Draft

Pending legal review. This is placeholder copy and has not been reviewed or approved by a lawyer — do not treat it as a final Privacy Policy.

Legal

Privacy Policy

This policy explains what data Sorti collects and how it's used. This is a draft outline of the sections a privacy policy normally covers — the language below has not been finalized or reviewed by a lawyer.

1. Data we collect

Account details (email), traveler profile fields you provide (travel style, dietary needs, home base, drinking/coffee style, notes), trip data (destinations, dates, highlights, itineraries), and usage data. [DRAFT — full data inventory pending.]

2. How we use your data

To generate itineraries, packing lists, and trip prep tasks; to personalize recommendations; to operate and improve the service; and to communicate with you about your account and trips (see the itinerary-email opt-out in your trip settings).

3. Data sharing & third parties

Sorti shares limited data with third-party providers as needed to deliver the service — for example, places/activities/events data providers, weather and travel-advisory sources, booking or ticketing partners, and infrastructure providers (hosting, database, email delivery). Sorti does not sell your personal data. [DRAFT — full sub-processor list pending.]

4. Data storage & security

Your data is stored with our database and authentication provider and protected in transit and at rest using industry-standard practices. [DRAFT — region-specific storage detail pending finalization.]

5. Cookies

Sorti uses cookies necessary for the service to function (for example, keeping you signed in). See the cookie notice shown on your first visit for details.

6. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data. You can export or delete your account data from your profile settings at any time. [DRAFT — full GDPR/CCPA rights language pending legal review.]

7. Data retention

Sorti retains your data for as long as your account is active, or as needed to provide the service. Deleting your account removes your personal data, subject to any legal retention obligations. [DRAFT — specific retention periods pending.]

8. Children’s privacy

Sorti is not directed at children and is not intended for use by anyone under the age of 16. [DRAFT — age threshold pending legal review.]

9. Changes to this policy

Sorti may update this policy from time to time. Material changes will be communicated before they take effect. [DRAFT — notice mechanism pending.]

10. Contact & data controller

Questions about this policy or requests regarding your data can be sent to the data controller below.

[CONTACT EMAIL NEEDED — see docs/qa-checklist.md]