SortedResearch

Privacy Policy

Last updated: 22 August 2026.

SortedResearch is operated by The Future Mill LLC ("SortedResearch", "we", "us", "our"), a US limited liability company. This Privacy Policy explains how we collect, use, share, and protect personal data when you use our card-sorting research platform at sortedresearch.com (the "Service").

We collect as little personal data as we can. Study participants are anonymous by default. The platform does not collect participant names or contact details unless a researcher deliberately adds a screener question that asks for them.

If you have any questions, contact us at privacy@sortedresearch.com.

1. Who this policy covers

The Service has two main types of user:

  • Researchers: people and organizations who create accounts to build and run card-sorting studies.
  • Participants: people who take part in a study by sorting cards into groups.

This policy applies to both, but the rights and protections differ depending on the role and on who controls the data (see Section 3).

2. The data we collect

Account data

  • Email address.
  • Optional display name.
  • Password (stored only as a secure hash via our authentication provider, Supabase Auth. We never see or store your plain-text password).

Billing data

  • Billing handled by Stripe. We do not store full payment card numbers. We may store limited billing metadata such as plan, billing status, and the last four digits / card brand surfaced by Stripe.

Usage and analytics data

  • How you use the Service (e.g. studies created, features used, device and browser type, log and diagnostic data).
  • With your consent, analytics and advertising measurement data collected via Google Analytics 4, Google Ads and Microsoft Advertising (e.g. pages viewed, referral source, and whether an advertisement led to a sign-up or purchase). These are switched off by default and are only collected if you accept analytics/advertising cookies in our cookie banner. See our Cookie Policy.

Demo workspace data

If you ask us for a link to our demo workspace, we collect the email address you give us and a record of your visit: when you asked, whether and when you used the link, how many times you came back, which screens inside the demo you opened, and roughly how long you spent on each. We use this to understand what prospective customers are interested in and to follow up with you about SortedResearch.

This is the one place where we link a named individual to the pages they viewed, so we say it plainly rather than folding it into general analytics. It applies only to our demo workspace, never to a customer's own account. Our lawful basis is legitimate interests (understanding and responding to interest in our product); you can ask us to delete it at any time at privacy@sortedresearch.com, and we will.

Support and AI assistant ("Graham") data

  • Conversations you have with our in-app AI assistant, Graham, and other support communications. Graham messages are sent to our AI provider (Anthropic) to generate responses.

Participant study data

When a participant takes part in a study, we process on the researcher's behalf:

  • Card placements and group names the participant creates.
  • Screener question answers (only the questions the researcher chose to ask).
  • Timing and quality metadata (e.g. completion time, basic quality signals).
  • Where a participant is sent from a recruitment panel (for example a survey sample marketplace), a panel-supplied transaction identifier. It is an opaque code, not a name or contact detail, and is used only to report the outcome of the participant's session (completed, screened out, quota full, or removed for quality) back to that panel so it can credit or replace the participant.

Participants are anonymous by default. We do not ask participants for names or contact details. If a researcher adds a screener question requesting identifying information, that is the researcher's decision and the researcher is responsible for it (see Section 3).

Cookies

  • A functional "one-response-per-device" cookie used to prevent duplicate submissions.
  • Authentication / session cookies for signed-in researchers.
  • Analytics cookies (Google Analytics 4) and advertising cookies (Google Ads and Microsoft Advertising), set only if you accept them in our cookie banner.

See our Cookie Policy for full details.

3. Data roles: controller vs processor

Privacy law separates the controller (who decides why and how data is processed) from the processor (who processes data on the controller's instructions).

  • SortedResearch is the controller for researcher account data, billing data, usage/analytics data, demo workspace data, and support/Graham chat data. This policy governs how we handle that data.
  • SortedResearch is a processor for participant study data collected through a researcher's studies. In that case, the researcher (or their organization) is the controller. We process that data on their instructions to provide the Service. The researcher's own privacy notice and lawful basis govern that data; our processing terms are set out in our Data Processing Agreement, available to paid customers on request.

If you are a participant and have questions about how your study data is used, please contact the researcher or organization that invited you. We will assist them in responding.

4. Why we process data and our lawful bases (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies and we act as controller, we rely on the following lawful bases:

Purpose Data Lawful basis
Create and operate your account Account data Contract (Art. 6(1)(b))
Process payments and prevent fraud Billing data Contract; Legitimate interests
Provide and improve the Service Usage/analytics data Legitimate interests
Understand and follow up on interest in the product Demo workspace data Legitimate interests
Provide support and run Graham Support/Graham data Contract; Legitimate interests
Send service/transactional emails Account data Contract; Legitimate interests
Comply with legal obligations As applicable Legal obligation (Art. 6(1)(c))
Non-essential cookies Cookie data Consent (Art. 6(1)(a))

For participant study data, the researcher (as controller) is responsible for establishing the lawful basis.

