Privacy Policy
Last updated: 2 November 2026
1. Who we are
The Sortaba platform (the sortaba.com website and the Sortaba web application) is operated by DIGENSA SRL, with its registered office at Str. Partenie Cosma 19, floor 1, apt. 7, Sibiu, Romania, registered with the Romanian Trade Register under no. J2025074184007, tax ID (CUI) 52596624 ("we", "us").
For any question about your personal data, please write to support@sortaba.com.
2. What this policy covers
This policy explains how we process personal data when you:
- visit the sortaba.com website;
- create and use an account in the Sortaba application;
- join our early-access list or newsletter;
- answer the optional questions after signing up;
- book a call with the founders;
- send us a message through the contact form or by email.
3. Our role: controller and processor
For account data, billing data, newsletter and early-access data, call booking data and browsing data, DIGENSA SRL acts as data controller.
For the data an agency enters into Sortaba about its own clients (for example clients' answers to the pre-proposal form, opportunity details and commercial proposals), the agency is the controller and DIGENSA SRL acts as processor, only on the agency's instructions and in accordance with the Terms and Conditions.
If you are a client of an agency that uses Sortaba, please contact the agency first to exercise your rights. If you contact us directly, we will help and forward your request to the agency.
4. What data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | name, email address, password (stored encrypted), team role | you |
| Agency data | name, country, currency, logo, services, prices, working process, commercial terms | you |
| Agency clients' data | company name, contact person, email, answers to the pre-proposal form (goals, budget, context) | the agency, or the agency's client directly through the form |
| Payment and billing data | billing details, payment history; card details are processed directly by Stripe and are not stored by us | you, via Stripe |
| Newsletter and early-access list data | name, email, company, type (agency / freelancer), website | you |
| Early-access answers | team size, number of proposals per month, tools you use today, your answer about the hardest part of your process, your interest in the private beta | you, optionally, after signing up |
| Call booking data | name, email, chosen time slot, notes we take during the call | you, when you book a call; us, during the call |
| Support messages | name, email, subject, message content, attached screenshots | you |
| Technical and usage data | IP address, browser and device type, pages visited, in-app actions, error logs | collected automatically, including through cookies |
5. Why we use the data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account, providing the service | performance of a contract (Art. 6(1)(b)) |
| Generating summaries, scope recommendations and proposals with AI | performance of a contract (Art. 6(1)(b)); for agency clients' data, the agency's instructions |
| Processing payments and issuing invoices | performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Answering messages and providing support | performance of a contract or legitimate interest (Art. 6(1)(b) or (f)) |
| Newsletter, early-access list and launch / testing announcements | consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link |
| Running the early-access list and choosing the 10 Founding Members for the private beta, based on your optional answers | consent (Art. 6(1)(a)), given when you send the answers; you can withdraw it at any time |
| Organising calls with the founders and using what we learn to improve the product | steps taken at your request (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Website usage statistics (Google Analytics) | consent, given through the cookie banner (Art. 6(1)(a)) |
| Security, abuse prevention, troubleshooting | legitimate interest (Art. 6(1)(f)) |
| Improving the service using aggregated data | legitimate interest (Art. 6(1)(f)) |
| Complying with tax, accounting and authority requirements | legal obligation (Art. 6(1)(c)) |
Founding Members are chosen by the founders, who read every answer. We do not use automated decision-making to select them.
6. Use of artificial intelligence
Sortaba uses the OpenAI API to interpret discovery answers, generate summaries and draft proposals. For this purpose, the relevant texts (for example the client's answers and the agency's configuration) are sent to OpenAI for processing. Under OpenAI's API data policy, this data is not used to train its models.
AI-generated results are proposals that the agency reviews and approves. Sortaba does not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). Prices in proposals come from the agency's configuration and are not set by AI.
Connecting your own AI assistant. If you connect an external AI assistant to your account through MCP or our API, that assistant can read your quotes, clients and discovery answers. The connection is read-only and you can revoke it at any time. Data read by the assistant is processed by its provider under that provider's own privacy policy. You decide whether to connect an assistant and which one.
7. Who we share data with
We do not sell personal data. We share it only with providers that help us run the service, under contract and with confidentiality and security obligations:
| Provider | Role | Processing location |
|---|---|---|
| Romarg SRL | hosting of the website and application | Romania |
| Supabase Inc. | application database, authentication and file storage | EU (Frankfurt) / USA |
| Google Ireland Limited (Google Analytics, Google Calendar) | usage statistics, call scheduling | EU / USA |
| OpenAI | AI processing | USA |
| Stripe Payments Europe Ltd. | payment processing | Ireland / USA |
| UAB "MailerLite" | newsletter and early-access emails | Lithuania (EU) |
We may also share data with our advisers (accountant, lawyer) under confidentiality obligations, and with public authorities where the law requires it.
8. Transfers outside the European Economic Area
Some providers (OpenAI, Google, Stripe) may process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission. You can request information about the safeguards applied at support@sortaba.com.
9. How long we keep data
| Data | Retention period |
|---|---|
| Account data and data entered in the application | while the account is active; deleted within 30 days of account deletion. Backups are overwritten within 90 days. |
| Invoices and accounting records | for the period required by Romanian tax and accounting law |
| Newsletter and early-access list data | until you unsubscribe |
| Early-access answers | until you unsubscribe or ask us to delete them, and no later than 12 months after the public launch |
| Call booking data and call notes | 24 months from the call |
| Support messages | 24 months from the last correspondence |
| Technical data and logs | up to 12 months |
| Google Analytics data | according to the account retention settings, up to 14 months |
10. Security
We use encrypted connections (HTTPS), encrypted password storage, role-based access to data and providers that apply recognised security standards. Each agency's data is kept separate from other agencies' data. The Sortaba team does not access an agency's data unless the agency asks for it (for example for support) or the law requires it.
11. Your rights
Under Regulation (EU) 2016/679 (GDPR), you have the following rights:
- the right of access to your data;
- the right to rectification of inaccurate data;
- the right to erasure;
- the right to restriction of processing;
- the right to data portability;
- the right to object to processing based on legitimate interest;
- the right to withdraw consent at any time, without affecting the lawfulness of earlier processing;
- the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro, or with the supervisory authority in your country of residence.
To exercise your rights, write to support@sortaba.com. We reply within 30 days at the latest. You can also delete your account directly from the application settings.
12. Children
Sortaba is intended for professionals and businesses. We do not knowingly collect data from persons under 18.
13. Changes
We may update this policy. The date of the last update is shown at the top of the document. We will notify you of significant changes by email or in the application.
14. Contact
DIGENSA SRL, Str. Partenie Cosma 19, floor 1, apt. 7, Sibiu, Romania
Email: support@sortaba.com
Questions about the early-access programme: founders@sortaba.com