Privacy Policy

1. Introduction

SOSUITE LLC (“Sorcrr,” “we,” “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share information when you use sorcrr.com, app.sorcrr.com, market.sorcrr.com, our mobile applications, and related services (collectively, the “Platform”).

By using the Platform, you consent to the practices described in this policy. If you do not agree, please do not use our services.

2. Information We Collect

Information You Provide

• Account data: Name, email address, phone number, password, profile photo
• Profile information: Work experience, skills, education, bio, video introductions
• Company data: Company name, address, industry, logo, team members (for employer accounts)
• Service listings: Offering details, pricing, availability, bounty settings (for Market providers)
• Job postings: Job descriptions, salary ranges, requirements, bounty amounts (for employers)
• Communications: Messages, chat content, support tickets, feedback
• Video content: Profile videos and application videos you choose to upload
• Payment information: Processed by Stripe—we do not store credit card numbers (see Section 8)
• Promotional-credit eligibility: Grant status, grant date, and a minimal pseudonymous token derived from a verified identity signal, used to prevent duplicate signup or promotional-credit grants. This eligibility record does not contain a raw phone number.

Information Collected Automatically

• Usage data: Pages visited, features used, clicks, time spent, search queries
• Device information: IP address, browser type, operating system, device identifiers
• Location data: Approximate location based on IP address, city/region or radius-based location shown in product filters, and precise GPS/home-address signals only when you choose to use verification or location features that require them
• Referral data: Share chain interactions, referral link clicks, conversion events

Information from Third Parties

• OAuth providers: Name, email, and profile photo from Google or Apple when you sign in
• Stripe: Payout status and account verification status (not payment card details)
• Calendar providers: Availability time slots from Google Calendar or Apple Calendar (see Section 5)
• YouTube: Public channel information and statistics for YouTube channel links you add, read through YouTube API Services (see Section 6)
• Connected social platforms: If you connect an Instagram, TikTok, or X account in Linked accounts, account and audience statistics we read from that platform with your permission (see Section 6)

3. How We Use Your Information

Purpose	Data Used
Provide and operate the Platform	Account data, profile, listings, bookings
Match candidates with jobs	Profile, skills, experience, AI matching scores
Match buyers with providers	Search queries, location, preferences, availability
Process payments and bounties	Transaction data, Stripe account status
Track and distribute referral bounties	Share chain data, referral links, conversion events
Power AI features (SAI, matching, analysis)	Profile data, job data, interaction history
Send notifications and communications	Email, phone, push notification tokens
Prevent fraud and enforce Terms	Usage patterns, device info, IP address
Improve the Platform	Aggregated usage analytics, feedback

4. Contact Import & Address Book

With your explicit, opt-in permission, Sorcrr may access your device’s address book to help you discover people you know on the Platform.

• You can revoke address book access at any time through your device settings
• We do not message or contact people from your address book without their independent consent
• The “Invite Friends” feature sends invitations only when you explicitly choose to invite specific contacts
• You can request deletion of imported-contact data through the app where available or by contacting privacy@sorcrr.com

5. Calendar Integration

Sorcrr Market allows providers to connect Google Calendar or Apple Calendar for availability management.

• Calendar access is authorized via OAuth 2.0—you grant and revoke access through Google or Apple directly
• We read event times only to determine busy/free slots—we do not access event titles, descriptions, attendees, or other details
• We create calendar events for confirmed bookings with only the information necessary (time, service name, booking reference)
• Calendar data is not shared with other users, third parties, or used for advertising
• You can disconnect your calendar at any time from Commerce > Calendar Settings
• In Sorcrr Hiring, interviewers can connect Google Calendar to schedule interviews: we read free/busy times to suggest open interview slots, keep the connected calendar’s ID, and create, update, or cancel the interview’s calendar event and its invitations
• Sorcrr’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements

6. Social Platform Connections

You can add links to your accounts on other platforms, such as YouTube, Instagram, TikTok, X, or LinkedIn, or to a website, in the Links section of your profile, and people who manage a company page can add them there. For YouTube, Sorcrr reads public channel statistics with its own API key. For Instagram, TikTok, and X, you can choose to connect your account so Sorcrr can verify that the account is yours and read its audience statistics. Sorcrr only reads from these platforms. It never posts, comments, messages, or changes anything on your accounts.

