Plain-English note. This policy was drafted in plain language and reviewed by the founder. It is not legal advice, and no lawyer has signed off on it for your situation. Where a capability is planned rather than built, this page says so instead of implying it exists.
Our role, and yours
There are two different kinds of data here, and the difference matters.
- Your workspace content — the strategies, initiatives, work items, documents and chat you put into Sortie HQ. You decide what goes in and why. In data-protection language you are the controller and we are a processor acting on your instructions. Our Data Processing Addendum covers this in detail.
- Account and billing data — who signed up, the organization, the plan, the invoices. We decide how to handle that in order to run a business, so for this we are the controller.
Sortie HQ is operated by its founder as a solo operation, reachable at runiondd@gmail.com. That address is also the privacy contact.
What we collect
| Category | What it includes |
|---|---|
| Account | Name, work email, the organization you belong to, your role, and whether the account is active. If you sign in with a password we store a bcrypt hash, never the password itself. If you sign in with Google we store the Google account identifier and the email and profile name Google returns — we do not get access to your Gmail, Drive or calendar. |
| Workspace content | Everything you create or upload: initiatives and strategies, work items and their acceptance criteria, estimates, dependencies, teams, knowledge-base documents you add for context, references to code repositories you connect, comments and chat messages. |
| Billing | Your Stripe customer and subscription identifiers, plan, status, credit balance and trial history, plus a card fingerprint from Stripe that we use only to enforce one trial per card. We never receive or store card numbers — those go straight from your browser to Stripe. |
| Model-call records | For every LLM call: the provider, model, purpose tag, token counts, latency, cost and whether it used your key or ours. These records hold metadata only — not the text of the prompt or the response. |
| Chat logs | When you use in-app chat, we store the text of your question, a summary of the answer, and what the system understood you to be asking about. This is what makes chat history and suggestions work. |
| Audit trail | Who changed what and when — item creation, edits, status changes, approvals, overrides and billing events, with before-and-after state. This is deliberately extensive; it is what lets you reconstruct how a plan got to where it is. |
| Site analytics | How the marketing site and the app get used: the page viewed, the site that linked you, browser, operating system, device type, screen size and country. This is measured by software we run on our own server — no cookie, no stored IP address, and nothing that identifies a person. Cookies, analytics and browser storage sets out exactly how. |
| Technical logs | Ordinary server logs: IP address, request path, timestamps, user agent and error traces. |
We do not buy data about you, and we do not run advertising or tracking pixels.
Why we process it
- To run the service you asked for — decomposing initiatives, storing plans, showing them to your team, sending notifications. Legal basis: performance of our contract with you.
- To bill you — subscriptions, credit accounting, invoices, and enforcing one trial per organization. Legal basis: contract, and our legitimate interest in not being defrauded.
- To keep the service working and secure — logs, error traces, rate limiting, abuse investigation. Legal basis: legitimate interests.
- To support you — answering your emails, which may mean looking at your workspace when you ask us to. Legal basis: contract.
- To meet legal obligations — tax and accounting records, and responding to lawful requests.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under California law, that means we have nothing to opt you out of.
We do not train models on your content and we do not use one customer's content to improve anything for another.
Your LLM provider and your content
This is the part of Sortie HQ that most affects where your strategic content ends up, so here it is directly.
Every organization starts on our managed AI. Sortie HQ sends your content to Anthropic using a key we provide, under our agreement with them, and Anthropic processes it as our sub-processor.
Any organization can instead connect its own model provider account — today Anthropic, OpenAI, or Azure OpenAI. When you do, Sortie HQ sends your content to that provider, using your key, under your agreement with them, and never routes it to a provider you did not configure.
Either way, your plans and the work items generated from them are stored in our database in the United States. Connecting your own key changes which account runs the model, not where your plans are stored.
Practically, that means:
- If you connect your own provider, it is a sub-processor you chose and contracted with. Their data-handling, retention and training terms — and any zero-retention arrangement you have negotiated — are the ones that apply to the model side.
- If you connect your own provider, we store your API key encrypted at rest (Fernet symmetric encryption) and decrypt it only to make the call.
- We log the metadata of each call — provider, model, tokens, latency, cost — so you can see what was spent. We do not log the prompt or the completion.
If your organization uses a key we provide instead of your own, then the model calls go to our provider, which is Anthropic, under our agreement with them. Your content leaves our systems for Anthropic's in that case. The app records which key was used for every call, so you can tell the two situations apart.
Sortie HQ classifies which work an AI coding agent could take on. It sends work to an agent only if you connect an agent runtime and switch on automatic dispatch — both are off by default. Whatever is sent to a runtime you connect is governed by your arrangement with that runtime.
