Privacy Policy

What this policy covers

This policy explains what Sortiq collects when you use the service at https://app.sortiq.com.au, why we collect it, and what we do with it. It applies to the Sortiq application and this website.

Information we collect

Account information you provide: your name, email address and billing details. Payment card details are handled by Stripe and are never stored on our systems.

Mailbox content you connect: the email messages, metadata and calendar entries in the Microsoft mailboxes you authorise, whether Microsoft 365 or a personal Microsoft account. Sortiq reads this in order to classify, prioritise, draft replies and screen for threats.

Usage and audit records: sign-in events, actions taken in the application, and the decisions Sortiq made about your mail, retained so that both you and we can understand what happened and when.

How we use it

To operate the service you have subscribed to: classification, prioritisation, reply drafting, workflow automation and threat screening.

To secure the service, including detecting malicious mail and investigating suspicious account activity.

To bill you, support you, and notify you about material changes to the service.

We do not sell your data, and we do not use the contents of your mailbox to advertise to you.

Third parties

Microsoft — your mailbox is accessed through Microsoft Graph under the consent you grant. Microsoft remains the system of record for your mail.

OpenAI — message content may be sent to OpenAI models to perform classification, summarisation and reply drafting.

Stripe — processes subscription payments and holds your payment details.

These providers process data on our behalf in order to deliver the features described on this site.

Where your data is held

The platform runs on infrastructure located in Sydney, Australia. Each tenant’s data is isolated at the database level by row-level security policies, not only by application logic.

Disclosure outside Australia

Although the platform is hosted in Sydney, some processing happens overseas. Message content sent to OpenAI for classification, summarisation and reply drafting is processed in the United States. Stripe processes payment information in the United States and other countries in which it operates.

We take reasonable steps to ensure these providers handle your information consistently with the Australian Privacy Principles, and we use them under terms that restrict them to processing data on our behalf. By using Sortiq you consent to this disclosure. If you would rather your mailbox content were not processed overseas, Sortiq is not currently able to offer that, and you should not connect a mailbox.

Data breaches

We are covered by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. If a breach of your personal information occurs and is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as soon as practicable after we become aware of it, and tell you what happened and what to do about it.

Retention and deletion

Message content — the text of your emails, and any reply Sortiq drafted from it — is kept for 90 days and then deleted automatically. What remains after that is the subject, sender, recipients, date, the classification Sortiq made and the audit record of it: enough to show that a message arrived and what happened to it, not enough to read it. Microsoft remains the system of record for your mail.

Everything else we hold is retained for as long as your account is active. When you cancel, your data is retained for 30 days so the account can be restored if cancellation was a mistake, and is then deleted. Audit records of actions taken in the application are kept for 12 months so that both you and we can reconstruct what happened.

You can revoke Sortiq’s access to your mailbox at any time from Microsoft Entra ID, which stops all further processing immediately.

Your rights

You may request a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Under the Australian Privacy Act you may also complain to the Office of the Australian Information Commissioner if you believe we have mishandled your information.

Contact us at support@peritusdigital.com.au for any of the above.

Changes

If this policy changes materially we will tell account holders by email rather than quietly updating this page.