Links you add

• For every link, we store the address you enter, its label, the platform, and the account handle or channel ID contained in the address

YouTube channel links (no sign-in)

• Sorcrr reads the channel’s public information through the YouTube Data API using Sorcrr’s own API key: the channel ID, channel name and handle, and its subscriber count (unless the channel hides it), total view count, and video count. This does not ask you to sign in to YouTube or Google and does not access your Google account, your private YouTube data, or YouTube Analytics.

Connecting Instagram, TikTok, or X (with your permission)

• When you connect an account, you sign in on that platform and approve read-only access. We request only:
  • Instagram (professional accounts): basic account information and insights (instagram_business_basic, instagram_business_manage_insights);
  • TikTok: basic profile information, profile statistics, and your list of videos (user.info.basic, user.info.profile, user.info.stats, video.list);
  • X: your account and posts, and continued access until you disconnect (users.read, tweet.read, offline.access).
• We read and store your account ID and username, and your follower, following, post, and like counts. We also read and store whether the platform marks the account as verified and, for TikTok, average views and engagement across your most recent videos. For an Instagram account with at least 100 followers, we also read aggregated follower demographics (age range, gender, and country). These are totals the platform provides; they do not identify any individual follower.
• When the connected account matches a link on your profile, we mark that link as verified and show its follower count with it. Follower demographics are shown only to you. They are not shown on your public profile, on offerings, to other users, or to AI features.
• Access tokens are encrypted and used only to read the data described here.

Sponsored posts (Sorcrr Market)

• When a creator registers a sponsored post for a Market sponsorship booking, Sorcrr reads that post’s public metrics once a day during the measurement window agreed at checkout: views, likes, and comments, and for YouTube whether the post is marked as a paid promotion. YouTube posts are read with Sorcrr’s API key; Instagram, TikTok, and X posts are read through the creator’s connected account. We use these figures to confirm the post went live, to measure it, and for CPM sponsorships to settle the amount charged (see the Terms of Service, Section 4). They are visible only to the brand and the creator on that booking.

How we use these data

• We use them to show and verify your links, to show your audience on your creator rate card and Market offerings, and to measure and settle sponsorships. Your handle, platform, follower count, and verified status, together with your rate card, may also be used by Sorcrr features that work for you: Market search, SAI, and automated replies from your own Customer Desk. Follower demographics are never used for these. We do not sell these data, use them for advertising, or share them with third parties other than the service providers that operate the Platform (see Section 10).

How often we refresh and how long we keep data

• We read figures when you save or connect a link and refresh them about once a day. We store the latest figures with the link and keep one record of them per day for up to 30 days; older daily records are deleted automatically.
• If a refresh fails, the last figures we read stay with the link until a later refresh succeeds, you remove or disconnect it, or 30 days pass, after which they are cleared.
• Sponsored-post figures are kept with the booking for settlement and disputes, as follows:
  • YouTube: each daily figure is deleted 30 days after we read it. The view count used to settle a CPM sponsorship is deleted 30 days after settlement.
  • X: figures are deleted 30 days after the measurement window ends, or immediately if the post is deleted or made private on X.
  • Instagram and TikTok: figures stay with the booking as settlement and dispute evidence until you ask us to delete them or delete your account.
  • In every case, the amounts charged, refunded, and paid out are kept with the booking’s financial records (see Section 12).