Who else touches the data
These are the third parties involved in running Sortie HQ. We will update this list before adding a new one, and the DPA sets out the notice period and your right to object.
| Provider | What they do | Where |
|---|---|---|
| DigitalOcean | Hosting: the application servers, the managed Postgres database and the vector store that backs retrieval. Effectively all stored data sits here. | United States |
| Stripe | Payments, card storage, invoices, the customer portal and renewal emails. | United States |
| Your chosen LLM provider — Anthropic, OpenAI, or Microsoft (Azure OpenAI) | Runs the model calls on your content. Selected and contracted by you. | Per that provider |
| Anthropic | Runs the model calls on your content when your organization uses our managed AI — the default for every new organization. | United States |
| Only if you sign in with Google. We receive your account identifier, email and profile name. | United States | |
| Resend | Sends all email from the app: team invitations, password-reset links and password-changed notices, failed-payment notices to administrators, and scheduled reports with their attached PDF. It receives the recipient's address and the message. | United States |
| Sentry (Functional Software, Inc.) | Error monitoring. When something breaks, it receives an error report with account and organization identifiers, the request identifier, browser type and technical context. Passwords and the content fields we scrub are never sent. | United States |
| Cloudflare (Turnstile) | The human check on the sign-up page, once it is switched on. It receives the visitor's browser and network signals, including IP address, to tell people from bots. | Global |
| Slack | Only if you configure a Slack webhook for report delivery, to the workspace you point it at. | Per your Slack workspace |
There is no analytics company on this list, and that is not an omission — the analytics software runs on our own server, so no third party ever receives it. See cookies and analytics.
Beyond these, we disclose data only when the law requires it, and we will tell you unless we are forbidden from doing so. If the business is ever sold or transferred, data moves with it and you will be told before anything changes.
International transfers
Sortie HQ runs in the United States. If your organization or your people are in the UK, the EEA or Switzerland, using the service means your data is transferred to the US.
For those transfers we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies. Both are incorporated into our Data Processing Addendum, which we will sign on request. Your chosen model provider is a separate transfer that you control through your contract with them.
How long we keep it
| Data | Retention |
|---|---|
| Workspace content | For as long as your account is open. Deleting a work item marks it deleted and hides it everywhere in the product, but the record is kept so the audit trail stays intact. |
| Account data | For as long as your account is open, then 30 days after closure, then deleted. |
| Audit trail | For the life of the account. It is a compliance feature — we do not prune it. |
| Chat logs and model-call records | For the life of the account, so usage and spend stay reconstructable. |
| Billing records | Up to 7 years after the last transaction, because tax law requires it. |
| Server logs | Typically 30 days. |
| Backups | Deleted data persists in database backups until those backups age out. |
Ask us to delete your organization's data and we will, other than records we are legally required to keep. See the next section for how that request is handled today.
Your rights, and what works today
Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, get a portable copy, object to certain processing, or complain to a regulator. We honour these requests and we do not charge for them or treat you differently for making one.
There is no self-serve "export everything" or "delete my account" button in the product today. Data-subject requests are handled manually: email runiondd@gmail.com and we will verify who you are and respond within 30 days. Self-serve export and deletion are on the roadmap. We would rather say that than imply a button exists.
What you can do in the app today: export a plan or a report as PDF or PowerPoint, delete individual work items, strategies, knowledge-base entries, chat sessions and teams, and remove a member from the workspace.
If you are an employee of a Sortie HQ customer and you want your personal data handled, ask your own organization first — they control that workspace and we act on their instructions. If you ask us directly, we will forward the request to them.
In the EEA or UK you can complain to your national data-protection authority. We would rather you emailed us first.
Security, stated honestly
Here is what is actually in place:
- Encryption in transit. HTTPS everywhere, with certificates managed automatically.
- Credentials at rest. Passwords are bcrypt-hashed. LLM provider keys and agent credentials are encrypted with Fernet before they are stored, using a key held outside the database.
- Tenant isolation. Every query that returns customer data is scoped to the requesting organization, and that scope comes from the signed-in session rather than anything in the URL. It is a code-review rule, not a convention.
- Role-based access inside a workspace, and API keys that can be issued and revoked for machine access.
- An audit trail of state changes, including who made them and why.
- Managed database infrastructure from DigitalOcean, with their patching and backups.
- Minimal human access. Sortie HQ is a solo operation; one person can reach production, and does so only to operate or support the service.
Sortie HQ has no SOC 2 report, no ISO 27001 certificate, and makes no HIPAA claims. Do not put protected health information, payment card numbers or government ID numbers into it. If your security review needs one of those certifications, we are not there yet — tell us and we will be straight with you about timing rather than sell around it.
No system is perfectly secure. If you find a vulnerability, email runiondd@gmail.com and we will work with you. If a breach affects your data, we will notify you without undue delay and within 72 hours of becoming aware, with what we know at the time.
Children
Sortie HQ is a workplace tool for adults. It is not directed at anyone under 18 and we do not knowingly collect data from children. If we learn that we have, we will delete it.
Changes to this policy
When this policy changes, the "last updated" date at the top changes with it. If a change materially affects how we handle your data, we will email the administrator of each account at least 30 days before it takes effect.
Contact
Privacy questions, data requests, security reviews, or a DPA to sign: runiondd@gmail.com. A person reads it.