Privacy policy

Last updated 27 October 2026

Sorva is a trading name of Lendaly Pty Ltd (ABN 67 667 505 768). This policy explains what Sorva collects, why, where it’s kept and who it’s shared with. “We” means Lendaly Pty Ltd. If you have a question, email [email protected].

What we collect

  • Your account: your name, email address, password (stored only as a one-way hash) and, if you add it, your mobile number.
  • Your business: its name, country, business number (such as an ABN or VAT number), and the people you invite.
  • Your documents: the receipts and invoices you upload (on the website or with the iPhone app), forward, send by WhatsApp or let us find in a connected mailbox, and the details read from them (supplier, dates, amounts, tax, business numbers).
  • Connected mailboxes: if you connect Gmail, Outlook or another mailbox, we read it only to find receipts and invoices. We keep the emails that contain them, and nothing else. Access is read-only: we never send, change or delete your emails.
  • Connected services: if you connect accounting software or cloud storage (such as Xero, QuickBooks, MYOB, Google Drive or Dropbox), we keep the access they give us, encrypted, to send your documents there.
  • How you use Sorva: a record of important actions (such as edits, exports, downloads and sign-ins) for security, and anything you send us through the Feedback button. When you sign in, we keep your internet (IP) address and the type of browser or device with your sign-in, also for security.

We don’t sell your information, we don’t use it for advertising, and Sorva has no advertising or analytics trackers. The only cookies are the ones that keep you signed in.

Why we use it

  • To read, organise and export your documents, which is the service you signed up for.
  • To run your account: signing in, emails about your account, invites and support.
  • To keep Sorva secure and working, and to fix problems.

Where it’s kept

Your account, documents and their details are stored with DigitalOcean in Sydney, Australia. Files are private: links to them expire after a few minutes, and only people in your business who are allowed to see a document can open it.

Who we share it with

We use a few service providers to run Sorva. Some are overseas, mainly in the United States, so your information may be handled there. We choose providers that protect it to a standard similar to the Australian Privacy Principles, and we only give them what they need:

  • Anthropic (United States): its AI reads each document to find the supplier, dates and amounts. Anthropic doesn’t use what we send it to train its AI.
  • Postmark (United States): sends our emails, and receives the emails you forward to your Sorva address.
  • DigitalOcean (servers in Sydney): hosts Sorva and stores your data.
  • Meta (WhatsApp), only if you send documents by WhatsApp.
  • Google, Microsoft, Xero, Intuit (QuickBooks), MYOB and Dropbox, only if you connect them, and only to do what you asked (sign you in, find receipts, or send documents there).

Your accountant, team members and anyone else you invite can see your business’s documents, according to their role. We may also share information if the law requires it.

Google user data

If you connect Gmail or Google Drive, Sorva’s use of information from Google follows the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail access only to find your receipts and invoices, and Drive access only to save the files you export. We don’t use Google data for advertising, and we don’t use it to train AI models.

The iPhone app

The Sorva iPhone app is for capturing receipts and invoices. It signs in to the same Sorva account as the website, and everything in this policy applies to it too.

  • Camera, photos and files: the app uses the camera only when you scan, to capture receipts and invoices. From your photos and files, it only receives the ones you choose, or share to Sorva from another app. It never uses the microphone or your location.
  • Uploads: what you capture is uploaded to your Sorva account, into the business you were working in when you captured it, and handled like anything else you upload.
  • What’s kept on your phone: each capture waits in the app’s own storage until it has uploaded, so nothing is lost without signal. The app deletes its copy once the capture shows in Recent captures, or a week after it uploaded. It also keeps small preview pictures of your recent captures. Your sign-in is kept in the iPhone’s keychain, on that phone only. Signing out deletes all of this from the phone, including captures that hadn’t uploaded yet.
  • No tracking or ads: the app has no advertising, no analytics and no tracking, and it only connects to Sorva itself. If you’ve chosen to share analytics with app developers in your iPhone’s settings, Apple may pass its crash reports for the app on to us. Apple collects those, not Sorva.

How long we keep it

  • Documents stay until you delete them. Archived documents are deleted for good after 90 days.
  • If you close your account, we delete your business’s documents, files and connections, unless someone else owns the business with you.
  • Backups are kept for a short time after that, then overwritten.

Keeping it safe

Everything is sent over encrypted connections. Passwords are hashed, and access to your mailboxes and connected services is encrypted. Inside Sorva, each business can only ever see its own data.

Your choices and rights

You can see and correct your details in Sorva, export your documents at any time, and close your account and delete its data in Personal settings on the website. In the iPhone app, Account → Delete account takes you there; Help and support has the steps. You can also ask us for a copy of the information we hold about you, or to correct or delete it, by emailing [email protected]. We’ll reply within 30 days.

If you’re unhappy with how we’ve handled your information, tell us first and we’ll try to fix it. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the United Kingdom, the Information Commissioner’s Office (ico.org.uk).

Changes

If we change this policy in a way that matters, we’ll tell you by email or in Sorva before the change takes effect.