Disconnecting, removing, and deleting

• You can disconnect a platform at any time in Settings > Linked accounts. Disconnecting deletes the access tokens immediately, asks TikTok and X to revoke Sorcrr’s access, and deletes the statistics and daily records we read through that connection. Instagram does not offer revocation from our side; you can also remove Sorcrr under Apps and websites in your Instagram settings.
• Removing a link immediately deletes it together with every figure we stored for it.
• You can ask us to delete these data by emailing privacy@sorcrr.com. We will delete them within 7 days of your request.
• Deleting your Sorcrr account deletes your links, your platform connections and their tokens, and every figure we stored for them, including sponsored-post figures. The financial records of your sponsorship bookings are kept as Section 12 describes.

Platform terms

• YouTube is a Google service. Google’s handling of data is described in the Google Privacy Policy, and your use of YouTube is governed by the YouTube Terms of Service. You can review the apps that have access to your Google account on the Google security settings page.
• Instagram is provided by Meta, TikTok by TikTok, and X by X Corp. Their own privacy policies and terms apply to your use of their platforms.
• Sorcrr does not use Google or YouTube sign-in for these features.

7. Decision-Support & AI Data Processing

Sorcrr provides two different kinds of assistive technology: deterministic decision-support tools, including Career Rank Score (“CRS”) and Open Algorithm, and the SAI artificial-intelligence assistant. The distinction matters because deterministic tools follow published rules, while model-assisted features may generate or interpret content probabilistically.

Career Rank Score (CRS)

CRS is one canonical, viewer-independent score calculated by Sorcrr’s backend using a deterministic, versioned formula; the active formula version is published on How CRS Works. The score is additive and has no upper limit: a profile foundation from dated work experience, completed education, and skills or certificates, plus the raw sum of the four 0–5 review dimensions (Rating, Integrity, Intelligence, and Energy) of every eligible submitted review. Missing components contribute zero and are not renormalized. CRS applies no multiplier for reviewer relationship, reviewer score, verification, recency, account tier, employer, or institution. Private and anonymous complete reviews count, and a review hidden from display still counts as evidence. CRS does not use age, account age, salary, referral counts, or employer or institution prestige. Viewers may apply named ranking lenses that choose an evidence mode, weights, guardrails, or reviewer-relationship exclusions; a lens never changes the canonical score. Market ratings use their native 0–5 scale and are separate from CRS.

To calculate, explain, and audit CRS, Sorcrr may process and retain:

• Eligible review dimensions, review status and display visibility, review source, verification level, and the reviewer’s stated relationship, without converting the absence of a review into a negative rating
• Dated work, completed education (including degree level and normalized GPA when a supported grading scale is usable), skills, certificates, and verification status associated with those records
• The current score, component breakdown, formula version, confidence, verification coverage, availability or freshness state, calculation timestamps, and historical score snapshots
• Authorized ranking-policy versions and result receipts needed to show which filters, thresholds, weights, and sort metric a viewer applied

A review requested for a Market booking that was paid when the review was requested is recorded as verified evidence. Verification coverage is shown separately and is not a hidden multiplier. Current and historical CRS records are retained while an account is active to support reproducibility, correction, disputes, safety, and audit. They are removed or anonymized under Section 12 when the underlying account or data is deleted, unless a narrower record must be retained for legal, fraud, security, or dispute purposes.

Open Algorithm / Viewer-Owned Ranking

Open Algorithm (also described as “build your own algorithm”) is a deterministic filter and sorting policy. It can use authorized evidence scope, CRS or confidence thresholds, verification coverage, verified work years, explicit component or dimension weights, and derived metrics such as score per verified year. It does not rewrite a person’s canonical CRS. Sorcrr returns the original score beside any derived value, policy version, confidence, and explanation.

Ranking policies may be stored for a personal, company, or job scope. Access controls determine who can create, view, or change each policy. Sorcrr prohibits using protected characteristics as filters or weights and does not provide a Platform function that automatically rejects or selects a person solely from CRS or a ranking lens. Learn more at How CRS Works.

SAI: A Permissioned AI Assistant

SAI is clearly presented as an AI assistant. It routes a request through the current user’s authorized context and the narrowest suitable tool. Some routes are deterministic and do not invoke a generative model. Other routes use a model for drafting, summarization, retrieval assistance, or interpretation and may consume AI credits.

