggregate, anonymized usage statistics may be retained indefinitely.

6. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS), hashed passwords, secure authentication tokens, and row-level database access controls. Authentication sessions are encrypted on your device using your operating system's secure storage. However, no method of transmission or storage is 100% secure.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

8. Automated Decision-Making

Sorto uses OpenAI's API to automatically classify and extract information from your documents. This automated processing determines the suggested filename for each document. No automated decisions affect your legal rights or have significant legal effects. You retain full control — all suggestions can be reviewed and overridden before any file is renamed. To request human review of any result, contact support@sorto.ca.

9. Children's Privacy

Sorto is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. By creating an account, you confirm that you are at least 16 years of age.

10. Privacy Officer

Privacy Officer: Founder, A&B Solutions Inc.
Contact: support@sorto.ca
12 Pinewoods Drive, Stoney Creek, Ontario, Canada, L8J 2T5

For privacy inquiries, data requests, or complaints, contact the Privacy Officer above. We are committed to resolving privacy concerns promptly.

11. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada (priv.gc.ca) and affected individuals as required by PIPEDA. Quebec residents will also be notified to the Commission d'accès à l'information (cai.gouv.qc.ca) within 72 hours, in accordance with Quebec's Law 25.

12. Complaint Rights

You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or the Commission d'accès à l'information du Québec at cai.gouv.qc.ca if you believe your privacy rights have been violated.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the application.

14. Contact

For privacy-related questions, contact us at support@sorto.ca.