Privacy
We handle four kinds of data on this site, and they are not interchangeable. Saying yes to one does not mean you have said yes to the others.
Data processors · Manage my data
A. Account data — export and delete
If you sign in, we store an account: email, optional profile fields (username, country, industry, company size, role, age range, devices, budget, skill, privacy preference), session cookies, and records tied to your account such as saved tools, reviews, reactions, tag votes, alerts, subscriptions, newsletter state, company profile, shortlists, API keys, white-label configs, and recommendation audit logs.
Export. A logged-in user can download a JSON file of those records from Account or from /account/export.
Delete. Closing your account removes your user record and related records, including the company profile. That is not the same as turning off aggregated sharing (section B), and it does not take back a named lead already sent to a vendor (section C).
One exception: B2B leads that are no longer in draft status (new) are unlinked from you (user_id set null) rather than erased, because those records were already disclosed to a vendor under the separate lead consent. Draft leads still marked new are deleted with the account.
B. Optional aggregated / anonymized sharing with vendors
This is the optional checkbox you see during sign-up and in account settings. We store your choice as consent_data_sharing. Creating an account does not turn it on. The exact wording currently shown next to the box is:
“I'm comfortable with anonymized/aggregated data about my usage being used to improve recommendations and shared in aggregate with tool vendors”
When this is on, we may use anonymized or aggregated usage tied to your account (for example recommendation quality and vendor-facing totals that do not name you) to improve the product and to share in aggregate with tool vendors. It is not permission to hand your name and email to a specific vendor.
You can turn this off at any time without deleting the account: Manage my data. That is the practical “withdraw consent / opt out of this sharing” control. It does not stop section D (anonymous catalog signals) and it does not unsend a section C lead.
C. Named B2B lead sharing with specific vendors
This is a materially larger disclosure than B. The For business form can send identifying contact details — company name, website, industry, size, department, budget range, purchase timeline, problem description, contact name, and contact email — directly to specific AI tool vendors that match what you described. Those vendors may then email or call you about products.
That only happens if you tick a separate checkbox. Signing in does not imply it. The aggregated-sharing checkbox in section B does not imply it. The exact wording currently shown is:
“I agree that Sort AI may share my company name, website, industry, size, department, budget range, purchase timeline, problem description, and my contact name and email with relevant AI tool vendors, and that those vendors may contact me about products that fit what I described. This is not the same as agreeing to anonymized or aggregated data use on my account.”
Once a lead leaves draft status (new) — for example it is marked as sent and vendor ids are stored — we treat it as already delivered. Deleting your Sort AI account will not pull that packet back from the vendor. We only unlink your user id from the lead record on our side.
If you submitted a lead in error and it is still new, deleting the account removes that draft from our database. If it has already been sent, contact the vendor as well as us — we cannot unsay what they already received.
D. Anonymized market signals from all visitors
This is lighter than B or C, but it is not secret. Search queries, selected filters, comparison pairs, and “this wasn’t in the catalog” feature requests are saved in records that do not store user id, session id, IP, or email. If those identifiers show up in a filter you used, we strip them before saving. We also remove email-like text and IP-style numbers from free-text requests.
We collect these records from logged-in and logged-out visitors alike only when analytics cookies are accepted (or the equivalent toggle on Your privacy choices). Until then we do not save search-signal or compare-pair records. That is market demand, not a named lead and not “sale” of your profile.
Guests who do not want even anonymous query text stored can reject analytics on the banner or on Your privacy choices. There is no per-account off switch tied to a user id because we never stored one on these records.
Data processors
GDPR Article 28 expects us to say who processes personal data for us and for what. The services below are the ones this site uses. Listing them here is not a claim that every addendum has been accepted in a vendor dashboard — those confirmations sit in the Cloudflare and Anthropic accounts we use, and this page cannot see whether they are ticked.
Cloudflare
The site runs as a Cloudflare Worker with D1, R2, KV, Queues, and (where configured) Browser Rendering and Vectorize. Cloudflare sees connection metadata (including the CF-IPCountry header we use only to guess a display currency) and stores the databases and files we write.
Cloudflare publishes a standard Customer Data Processing Addendum. Confirm it is accepted on the Cloudflare account that owns this Worker (Dashboard → account home → Data Processing Addendum). This site cannot see whether that box is ticked.
Anthropic
We send listing page text, review-summary prompts, and similar content to the Claude API (currently Haiku-class models) for moderation and reading listing pages. Find AI shortlist explanations are built from stored checklist facts (budget, OS, country, and so on), not a live model call. Other product surfaces may still use Claude when an operator runs ingest, reviews, or editorial jobs. A review or vendor submission can still include words you typed.
As of Anthropic’s Privacy Center article dated 16 March 2026, Anthropic’s DPA (with Standard Contractual Clauses) is incorporated into its Commercial Terms of Service for API products — accepting those commercial terms accepts the DPA. Confirm the current text in the Anthropic Console for the API key this site uses.
Resend (email)
Transactional mail (magic links, vendor claim notices) is sent through Resend’s API. Resend receives the recipient address, subject, and body we pass when sending that mail. No marketing blast provider is connected.
Resend’s processor terms / DPA are the contract for that send path. Confirm the current DPA on the Resend account that holds RESEND_API_KEY.
ExchangeRate-API (currency snapshot)
A scheduled job fetches USD rates from exchangerate-api.com (keyed) or open.er-api.com (keyless fallback) and stores the snapshot in KV. That request is server-to-server: it does not include a visitor cookie, IP, or account id. Display conversion uses the stored snapshot only — a visitor choosing NZD does not trigger a live lookup with their identity.
Because the currency request is a plain rate lookup without end-user personal data, this processor is listed for completeness. It is not a visitor-data subprocessor in the usual sense.
Cloudflare Turnstile (bot check) is Cloudflare again, not a fourth vendor. Affiliate networks, if a click uses an affiliate URL, are the vendor’s network — that hop is the visitor going to the tool, not us appointing them as our processor for a catalog of personal data.
Manage my data
Sign in to see and change the aggregated-sharing setting stored as consent_data_sharing. Export and account deletion stay on the account page after you sign in.
Listing information
Tool pricing, features, and capability claims on this site are as stated by the vendor’s own page, or by the vendor directly when they claim a listing. We do not independently audit or verify that information, and we are not liable for inaccuracies in vendor-stated claims.
Age
This site is not directed at children and is not intended for use by anyone under 16. We do not run age-verification. If you are under 16, do not create an account or send us personal details.
International transfers and complaints
Data is processed on Cloudflare’s global network. Transfers outside your country, if they occur, rely on Cloudflare’s published safeguards (including its customer DPA and standard contractual clauses where those apply). This is a factual description of the hosting platform, not a legal opinion about our entity.
You have the right to lodge a complaint with your local data protection supervisory authority if you believe processing of your personal data infringes applicable law.
Other notes
- Magic-link login stores a hashed token and your email until you sign in or it expires.
- We use a bot check (Turnstile) on some public forms.
- Affiliate click logs store tool id, country, referrer path, and time — not the destination URL.
- This page describes how we handle data today. It is not legal advice. Entity and counsel review is still outstanding before we treat B2B routing as production-scale.
Your privacy choices · Cookie preferences · Data processors · Manage my data · Terms · How we rank