Depending on the feature you invoke and your permissions, SAI may process:

• Message text, timestamps, sender metadata, and attachments in conversations you participate in
• Internal briefs or Internal Remarks that your hiring role is authorized to access; employer-only intelligence is not disclosed to candidates
• Profile, job, application, company, provider, offering, booking, customer, or finance-support context relevant to the request
• For Market creators, SAI, Market search, and your Customer Desk’s automated replies may use your rate card and your public audience details (platform, handle, follower count, verified status). They do not use follower demographics.
• Files you select and approved personal, team, company, or customer-facing knowledge sources
• When enabled for the applicable workflow, user-scoped preferences, conversation continuity, diary or timeline summaries, compacted memory, and derived retrieval indexes or graph relationships used to find relevant authorized context
• When separately enabled, real-time interview transcripts and interviewer-only assistive output. Interview AI is not assumed to be active in every interview. When it is active, the candidate sees a short notice on joining. Sorcrr does not retain an interview audio or video recording through this feature.

SAI can produce drafts, summaries, explanations, navigation help, retrieval results, and assistive recommendations. Output is returned within the authorized account, conversation, or workflow that requested it. Customer-facing SAI uses approved company knowledge and permitted customer context, not an owner’s personal memory. When a company enables governed automated responses and the applicable access, AI funding, evidence, safety, consent, and authority checks pass, SAI output may be delivered within that customer conversation before a person takes over. Company users can review or take over supported customer workflows.

Personalization & Controls

Where the user profile-context control is available, you can disable use of eligible profile data for SAI personalization. That preference does not disable required account or safety operations, deterministic tools, or a model-assisted feature that you separately choose to invoke with selected content. You can also choose not to submit optional files or prompts to SAI. Important external, financial, account, and hiring actions retain their normal authorization and confirmation requirements.

SAI Memory & Context Management

SAI context is not one undifferentiated record. Sorcrr separates live conversation or workflow context, user-scoped memory such as preferences and diary or timeline summaries, approved personal or organizational knowledge, and derived retrieval data such as embeddings, compacted summaries, or graph relationships. Each source keeps its own user, team, company, job, customer, or platform access boundary. A model-assisted request receives only the relevant context assembled for that authorized request, not unrestricted access to an account or organization.

Supported AI settings let you inspect a unified memory inventory and source breakdown, open source-specific views, configure retention preferences, preview compaction, and preview eligible cleanup before deletion. You may also end or delete supported conversations and request export or deletion under Sections 12 and 13. Cleanup coverage varies by source: deleting a derived vector or index does not necessarily delete its canonical source record, and some sources must be corrected or deleted in the product surface that owns them. The confirmation flow identifies affected sources and known preserved sources where supported. Security, fraud, billing, dispute, backup, and legal-retention duties can limit or delay deletion.

AI Providers & Training

Depending on the selected capability, Sorcrr may use Google Cloud services, including Speech-to-Text and Vertex AI, and approved model families made available through Vertex AI or another configured enterprise provider. Current providers and model availability can change as we improve reliability, safety, price, and regional support.

• Sorcrr does not authorize service providers to use your prompts, files, chat content, or outputs to train shared foundation models unless we first obtain your permission or clearly disclose a different arrangement.
• Provider features may temporarily retain or cache data for abuse prevention, safety, service operation, or a feature you select. Sorcrr uses enterprise data controls where available and limits provider access to the requested processing.
• Google Cloud processing is governed by its enterprise Data Processing Addendum. International transfers use the safeguards described in Sections 14 and 16.

Retention of SAI Data

• SAI-generated outputs (summaries, recommendations, drafts) are retained for the lifetime of the authorized chat, document, workflow, or account that contains them and are deleted or anonymized under Section 12.
• SAI processing logs used for debugging, billing, audit, and abuse prevention are retained for 90 days, then automatically purged unless a specific security, fraud, dispute, or legal hold requires narrower retention.
• Vector embeddings derived from authorized profile or content sources are retained while the applicable account or source is active and removed or anonymized according to Section 12.
• User-scoped memory tiers may have configurable auto-deletion periods where that setting is supported and enabled. The underlying source record follows the retention rule for the product surface that owns it.

