1. Overview

SortedAI, operated by Mustafa Demirsoy trading as SortedAI, is committed to protecting your privacy in accordance with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). This policy explains how we collect, use, store, and disclose your personal information.

2. Information We Collect

We collect the following types of personal information:

Account information: name, email address, phone number, password (encrypted)
Profile information: the suburb or location you save to your account
Location data: the suburb or address you provide so Tia can find nearby businesses
Payment information: processed securely by Stripe — we do not store card numbers
Communications: recordings and transcripts of the calls Tia makes on your behalf, used to confirm quote and booking details
Usage data: pages visited, features used, device and browser information

Calls made by our AI assistant. When we call a local business on your behalf, the call is placed by our AI voice assistant, Tia. Tia identifies herself as an AI at the start of every call and tells the person the call is recorded. Recordings and transcripts are used to confirm quote and booking details.

Business details from public listings (IPP 3A). To find businesses for Tia to call, we may collect business contact details (such as a business name and phone number) from publicly available listings. If you represent a business whose details we collected this way rather than from you directly, you can ask us what we hold, correct it, or have it removed at any time — email privacy@sortedai.co.nz.

3. How We Use Your Information

To have our AI assistant call local businesses on your behalf to get quotes and make bookings
To process any SortedAI booking fee
To send booking confirmations, status updates, and notifications (via email)
To improve our AI assistant and the way it understands your requests
To comply with legal obligations and resolve disputes

4. Data Storage & Security

Your data is stored securely using industry-standard encryption. Our database infrastructure uses Row-Level Security (RLS) policies ensuring users can only access their own data. All API communications are encrypted via HTTPS/TLS. We regularly audit our security practices.

If a privacy breach occurs that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act 2020.

5. Third-Party Services

We share limited data with the following trusted third-party services:

Supabase: Database and authentication (hosts your account and booking data)
Stripe: Payment processing — card data is entered directly with Stripe and never touches our servers (Stripe Privacy Policy)
Telnyx: Places the AI assistant's phone calls to businesses
Anthropic (Claude) & Serper: Power the AI assistant and its search for local businesses to call
Apify: Helps us find local businesses from publicly available listings
Resend: Sends email confirmations and notifications
Google Analytics (via Google Tag Manager) & Microsoft Clarity: Aggregate analytics to understand how the site is used

We have data-processing agreements with these providers and do not permit your personal information to be used to train third-party AI models.

6. Your Rights Under the NZ Privacy Act 2020

You have the right to:

Access your personal information held by us (IPP 6)
Correct any inaccurate information (IPP 7)
Request deletion of your account and associated data
Withdraw consent for marketing communications at any time
Complain to the Office of the Privacy Commissioner if you believe your privacy has been breached

7. Data Retention

We retain your personal information for as long as your account is active, plus 7 years after account closure for legal and tax compliance purposes. Call recordings are retained for 90 days for quality assurance, then automatically deleted. You may request early deletion at any time, subject to legal retention requirements.

8. Cookies & Analytics

We use essential cookies to maintain your session and preferences. We use Google Analytics (loaded via Google Tag Manager) and Microsoft Clarity to understand, in aggregate, how visitors use our site. We do not sell your personal information, and we do not use it for third-party advertising.

9. Children's Privacy

SortedAI is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children.

10. Cross-Border Disclosure

Some of our providers (Supabase, Stripe, Telnyx, Anthropic, Serper, Apify, Resend, Google, Microsoft) process data on servers outside New Zealand. Where this occurs, we ensure the recipient is subject to comparable privacy safeguards via their data-processing terms, in accordance with IPP 12 of the Privacy Act 2020.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email. The "Last updated" date at the top indicates the most recent revision.

12. Contact Us

For privacy enquiries or to exercise your rights:
Mustafa Demirsoy trading as SortedAI — Privacy Officer
Tauranga, New Zealand
Email: privacy@sortedai.co.nz

You may also contact the Office of the Privacy Commissioner if you have concerns about how we handle your information.