Privacy policy

Last updated 13 October 2026

Sorva is a trading name of Lendaly Pty Ltd. This policy explains what Sorva collects, why, where it’s kept and who it’s shared with. “We” means Lendaly Pty Ltd. If you have a question, email [email protected].

What we collect

  • Your account: your name, email address, password (stored only as a one-way hash) and, if you add it, your mobile number.
  • Your business: its name, country, business number (such as an ABN or VAT number), and the people you invite.
  • Your documents: the receipts and invoices you upload, forward, send by WhatsApp or let us find in a connected mailbox, and the details read from them (supplier, dates, amounts, tax, business numbers).
  • Connected mailboxes: if you connect Gmail, Outlook or another mailbox, we read it only to find receipts and invoices. We keep the emails that contain them, and nothing else. Access is read-only: we never send, change or delete your emails.
  • Connected services: if you connect accounting software or cloud storage (such as Xero, QuickBooks, MYOB, Google Drive or Dropbox), we keep the access they give us, encrypted, to send your documents there.
  • How you use Sorva: a record of important actions (such as edits, exports, downloads and sign-ins) for security, and anything you send us through the Feedback button.

We don’t sell your information, we don’t use it for advertising, and Sorva has no advertising or analytics trackers. The only cookies are the ones that keep you signed in.

Why we use it

  • To read, organise and export your documents, which is the service you signed up for.
  • To run your account: signing in, emails about your account, invites and support.
  • To keep Sorva secure and working, and to fix problems.

Where it’s kept

Your account, documents and their details are stored with DigitalOcean in Sydney, Australia. Files are private: links to them expire after a few minutes, and only people in your business who are allowed to see a document can open it.

Who we share it with

We use a few service providers to run Sorva. Some are overseas, mainly in the United States, so your information may be handled there. We choose providers that protect it to a standard similar to the Australian Privacy Principles, and we only give them what they need:

  • Anthropic (United States): its AI reads each document to find the supplier, dates and amounts. Anthropic doesn’t use what we send it to train its AI.
  • Postmark (United States): sends our emails, and receives the emails you forward to your Sorva address.
  • DigitalOcean (servers in Sydney): hosts Sorva and stores your data.
  • Meta (WhatsApp), only if you send documents by WhatsApp.
  • Google, Microsoft, Xero, Intuit (QuickBooks), MYOB and Dropbox, only if you connect them, and only to do what you asked (sign you in, find receipts, or send documents there).

Your accountant, team members and anyone else you invite can see your business’s documents, according to their role. We may also share information if the law requires it.

Google user data

If you connect Gmail or Google Drive, Sorva’s use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail access only to find your receipts and invoices, and Drive access only to save the files you export. We don’t use Google data for advertising, and we don’t use it to train AI models.

How long we keep it

  • Documents stay until you delete them. Archived documents are deleted for good after 90 days.
  • If you close your account, we delete your business’s documents, files and connections, unless someone else owns the business with you.
  • Backups are kept for a short time after that, then overwritten.

Keeping it safe

Everything is sent over encrypted connections. Passwords are hashed, and access to your mailboxes and connected services is encrypted. Inside Sorva, each business can only ever see its own data.

Your choices and rights

You can see and correct your details in Sorva, export your documents at any time, and close your account in Settings. You can also ask us for a copy of the information we hold about you, or to correct or delete it, by emailing [email protected]. We’ll reply within 30 days.

If you’re unhappy with how we’ve handled your information, tell us first and we’ll try to fix it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the United Kingdom, the Information Commissioner’s Office (ico.org.uk).

Changes

If we change this policy in a way that matters, we’ll tell you by email or in Sorva before the change takes effect.