AI Credits

Model-assisted features may require purchased, granted, or company-funded credits. A deterministic CRS calculation or Open Algorithm ranking route does not consume generative-AI credits. Usage tracking may include model, provider, token, tool, file, company, job, and workflow metadata needed for billing, abuse prevention, support, and audit logs.

If a company funds your AI credits or approves a top-up request, company admins may see request reason, requested amount, approval status, allocation amount, expiration, and company-scoped usage metadata. Your personal paid credits remain personal and are not exposed as a company balance. Learn more at How SAI Works.

8. Payment Data & Stripe

All payment processing is handled by Stripe, Inc. Sorcrr does not store, process, or have access to your full credit card numbers.

• What Stripe stores: Payment method details, transaction history, bank account information for payouts
• What Sorcrr stores: Transaction amounts, timestamps, booking/job references, payout status, Stripe customer and account IDs
• Stripe Connect: If you receive payouts, Stripe collects identity verification data (name, date of birth, government ID) as required by financial regulations. This data is stored by Stripe, not Sorcrr.

Stripe’s handling of your data is governed by the Stripe Privacy Policy.

9. Cookies & Analytics

Cookies

Sorcrr uses essential cookies for authentication and session management. We do not use third-party advertising cookies or cross-site tracking cookies.

Google Analytics (GA4)

We use Google Analytics 4 (measurement IDs: G-9XZBXVWHXS for our public websites and G-2ZQEXGM3LM for the web app) to understand how users interact with the Platform. GA4 collects:

• Page views, session duration, and navigation paths
• Approximate geographic location (country/city level)
• Device type, browser, and operating system
• Referral sources (how you found Sorcrr)

GA4 data is used to improve the Platform and understand launch funnels. Where a public consent control is available or legally required, your choice applies to non-essential analytics on that surface. You can also opt out of Google Analytics through browser controls or the Google Analytics Opt-out Browser Add-on. Signed-in app analytics choices are managed in app privacy settings where available.

In regions where consent is required (the EEA, the United Kingdom, Switzerland, Turkey, Brazil, South Korea, and mainland China), our public websites and app ask for your consent before collecting analytics. Elsewhere, analytics may run by default, and you can turn it off at any time through “Cookie settings” on our websites or Settings > Privacy in the app. When analytics is declined, Google Consent Mode may still send cookieless, non-identifying pings that do not set analytics cookies.

Firebase Analytics

Our mobile applications use Firebase Analytics for app usage data (screen views, feature usage, crash reports). Firebase is operated by Google and governed by Google’s privacy policies.

10. Data Sharing

We do not sell your personal data. We share information only in these circumstances:

• With other users: Your public profile, listings, and reviews are visible to other Platform users as necessary for the service to function
• With a hiring team when you apply: When you submit an application to a job, the videos you attached and the application-relevant profile information, including your salary expectations and work history, become visible to that job’s hiring team (the job’s owner, supervisor, interviewers, and hiring-team members) for the purpose of evaluating your application, regardless of your general visibility settings. This visibility ends if you withdraw the application; information the hiring team has already reviewed may be retained as part of the hiring record
• With interview participants when an interview is scheduled: The candidate and the interview participants (the interviewers, the supervisor, and interview team members) can see each other’s profile videos for that interview, regardless of general visibility settings. A hiring-team member who attaches a profile video to a job or an interview consents to the candidates they schedule seeing it
• Contact details in hiring: When you submit an application, that job’s hiring team can see your email address, phone number and address so they can contact you about the application and meet the company’s own internal hiring requirements (for example, background checks, offer letters or payroll), regardless of your visibility settings. Your precise device location is never shared. If you miss a scheduled interview, the interviewer may call you on that number during the interview’s contact window
• With service providers: Stripe (payments), Google Cloud and Vertex AI (infrastructure, storage, AI), Firebase (authentication and phone verification, hosting, notifications, analytics), Resend (email), and Google Analytics (web analytics)
• For referral chains: When you participate in a referral, your name may be visible to other chain participants (not your contact details)
• For legal compliance: When required by law, regulation, legal process, or government request
• For safety: To protect the rights, property, or safety of Sorcrr, our users, or the public
• In business transfers: In connection with a merger, acquisition, or sale of assets (with notice to users)

