AI Sortify
Last updated: July 2, 2026
This Data Processing Agreement ("DPA") applies when AI Sortify processes personal data on behalf of a customer or workspace in connection with the AI Sortify service, including the desktop app, mobile app, website, and backend/API services. It forms part of the Terms of Service unless a separate written data processing agreement is signed.
Customer / Controller: the person, company, organization, or workspace administrator that determines the purposes and means of processing personal data uploaded to or connected with AI Sortify.
AI Sortify / Processor: AI Sortify, operated by Anas Boumediene, processes customer personal data only to provide and support the service, according to customer instructions, this DPA, the Terms, and applicable law.
The subject matter is the processing of personal data for AI-assisted document classification, extraction, renaming, splitting, folder generation, Google Drive workflows, desktop and mobile app interfaces, web/account services, backend/API services, workspace/team features, subscription enforcement, support, security, and related service operation.
Processing continues for the duration of the customer's use of AI Sortify and any additional period required for deletion, backup rotation, legal obligations, dispute resolution, or security purposes.
| Processing activity | Purpose |
|---|---|
| Collection, upload, retrieval, storage, and transmission | Receive documents, metadata, workspace records, and user instructions for requested workflows. |
| Extraction, classification, transformation, and AI analysis | Extract text or fields, classify documents, suggest filenames, route files, and generate workflow outputs. |
| Google Drive actions | Create folders, read selected metadata, move/rename selected files, and maintain Drive connection state. |
| Access control and workspace administration | Authenticate users, manage teams, enforce permissions, and protect workspaces. |
| Logging, diagnostics, and support | Operate, troubleshoot, secure, and improve reliability of the service. |
| Deletion, anonymization, backup, and export | Handle user/customer deletion, disconnection, export, portability, and backup lifecycle requests. |
Customer instructs AI Sortify to process personal data as needed to provide the service and as configured or initiated by users in the app. AI Sortify will not process customer personal data for unrelated purposes unless required by law. If AI Sortify believes an instruction violates applicable data protection law, it may suspend the instruction and inform the customer where legally permitted.
AI Sortify restricts access to personal data to persons and providers that need access to operate, secure, support, or maintain the service. Persons with access are required to maintain confidentiality by contract, professional duty, or equivalent obligation.
| Area | Measures |
|---|---|
| Transport and access | HTTPS/TLS transport, authenticated API access, session controls, and provider access controls. |
| Device/session storage | Secure on-device storage for authentication/session data where supported by the platform. |
| Authorization | Workspace/user access controls, scoped Google OAuth access, and role-based app flows where applicable. |
| Provider security | Use of established infrastructure providers with their own technical and organizational controls. |
| Operational security | Logging, diagnostics, abuse prevention, limited access, and incident response practices appropriate to the service. |
| Data lifecycle | Deletion/disconnection workflows, backup rotation, and retention limits based on operational and legal needs. |
Customer authorizes AI Sortify to use subprocessors needed to provide the service. Current subprocessors or provider categories include:
| Subprocessor | Purpose | Data categories |
|---|---|---|
| Supabase | Authentication, database, storage, backend functions. | Account, workspace, app, storage, and session data. |
| Google APIs / Google Drive / Google Sign-In | Sign-in and Drive workflows. | Google account, tokens, Drive metadata, selected files/folders. |
| Google Cloud / hosted backend services | Backend API, Drive OAuth exchange, workflow processing. | Account identifiers, request data, Drive connection data, workflow data. |
| Google Vertex AI / Gemini | AI classification, extraction, naming, routing, review suggestions, and assistant requests. | Selected documents or document images, extracted text, filenames, metadata, folder/workspace context, assistant messages, and user instructions needed for the requested AI task. |
| OpenAI | Voice transcription and voice assistant support when voice features are used. | Optional voice recordings, transcripts, assistant messages, and context needed for the requested voice feature. |
| Apple App Store / Apple Sign-In | Authentication and iOS purchase processing. | Apple identity data made available to the app, purchase data. |
| Google Play, if Android purchases are enabled | Android distribution and purchase processing. | Purchase and subscription data. |
| RevenueCat | Subscription entitlement and customer center. | App user/workspace ID, product IDs, subscription status, purchase events. |
| Expo / EAS and platform services | Builds, updates, app platform operation. | Technical app/build/update metadata. |
| Website hosting provider | Hosting the public website and legal pages. | Standard web access logs handled by the hosting provider. |
| Email/support provider | Support and legal communications. | Email addresses and support message content. |
AI Sortify may add or replace subprocessors where needed to operate the service. If required by applicable law or a separate customer agreement, AI Sortify will provide notice and an opportunity to object to material subprocessor changes.
Subprocessors may process personal data outside the customer's country. AI Sortify relies on appropriate safeguards where required, such as standard contractual clauses, adequacy decisions, data processing agreements, or other lawful transfer mechanisms.
AI Sortify will reasonably assist customers with data subject access, correction, deletion, restriction, portability, and objection requests to the extent technically possible and legally required. Customers remain responsible for determining whether and how to respond to requests relating to their own documents and workspace data.
Taking into account the nature of processing and information available to AI Sortify, AI Sortify will reasonably assist customers with security, breach notification, data protection impact assessment, and regulator consultation obligations where required by applicable data protection law.
If AI Sortify becomes aware of a personal data breach affecting customer personal data, it will notify affected customers without undue delay where legally required and provide information reasonably available to support customer notification obligations.
Upon account deletion, workspace deletion, Drive disconnection, or written request, AI Sortify will delete or return customer personal data where technically possible, unless retention is required for legal, security, backup, dispute, or legitimate operational reasons. Backup deletion may take additional time according to backup rotation schedules.
AI Sortify will make reasonably necessary information available to demonstrate compliance with this DPA, subject to confidentiality, security, and protection of other customers. Any audit must be reasonable in scope, frequency, timing, and method, and must not compromise service security or third-party confidentiality obligations.
If this DPA conflicts with the Terms of Service, this DPA controls only for processing of personal data on behalf of a customer. A signed written agreement controls over this posted DPA where it expressly says so.
Data processing questions: anexbm@gmail.com
Privacy Policy: https://aisortify.com/privacy