Sorrl Privacy Policy
Last Updated: 8/13/2026
This Privacy Policy explains how Sorrl ("Sorrl," "we," "us," or "our") collects, uses, and protects information when you use our website and application located at sorrl.io and its subdomains (the "Service").
Sorrl is operated by Taite Hartman, doing business as "Sorrl," located at 1690 Swanson Ln, Upper Saint Clair, PA 15241 ("we," "us"). If you have questions about this policy, contact us at taite@sorrl.io.
This document is a draft prepared for review and has not been reviewed by an attorney. Do not treat this as legal advice or a final compliance document.
1. Information We Collect
Account Information
When you register for Sorrl, we collect your email address, a hashed password, and any profile information you provide (name, team/organization details).
Project and BOM Data
We collect the Bills of Materials (BOMs), part numbers, quantities, project structures, and sourcing preferences you upload or create within Sorrl, in order to provide pricing, sourcing, and cart-building functionality.
Connected Email Account Data
If you connect an email account (Gmail, Outlook, Yahoo, or iCloud) to Sorrl, we access that account to automatically detect order confirmation and shipping emails from supported electronics distributors. Specifically:
- How we connect: Depending on the provider, we connect either through the provider's official OAuth authorization (which grants Sorrl a limited, revocable token) or through an app-specific password you generate directly in your email provider's account settings. App-specific passwords, where used, grant Sorrl full access to your mailbox — this is a limitation of the app-password authentication method itself, not a Sorrl design choice, and we do not use this access beyond what is described below.
- What we access: We scan your inbox for emails from known electronics-distributor sending domains (e.g., digikey.com, mouser.com) related to orders you've placed through Sorrl. We do not read, store, or process emails unrelated to your Sorrl orders.
- What we extract: From matching emails, we extract order numbers, part numbers, tracking numbers, and shipping carrier information using automated processing, including AI-assisted extraction (see "Third-Party Service Providers" below). We retain the extracted structured data (order number, tracking number, etc.) as part of your order records. We do not retain full email content beyond what is operationally necessary to complete this extraction.
- Your control: You may disconnect any connected email account at any time from your account settings. Disconnecting revokes our stored access credential and stops future scanning. Disconnecting does not retroactively delete already-extracted order/tracking data tied to past orders.
Payment Information
If you subscribe to a paid plan, payment is processed by Stripe, Inc. Sorrl does not directly collect or store your full payment card details — Stripe handles this and shares with us only what is necessary for billing administration (e.g., subscription status, last four digits of your card, billing history).
Usage and Log Data
We may collect standard technical information such as IP address, browser type, device information, and usage patterns within the Service, for security, debugging, and service-improvement purposes.
2. How We Use Information
We use the information described above to:
- Provide BOM sourcing, pricing, and pre-filled distributor cart functionality
- Detect order confirmations and track shipments on your behalf
- Process subscription billing and manage your account tier
- Send transactional communications (order updates, tracking alerts, account notifications)
- Send risk-monitoring alerts for parts you've opted into monitoring (Pro feature)
- Maintain the security and integrity of the Service
- Comply with legal obligations
We do not sell your personal information. We do not use the content of your connected email accounts for advertising, and we do not permit human review of your email content except where necessary to investigate a support request you initiate or a security incident.
3. Third-Party Service Providers
We share limited information with the following categories of service providers, solely as necessary to operate the Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe | Subscription billing | Billing/account identifiers, subscription status |
| Anthropic (Claude) | AI-assisted extraction of order/tracking data from distributor emails | Relevant email content (subject, body) submitted for extraction |
| EasyPost | Shipment tracking | Tracking numbers, carrier information |
| DigiKey, Mouser, Arrow, LCSC, Newark, Avnet, Future Electronics | Part sourcing, pricing, and cart pre-fill | Part numbers and quantities (not personal information) |
| Nexar / Octopart (Pro tier only) | Extended sourcing and comparables | Part numbers and quantities (not personal information) |
| Resend | Transactional email delivery | Your email address, message content of Sorrl-originated emails |
| Google, Microsoft, Yahoo, Apple | Email account connection (order/shipment detection) | Authentication credentials you authorize; email content as described above |
We require these providers to handle data in a manner consistent with this policy and do not authorize them to use your data for their own independent purposes beyond providing services to us.
We may also disclose information if required by law, to protect the rights and safety of Sorrl or others, or in connection with a merger, acquisition, or sale of assets (with notice to affected users where required).
4. Data Security
We take reasonable technical and organizational measures to protect your information, including:
- Encryption of connected-account credentials at rest
- Encryption of data in transit (TLS)
- Access controls limiting internal access to production data
- Signature verification on inbound webhooks (e.g., shipment tracking updates)
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
5. Data Retention
We retain your account and project data for as long as your account remains active. Extracted order and tracking data is retained as part of your order history. If you delete your account, we will delete or anonymize your personal information within a reasonable period, except where retention is required for legal, tax, or dispute-resolution purposes.
6. Your Rights and Choices
Depending on your location, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To exercise these rights, contact us at taite@sorrl.io.
You can disconnect any connected email account, delete BOMs/projects, or close your account at any time from within the Service.
If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have additional rights under the GDPR. If you are a California resident, you may have additional rights under the CCPA/CPRA. [This section should be expanded with jurisdiction-specific detail as Sorrl's user base grows — flagged for legal review.]
7. Children's Privacy
Sorrl is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
8. International Data Transfers
Sorrl is based in the United States, and information we collect may be processed and stored in the United States or other countries where our service providers operate. By using the Service, you consent to this transfer.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy with a new "Last Updated" date. Material changes will be communicated via email or in-app notice where appropriate.
10. Contact Us
Questions about this Privacy Policy can be directed to:
Taite Hartman (Sorrl)
1690 Swanson Ln, Upper Saint Clair, PA 15241
taite@sorrl.io