When you connect Instagram, TikTok, or X, data flows from that platform to Sorcrr under your permission. Sorcrr does not send your Sorcrr data to those platforms, apart from the requests needed to read the data described in Section 6 and to revoke access when you disconnect.

11. Data Security

We implement robust security measures to protect your data:

• Encryption in transit: All data transmitted between your device and our servers uses TLS/HTTPS
• Encryption at rest: Sensitive data is encrypted in our databases (Google Cloud SQL)
• Authentication: RS256 JWT tokens with JWKS validation, two-tier defense-in-depth architecture
• Access control: IAM-locked Cloud Run services, no direct public access to backend services
• Secret management: All credentials stored in Google Cloud Secret Manager (no hardcoded secrets)
• Monitoring: Security headers, scanner-path blocking, abuse monitoring, audit logging, and service-level access controls

No system is 100% secure. While we take extensive measures to protect your data, we cannot guarantee absolute security. If we discover a data breach that affects your personal information, we will notify you in accordance with applicable law.

12. Data Retention & Account Deletion

How to Delete Your Account

You can request deletion or anonymization of your Sorcrr account and the personal data we hold for you through these paths:

• Inside the app: Open Settings > Personal Data > Delete Account. After you confirm the dialog, your account is immediately deactivated, you are signed out, the account stops appearing in normal search and listing surfaces, and deletion or anonymization begins.
• Web form (no sign-in required): Submit a request at sorcrr.com/account-deletion. This form is intended for users who have uninstalled the app or cannot sign in. You only need your email address and optional account ID.
• Email: Write to privacy@sorcrr.com from the email address on your account.

What the Deletion Flow Looks Like

1. You submit a deletion request via app, web form, or email
2. We send an acknowledgement email to the address on file
3. We verify the request is coming from the account owner (via the email we already have on file, or a simple confirmation link)
4. We deactivate the account, anonymize core account identifiers, and remove or anonymize supported personal data from active product systems within 30 days after verification, subject to the retention rules below
5. We send a confirmation email when the request has been processed or explain any retained categories required by law or platform safety

If you change your mind within 30 days of your request, reply to the confirmation email or contact privacy@sorcrr.com and we can cancel the deletion.

What Is Removed Or Anonymized From Active Product Systems

• Profile (name, photo, bio, work experience, skills, education)
• Uploaded videos, thumbnails, and documents (resumes, cover letters, portfolios)
• Chat messages, internal remarks, and internal briefs authored by you
• SAI conversation history and SAI-generated outputs tied to your account
• Current and historical CRS records, component breakdowns, and personal ranking policies tied to your account, subject to any narrow dispute, security, fraud, or legal hold
• Vector embeddings derived from your content
• Job postings, applications, service listings, and bookings you created
• Notifications, notification preferences, device tokens
• Referral links you own (chain attribution is retained in anonymized form for accounting)
• SAI processing logs older than 90 days are already purged; the remainder is purged with your account

What Is Retained for Up to 7 Years

To comply with US and international tax, accounting, and anti-fraud obligations, we retain the following for up to 7 years after account closure:

• Transaction records: invoices, payment receipts, payout records, refund records
• Bounty payout history (amounts, counterparties, dates)
• Tax and 1099 reporting data
• Anti-fraud and abuse records where we have a reasonable belief of a policy violation

These records are minimized — we keep only what financial and legal regulations require, and they are not used for any product or marketing purpose.

