Privacy Policy

Last updated: 19 October 2026 · SortMyDocuments by AIMediaFlow

SortMyDocuments is a document-processing service operated by Serhii Baliasnyi, trading as AIMediaFlow. It extracts data from accounting documents and lets users review and publish the resulting records to SortMyBooks. This policy explains what information we collect, how we use it, and the choices and rights available to users.

About SortMyDocuments · Terms of Service

1. Who we are

AIMediaFlow is the controller for personal data submitted directly to this service. Contact: sergey070373@gmail.com.

2. Data we collect

• Account data: registration email address, password hash, selected SortMyBooks company identifiers and account preferences.
• Document data: invoices, receipts and bank statements, plus extracted fields such as supplier, references, dates, totals, VAT and line items.
• Integration credentials: encrypted SortMyBooks credentials and encrypted long-lived refresh tokens when a user connects Dropbox or Google Drive. Short-lived Google access tokens are generated when needed and are not stored at rest.
• Connected-account identity: limited account name, email or provider identifier needed to show which storage account is connected and to prevent a copy from being attributed to a different account.
• Operational data: timestamps, request and provider outcomes, usage counters, error classifications and security logs needed to operate and protect the service.
• Mobile app and device data: when you use the mobile app, we record the app name, version and build, the platform, and your phone's maker, model and operating-system version as the phone reports them, together with sign-in and last-activity times. We use this to protect accounts and to provide support. We do not collect IMEI or serial numbers, advertising IDs or location.

3. How we use data

• To extract structured accounting data and present it for review.
• To publish records to the SortMyBooks company selected by the user.
• To deduplicate uploads and, where enabled, check supplier identifiers using VIES and CRO data.
• To retain a local safety copy and create a verified private copy in the external storage provider selected for that company.
• To diagnose failures, prevent duplicate external copies, secure accounts and monitor service reliability and cost.

4. Google Drive data

Google Drive is optional and is connected only when a user clicks Connect Google Drive and grants consent. SortMyDocuments requests only https://www.googleapis.com/auth/drive.file. This permission lets the service create and manage files that it created for the user or that the user explicitly opened with the service; it does not grant general access to every file in the user's Drive.

When Google Drive is selected for a SortMyBooks company, the service creates or reuses folders identified for this application and stores documents under SortMyBooks / Company / Purchases or Sales. It reads an uploaded file back to verify its byte size and cryptographic hash and may inspect an application-created object to reconcile an interrupted or retried upload. It does not enumerate, read or modify unrelated Drive files and does not create public or shared Drive links.

Google account identity and Drive data are used only to provide and secure this user-facing storage feature. We do not sell Google user data, use it for advertising, or use Drive content to train AI models. Access is not transferred to third parties except as necessary to provide the requested service, maintain security, comply with law, or with the user's affirmative direction.

A user can disconnect Google Drive in Settings. The stored refresh token is removed and revocation is requested from Google. Existing files already created in the user's Drive remain under that user's control and can be deleted there.

5. Dropbox data

Dropbox is optional. The service requests the minimum permissions needed to write and verify documents in its private App Folder and to display the connected account identity. It does not enumerate or read files outside that App Folder and does not create public or shared Dropbox links.

A user can disconnect Dropbox in Settings. The stored token is removed; existing Dropbox files remain under the user's control.

6. Hosting and service providers

The principal application and database infrastructure is hosted in the AWS Europe (Ireland) region. We use service providers to operate email ingestion, document storage, monitoring and document extraction. Depending on the configured recognition route, document content may be processed by Google Cloud Vertex AI in European locations, Mistral AI in Europe, and other explicitly configured AI services subject to regional and security controls. SortMyBooks receives only records the user chooses to publish. Dropbox or Google Drive receives a document copy only when that provider is selected for the relevant company.

We do not sell personal data or share it for advertising.

7. Retention and deletion

Automatic post-Push deletion of local document files is not currently running. The archive-period value visible in Settings is saved for future use but does not start a deletion schedule. The Service does not currently provide a self-service account or document deletion feature or a routine deletion-request process. Local safety copies and associated records are retained without a fixed expiry, subject to any erasure required by applicable law. We will update this policy if a deletion feature or retention schedule becomes available.

Verified external copies remain in the user's Dropbox or Google Drive until the user deletes them there. Disconnecting a provider prevents future access but does not delete copies already owned by the user.

8. Security

Traffic uses HTTPS. Passwords are hashed. SortMyBooks credentials and storage-provider refresh tokens are encrypted at rest with versioned encryption keys. Provider access is scoped by user and SortMyBooks company. External-copy success is recorded only after the provider returns an object identifier and the returned content has been verified.

9. Legal basis and your rights

We process data to provide the service requested by the user, to protect the service and its users, to comply with legal obligations, and where applicable on the basis of consent. Where the GDPR applies, individuals have rights to request access, correction, export, restriction or erasure of their personal data, and may object to processing or withdraw consent where consent is the basis. Erasure rights are subject to legal conditions and retention obligations; the absence of a routine Service deletion feature does not remove statutory rights.

For questions about these rights, email sergey070373@gmail.com. EU users may also complain to their national data-protection supervisory authority.

10. Changes

We update this policy when the service or its integrations change. Material changes will be communicated through the service or by another appropriate channel.

11. Contact

Privacy questions or requests: sergey070373@gmail.com.