Data Processing Terms

How Sortr handles the ticket data it processes for your server.

Effective 2 November 2026 · Version 8

1. What these terms cover

These terms apply to the personal data Sortr processes for a Discord server: its ticket records, form answers and the names of attached files, transcripts, event log, uploaded images, the settings that name people, what the server sends to a Google Sheet or another app, its move from Ticket Tool, and the changes made with an API key it allowed. Our Privacy Policy describes all of it in sections 2.2 to 2.9, and how long each part is kept in section 4; those sections are the details of the processing for these terms (what, why, whose data, and for how long). The data is about the people in your server: members who open tickets or are added to them, or to another channel with /add; staff who handle them; anyone who writes in a ticket or adds someone with /add; and admins who change settings.

They do not cover the dashboard sign-in, sessions or email you send us. For those, we decide, and the Privacy Policy applies on its own.

2. Who is who

• "You" means whoever runs the server: the person or organization that adds Sortr to it or sets it up in the dashboard. If you do that for someone else, you confirm that you may agree to these terms for them.
• If you run a server for a client, for example as an agency: your client is the controller, you act as its processor, and Sortr acts as your sub-processor. You confirm that your client has allowed you to use Sortr for this, on terms that protect the data at least as well as these, and you pass on to your client what these terms give you, such as notice of a breach.
• "We" and "Sortr" mean Unlock Services LLC, which runs Sortr (see the Terms of Service, section 14).

3. Your instructions

• We process the data only to run Sortr in your server. Your instructions are the settings your server's owner and Administrators choose in the dashboard and in Discord, what a site holding your server's API key changes, and the fixed rules in our Privacy Policy, such as when data is deleted.
• We do not use the data for anything else. We do not sell it, use it for advertising, or use it to train AI.
• If we think an instruction breaks data-protection law, we tell you.
• If a law requires us to process the data in another way, we tell you first, unless that law forbids it.
• Do not use Sortr to collect the sensitive data that the Terms of Service forbid in forms (section 4). A ticket is free text, so members can still write anything; treat every ticket as possibly sensitive.

4. Confidentiality and security

• Only the people who run Sortr can reach the data, apart from our hosting provider, which can reach the machine as any host can (section 5). Each of the people who run Sortr is bound to keep it confidential.
• We keep at least the measures in section 6 of the Privacy Policy. We may change them, but never to a lower level of protection.

5. Companies we use

You agree that we use these companies (sub-processors) for your server's data:

Hostinger International Ltd.

Cyprus. The server Sortr runs on, in a data centre in Germany, and its weekly copies of that server, kept in Lithuania.

Zoho Corporation B.V. and the Zoho group

Our mailbox for team@sortr.xyz, on Zoho's EU service. Only for what reaches us by email, such as a member's request about a ticket.

Google LLC

United States. Only if your server turns on the Google Sheets export; the rows go to a sheet you own.

Resend, Inc.

United States company, sending from its EU region. No longer used since 13 October 2026; it keeps copies of replies sent before then for 30 days, until mid-November 2026.

Discord is the platform your server runs on, not a company we use: what Sortr posts into Discord is held by Discord under its own terms, under your server's control. A webhook address or a site with an API key that your server sets up is your own recipient, not ours.

Before we add or replace a company in this list, we publish the change on this page at least 14 days ahead. If you object, tell us at team@sortr.xyz; if we cannot resolve it, you may remove Sortr, and section 9 applies. Each of these companies is bound to protect the data at least as well as these terms, and we remain responsible to you for them.

6. Data outside the EU

Where a company in section 5, or Discord, handles the data outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on the EU standard contractual clauses, as section 5 of the Privacy Policy explains for each.

7. Your members' requests

• If someone asks us about their data in your server, for example for a copy or for deletion, we tell your server's owner and help you answer. We write to the owner in Discord, or by email if we have an address. We can export what we hold about a member or about your server, and delete it.
• Discord's developer terms require us to delete a person's data when they ask, unless the law requires keeping it. We tell your server's owner before we do, and give you 5 working days to tell us if the law requires you to keep it. If we cannot reach the owner, we still delete it after those 5 working days.

8. Breaches

• If a personal data breach affects your server's data, we tell you without undue delay after we become aware of it. We post a notice on our status page, sortr.xyz/status, and in Sortr's support server on Discord, and we write to your server's owner in Discord, or by email if we have an address. We say what happened, what data and roughly how many people are affected, and what we have done, and we add more as we learn it.
• Sortr cannot message every server's owner itself, so a message to your owner may not reach them. To hear about a breach quickly, check the status page or join the support server.
• We help you meet your own duties to tell the supervisory authority and the people affected. We also tell Discord, as its developer terms require.

9. When you remove Sortr

• Everything we hold for your server on sortr.xyz is deleted 30 days after Sortr is removed from it, or sooner if your server's owner or Administrators ask us. Before then, they can ask us for a copy of it at team@sortr.xyz.
• Copies Sortr already posted into Discord stay there, under your server's control.
• If Discord ends Sortr's access to its platform, Discord's developer terms require us to stop at once and delete the data we hold. We then cannot send you a copy first.
• Deleted data stays in our backups for up to 14 days (longer only for the newest complete backup while later ones fail, or in our off-site copy while it cannot be updated), and in the hosting provider's weekly copies of the whole server for up to about four weeks. Then it is gone.

10. Showing that we keep these terms

• We answer your reasonable written questions about how we handle your server's data, and keep a record of this processing, as GDPR Article 30 requires.
• If our answers are not enough, we allow an audit or inspection of our handling of your server's data: with 30 days' notice, at most once a year unless a supervisory authority requires more, at your cost, and by someone bound to keep what they see confidential.
• If you need a data protection impact assessment, or to consult the supervisory authority, we help with what we know.

11. Liability, changes and the rest

• Sections 9 and 10 of the Terms of Service (a free service, and liability) apply to these terms too, as far as the law allows.
• Where these terms and the rest of the Terms of Service disagree about personal data, these terms win.
• We change these terms as section 12 of the Terms of Service describes, with a note below of what changed, except that new companies in section 5 come with 14 days' notice.
• Questions: team@sortr.xyz.

What changed

• Version 8 (2 November 2026): the people added to other channels with /add, and who added them; where the hosting provider keeps its weekly copies.
• Version 7 (31 October 2026): how we tell you about a breach or a member's request, now that Sortr no longer sends a message to every server's owner; what happens if Discord ends Sortr's access.
• Version 6 (30 October 2026): the waitlist is gone.
• Version 5 (20 October 2026): how long backups can last when later ones fail.
• Version 4 (17 October 2026): the off-site backup copy described without its location.
• Version 3 (17 October 2026): we no longer use Resend.
• Version 2 (16 October 2026): the hosting provider's access, and how long the off-site backup copy can last, said more exactly.
• Version 1 (16 October 2026): first version.