Other Retention Rules

• Active accounts: Your data is retained as long as your account is active
• Signup and promotional-credit eligibility: Signup and promotional credits are generally limited to one grant per verified person or identity, and deletion followed by re-registration does not reset eligibility. To prevent duplicate grants, Sorcrr may retain grant status, grant date, and a minimal pseudonymous eligibility token for up to 24 months after account deletion. That retained eligibility record does not contain a raw phone number and is not used for marketing. If you believe an eligibility match is incorrect, contact privacy@sorcrr.com or use an in-app support channel to request review and correction.
• Contact import data: Optional imported-contact data may include hashed contact identifiers, contact names, match status, and import timestamps; it is deleted or anonymized when you request deletion of imported-contact data or close your account, subject to abuse, safety, and legal retention needs
• Social link figures and daily records: Up to 30 days (Section 6)
• Platform connections and tokens: Until you disconnect or delete your account
• Sponsored-post figures: YouTube, 30 days from each reading; X, until 30 days after the measurement window, or earlier if the post is removed from X; Instagram and TikTok, with the booking until a deletion request or account deletion. Financial amounts follow the financial-records rule
• SAI processing logs: 90 days, then auto-purged (see Section 7)
• SAI memory and context: User-configured retention applies to supported memory tiers when enabled; conversations, knowledge, source records, and derived indexes otherwise follow their owning surface, account, and Section 7 rules
• CRS score history and ranking receipts: Retained while the relevant account or authorized scope is active, then removed or anonymized under this section unless narrower legal, fraud, security, or dispute retention applies
• Analytics data: Aggregated and anonymized analytics are retained indefinitely. Individual-level analytics are retained for 26 months (GA4 default)
• Backups: Encrypted backups are purged according to our backup retention schedule, typically within 35 days of account deletion

13. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data (subject to the financial-records retention described in Section 12). You can delete your account inside the app at Settings > Personal Data > Delete Account, via our web deletion form (no sign-in required), or by emailing privacy@sorcrr.com.
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your data for certain purposes
• Withdraw consent: Withdraw consent for optional data processing (e.g., contact import, calendar access)

To exercise any of these rights, contact us at privacy@sorcrr.com. We will respond within 30 days.

14. GDPR & European Privacy Rights

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following additional rights and disclosures apply under the General Data Protection Regulation (GDPR).

Lawful Basis for Processing:

• Contract Performance — Processing necessary to provide Sorcrr’s core services (account management, job matching, payments)
• Legitimate Interest — Processing for security, fraud prevention, and platform improvement
• Consent — Contact import, calendar access, analytics where consent is required, personalization, and marketing communications (you may withdraw app-level consent via Settings > Privacy where available; public-web analytics choices are controlled through public consent controls where available, browser controls, or by contacting privacy@sorcrr.com)

Additional Rights:

• Right to lodge a complaint with your local data protection supervisory authority
• Right to request restriction of processing
• Right not to be subject to solely automated decision-making with legal or similarly significant effects where applicable; Sorcrr’s CRS, Open Algorithm, and SAI features are assistive and keep consequential decisions with human users

International Data Transfers: Your data is transferred to the United States for processing. We rely on Google Cloud’s Data Processing Agreement and Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection of your data during international transfers. Stripe uses similar mechanisms for payment data.

15. Children’s Privacy

Sorcrr is not intended for users under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@sorcrr.com.

16. International Data Transfers

Sorcrr operates primarily in the United States. If you access the Platform from outside the US, your data may be transferred to and processed in the United States. We rely on Google Cloud’s Data Processing Agreement and Standard Contractual Clauses (SCCs) to ensure adequate data protection for international transfers. Stripe uses similar mechanisms for payment data.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For material changes, we will provide notice through the Platform or via email. Your continued use of Sorcrr after changes take effect constitutes acceptance.

18. Contact

For questions, concerns, or requests regarding your privacy:

• Privacy inquiries: privacy@sorcrr.com
• General support: privacy@sorcrr.com
• Legal: legal@sorcrr.com
• Company: SOSUITE LLC, 312 W 2nd St, Unit #A448, Casper, WY 82601