Privacy policy

The controller is ITex Services s.r.o., Company ID 08886164, VAT ID CZ08886164, registered office Knapovec 180, 56201 Ústí nad Orlicí, C 45260 vedená u Krajského soudu v Hradci Králové. For data protection matters, contact us at info@insortio.com.

This policy covers prospects, customers and visitors to the InSortio website. For the mail in the mailboxes you connect to InSortio, you are the controller and we are the processor — see Data processing.

Account: email, name, language and time zone, a password hash (we don't know the password itself), two-factor settings and sign-in records (time, device).

Billing: name, address, company and VAT numbers, the VAT number verification result, the country an order came from (based on the IP address, for tax rules), billing e-mail, orders, documents and payments. The card number never reaches us; the payment gateway holds it.

Connected mailboxes: mailbox address and login details (password encrypted); for messages the sender, subject, date and where the service filed them; learned senders and rules; addresses you write to from the mailbox (so mail from them stays in the inbox); the Setup Guide analysis result. We do not store full message bodies or attachments; the beginning of the text (at most 300 characters) only with the digest excerpt turned on.

AI features (only when you turn them on): short results — summaries, digest lines, a description of your writing style for drafts — and a usage record (token counts, no content).

Website visits: technical data and cookies. See Cookies for details and settings.

Communication with us: the content of emails and questions you send us.

AI features are optional and you turn them on yourself. With AI on, we pass the language model provider, Anthropic (Claude) or possibly OpenAI (GPT), only the necessary details about a message: for sorting, the sender and subject; for features working with text, also the beginning of the text without attachments, links and e-mail addresses. With your consent, the Setup Guide passes a summary of the mailbox without personal addresses and your wishes.

The providers act as processors under a data processing agreement and don't use our data to train their models.

Performance of a contract — to set up your account, sort mail, send the digest, issue documents and communicate with you about the service.

Our legitimate interest — to secure the service (sign-in records, abuse protection), answer questions and protect our legal claims.

Legal obligations — in particular keeping tax and accounting documents.

Your consent — for analytics and marketing cookies and for AI features. You can change your cookie consent at any time via Cookie settings, and turn off AI in Features; withdrawal doesn't affect earlier processing.

Signing in with Google is optional; we only use your account's email and name from it.

Always only as long as necessary:

message records (sender, subject, where it went, any text excerpt) for 30 days;

addresses of sent messages for the Waiting for reply feature for 60 days, mailbox activity records for 180 days, the Setup Guide analysis result for at most 90 days;

mailbox credentials, learned senders and settings until the mailbox is disconnected or the account is closed;

AI usage records for 13 months; daily folder summaries for 14 days;

account data for the duration of the contract; records of admin actions for 1 year;

tax documents, the details on them and evidence of the customer's country for the period set by law (10 years).

We don't pass data to third parties for their own purposes. It's processed for us by contractually bound processors:

Vercel — hosting of the website and portal; Supabase — database (data stored in the EU);

the mail sorting server, which we operate ourselves in the Czech Republic;

an email sending provider (digests, documents, notifications);

Anthropic and OpenAI — language models, only with AI features turned on (section 3);

GoPay (card payments) and the bank (account payments); the European Commission and national VIES administrators (checking an EU business VAT number); Google: sign-in with Google and web analytics only with your consent.

We disclose data to public authorities only where required by law.

Only what goes to language model providers (Anthropic and OpenAI, based in the USA) and possibly Google analytics is processed outside the EU — always only with your consent.

Transfers are based on standard contractual clauses approved by the European Commission, or the EU–US Data Privacy Framework.

You have the right to access, rectify and erase your data, restrict processing and data portability. Where we process data based on legitimate interest, you can object; we'll handle it without undue delay, within one month at the latest. Exercise your rights at info@insortio.com. How to close your account is described on Account deletion.

You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).