5. Sub-processors and sharing

We share data with vetted third-party service providers ("sub-processors") who help us run the Service:

Sub-processor Purpose Location
Supabase Database, authentication, hosting US
Vercel Application hosting US
Anthropic Powers the Graham AI assistant and AI features US
Stripe Payment processing US
Resend Transactional and support email US
Cloudflare Bot protection (Turnstile) and encrypted off-site backup storage (R2) US
PureSpectrum Optional panel recruitment marketplace; receives only session outcomes (completed, screened out, quota full, or removed for quality) referenced by its own opaque transaction identifier, never names or contact details US
Google Website analytics (Google Analytics 4) and advertising measurement (Google Ads), engaged only with your consent to non-essential cookies US
Microsoft Advertising measurement on Bing and the Microsoft Advertising network (UET tag), engaged only with your consent to non-essential cookies US

We may also disclose data where required by law, to enforce our terms, to protect rights and safety, or in connection with a corporate transaction (e.g. merger or acquisition). We do not sell personal data.

6. International data transfers

We are based in the United States, and our sub-processors process data in the US. Where we transfer personal data from the EEA, the UK, or Switzerland to the US or other countries, we rely on appropriate safeguards, including the Standard Contractual Clauses (SCCs) and, for UK data, the UK International Data Transfer Addendum.

7. Data retention

  • Account data: retained while your account is active and for up to 12 months after the account is closed, then deleted or anonymized.
  • Billing data: retained as required for tax, accounting, and legal purposes (typically up to 7 years).
  • Usage/analytics data: retained for up to 24 months.
  • Demo workspace data: retained for up to 12 months from your last visit, then deleted.
  • Graham/support data: retained for up to 24 months.
  • Participant study data: retained according to the researcher's instructions; deleted or returned on termination as set out in our Data Processing Agreement.

We delete or anonymize data when it is no longer needed for the purposes above or as required by law.

8. How we keep data secure

We use appropriate technical and organizational measures, including:

  • Encryption in transit (TLS) and encryption at rest.
  • Row-level security that scopes each customer's data so that one customer can only access their own data.
  • Access controls limiting internal access to data on a need-to-know basis.
  • Use of reputable infrastructure and sub-processors with their own security programs.

No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

9. Your rights

Depending on where you live, you may have rights to:

  • Access a copy of your personal data.
  • Export / portability of your data.
  • Correct inaccurate data.
  • Delete your data.
  • Object to or restrict certain processing.
  • Withdraw consent (where processing is based on consent).
  • Lodge a complaint with a supervisory authority (in the EEA/UK).

To exercise these rights as a researcher, contact privacy@sortedresearch.com. As a participant, please contact the researcher who invited you, since they are the controller of your study data; we will assist them. We will not discriminate against you for exercising your rights.

10. California privacy rights (CCPA / CPRA)

If you are a California resident, you have the right to know, access, correct, and delete personal information we hold, and to be free from discrimination for exercising these rights.

We do not sell your personal data for money. If you accept advertising cookies in our banner, we use Google Ads and Microsoft Advertising to measure our advertising, which may be considered "sharing" for cross-context behavioral advertising under the CPRA. This is off by default and never happens unless you opt in. You can opt out at any time by selecting Reject in our cookie banner (or by clearing this site's cookies to make the banner reappear); rejecting advertising cookies is our opt-out of sale/sharing mechanism. We do not knowingly sell or share the personal information of consumers we know to be under 16. To exercise your rights, contact privacy@sortedresearch.com.

11. Cookies

We use a small number of cookies, described in our Cookie Policy. For non-essential cookies in jurisdictions that require it, we obtain consent via a banner.

12. Children

The Service is not directed to children. Researchers must be 18 or older to hold an account. Researchers must not use the Service to collect personal data from children (under 16, or the applicable local age of digital consent) without obtaining proper, verifiable consent from a parent or guardian and meeting all applicable legal requirements as controller. We do not knowingly collect personal data from children. If you believe a child's data has been collected, contact privacy@sortedresearch.com.

13. Availability

The Service is available globally, except in jurisdictions subject to OFAC sanctions or comprehensive US embargoes, which are excluded.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where required, notify you of material changes.

15. Contact us