Sorilo Privacy Policy
Last updated: 1 September 2026
1. Who controls your information
Sorilo is a trading name of Fergus Gregory Hughes, a sole trader established in England. For personal information processed through Sorilo, the data controller is Fergus Gregory Hughes trading as Sorilo.
Contact: support@soriloapp.com
Postal address: Old School House, Itchen Stoke, Winchester, SO24 0QU, United Kingdom
This policy explains how we use personal information when you visit soriloapp.com, create an account, use the Sorilo application or contact us.
2. Information we collect
Depending on how you use Sorilo, we may process:
- Account information: name, email address, authentication identifiers and account status.
- Profile information: occupation, business preferences, tax settings and onboarding answers.
- Freelance records: clients, contacts, projects, tasks, invoice information, expected and received income, expenses, categories and estimated tax set-asides.
- Files: receipts, invoice logos and other files you choose to upload.
- Communications: support requests, feedback and messages you send us.
- Technical, analytics and security information: IP address, requested page, referral source, approximate country derived from IP address, device/browser type derived from the User-Agent, timestamps, authentication and security events, and error logs.
- Subscription information: plan, Paddle customer/subscription identifiers, status, billing period and cancellation state. Paddle processes full payment-card details; Sorilo does not receive or store your full card number or security code.
- Website preferences: theme and similar settings stored using cookies or local storage.
You may enter information about clients or other people. In that situation, you are responsible for ensuring you have a lawful reason to do so and for giving them any privacy information required from you.
3. Why we use information and our legal bases
| Purpose | Typical information | UK GDPR legal basis |
|---|---|---|
| Create and operate your account and provide Sorilo | Account, profile, freelance records, files and subscription status | Performance of our contract with you |
| Process subscriptions and provide paid access | Account and subscription information | Performance of contract; legal obligation where applicable |
| Secure the Service, prevent fraud and enforce limits | Technical, authentication, subscription and hashed anti-abuse information | Legitimate interests in protecting Sorilo and its users; legal obligation where applicable |
| Respond to support and service messages | Account details and communications | Performance of contract and legitimate interests in customer support |
| Maintain, troubleshoot and improve Sorilo | Technical logs, error information and aggregated usage | Legitimate interests in operating and improving the Service |
| Understand basic website performance using server-side Project Analytics | Page request, referral, approximate country and device category | Legitimate interests in understanding use of the Service without setting analytics identifiers on users’ devices |
| Meet tax, accounting, legal and regulatory duties | Transaction, account and communication records | Legal obligation |
| Send optional product or marketing communications | Contact details and preferences | Consent, where required; you can unsubscribe at any time |
Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights override them. We do not use your financial records for third-party advertising.
4. When you must provide information
An email address and authentication information are needed to create and secure an account. Information you enter about your work and finances is generally optional, but Sorilo cannot provide the relevant feature without it. Payment and billing details are required by Paddle if you purchase a subscription.
5. Who receives information
We disclose information only where needed to operate Sorilo, complete a transaction, comply with law or protect rights. Providers may include:
- Lovable and underlying cloud infrastructure, used to build, host and operate the application.
- Supabase, where used for authentication, database and file storage services.
- Resend, used to deliver authentication and service emails.
- Cloudflare, used for domain, routing, security and performance services.
- Paddle, which acts as Merchant of Record for purchases and processes checkout, payments, tax, invoices, subscription administration and fraud prevention. Paddle also processes information under its own Privacy Notice.
- Professional advisers, insurers, regulators, courts, law enforcement or prospective business transferees where reasonably necessary and lawful.
We do not sell personal information.
6. Server-side Project Analytics
Lovable Project Analytics measures visitors, page views, visit duration, bounce rate, referral sources, viewed pages, approximate country and device category from server-side request logs. Sorilo does not load a client-side analytics script, set an analytics cookie, create a persistent analytics device identifier or use this information for advertising.
IP address, User-Agent and Referer information are received automatically when a browser requests a page. They are processed server-side to create approximate and aggregated statistics. Sorilo’s analytics dashboard does not use them to replay sessions or follow an identified person across other websites.
We use these statistics under our legitimate interests in understanding whether the Service is working, how people find it and which pages are useful, while choosing a less intrusive server-side approach. You may object to this processing by contacting support@soriloapp.com; we will consider your request in light of our lawful grounds and obligations.
7. International transfers
Some providers may process information outside the UK. Where UK data-protection law requires safeguards, we rely on mechanisms such as UK adequacy regulations, the UK International Data Transfer Agreement or approved contractual clauses, together with supplementary measures where appropriate. You may contact us for more information about relevant safeguards.
8. Retention
We retain account information while your account is active and for as long afterward as reasonably necessary for the purposes described above, including security, dispute resolution and legal obligations.
When you use Sorilo’s account-deletion feature, the application is designed to delete your authentication identity, owned database records and stored files after cancelling and confirming any active Paddle subscription. Limited information may remain where necessary:
- Paddle retains transaction, tax and invoice records under its own legal obligations and policies.
- Backups and security logs may persist temporarily until overwritten under normal retention cycles.
- A one-way hash derived from an email address may be retained to prevent repeated claims of single-use promotions. It is not used to contact you and is kept only while reasonably necessary for fraud and promotion-abuse prevention.
- We may retain records required for legal claims, regulatory compliance or protection against fraud.
Authentication-email rate-limit logs and unsuccessful promotional intents are retained only for as long as reasonably necessary for security and administration.
Server-side analytics and request logs are retained according to Lovable’s platform retention and our operational needs, then deleted or aggregated when no longer reasonably necessary. They are not used to create persistent advertising profiles.
9. Security
We use technical and organisational safeguards intended to protect information, including access controls, encryption in transit, server-side handling of sensitive credentials and restricted administrative access. No online service can guarantee absolute security. Keep your password secure and contact us promptly if you believe your account has been compromised.
10. Your rights
Subject to applicable law, you may have rights to:
- access a copy of your personal information;
- correct inaccurate or incomplete information;
- request deletion;
- restrict or object to certain processing;
- receive information you provided in a portable format;
- withdraw consent at any time, without affecting earlier lawful processing; and
- complain to a supervisory authority.
To exercise a right, email support@soriloapp.com. We may need to verify your identity. You can also delete your account through Sorilo’s settings, but contact us if you need assistance or a copy of information first.
In the UK, you may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.
11. Automated decisions
Sorilo does not make decisions about you that produce legal or similarly significant effects solely through automated processing. Automated estimates and categorisation, where provided, are organisational aids that you should review.
12. Children
Sorilo is intended for people aged 18 or over and is not directed to children. Contact us if you believe a child has provided personal information.
13. Cookies and similar technologies
See our Cookie Policy for information about authentication, security, preferences and payment technologies.
14. Changes
We may update this policy as Sorilo, our providers or legal requirements change. We will post the updated version and provide additional notice where a change materially affects your rights.