Privacy Policy

1. Introduction

Sado Labs Inc. ("Sado Labs", "we", "our", "us") operates the sorraia.app website and the Sorraia platform of embeddable forms, booking calendars, shops, AI chat and WhatsApp buttons (the "Service"). Sado Labs Inc. is the data controller for the personal data processed through the Service. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

Account Information

When you create an account, we collect your email address and name via our authentication provider (Clerk). If you sign in with Google or Microsoft, we receive your basic profile information from those providers.

Form & Booking Data

When end users submit forms or book appointments through widgets you create, we collect the data they provide (name, email, phone, and any custom fields you configure). This data is stored in our database and forwarded to your configured webhook URL.

Order & Payment Data

When end users purchase through your e-commerce widgets, we process order details (items, amounts, and the shipping/contact information they provide). Card details are handled directly by Stripe and never touch our servers.

Tracking Data

Our widgets may capture third-party tracking cookies present on the host website. This data is forwarded to your webhook alongside form submissions for lead attribution purposes.

WhatsApp Messages

When a business's WhatsApp number is connected to Sorraia through the WhatsApp Cloud API (Meta), the messages people send that number reach us so we can link a chat to the button tap that started it. We keep a one-way hash of the sender, the reference code and the times, never the message or the number, and delete what did not become a lead after 30 days; a lead is saved like a form submission, with the sender's WhatsApp name and number.

Calendar Data

If you connect a calendar provider, such as Google Calendar, we access your calendar's free/busy information to show available time slots. We create calendar events for confirmed bookings. Calendar access tokens are securely stored by our authentication provider (Clerk) and are never exposed to third parties.

Spam Protection

Submissions our checks flag as spam, or sent from an address the widget owner has blocked, can be held for the owner's review instead of being delivered. A block keeps only a one-way hash of the address, never the address itself. When a booking is refused because its address is blocked, we count the days this happened on that block, with no name, time or message, and the count is deleted with the block when it is lifted or the account is deleted.

How You Found Sorraia

When you visit sorraia.app from a browser whose time zone is in the Americas and that does not send a Global Privacy Control signal, we store two cookies, sorraia_ft and sorraia_lt, for up to 90 days (some browsers keep them for less). They record how you reached us, the first time and the most recent time: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content), the ad click identifier an ad platform added to it (such as Google's gclid), the page you landed on without its query string, the domain of the website that sent you, and the date. They hold no name, email address or other contact details. If you create an account, we keep this information with your account until the account is deleted.

Lead Tracking on sorraia.app

Under the same conditions, once a page of sorraia.app has finished loading it also loads WhatConverts, our lead-tracking provider (never on the dashboard). WhatConverts receives the address of each page you view and stores its own cookies on sorraia.app for up to two years (some browsers keep them for less), with copies in your browser's local storage: wc_client and wc_client_current, which record the campaign tags, ad click identifiers and landing page of your visit, and wc_visitor, a random identifier for your browser. When you send our contact form, start a conversation with our chat assistant, or create an account, we send WhatConverts a record of it, with the value of its wc_client_current cookie when your browser has one: your name and email address for the contact form and a new account; for a chat, the address of the page without its query string, the time and a reference number. Without that cookie, a new account's record carries the campaign tags, ad click identifier and landing page we keep with the account (see How You Found Sorraia above). We never send it what you wrote in the form or the chat.

3. How We Use Your Information

• To provide and maintain the Service
• To create and manage your account
• To process form submissions, booking requests, and orders
• To forward submission and order data to your configured webhooks
• To check calendar availability and create booking events
• To send booking confirmation, reminder, and order emails
• To communicate with you about the Service
• Account holders receive service emails about their account and may receive product emails, which they can turn off at any time in Settings → Emails or from the link in each email.
• To measure which of our own advertising campaigns lead to new accounts, published widgets and first payments
• To track which of our own pages and campaigns lead to contact requests, chats and new accounts

4. Data Sharing

We do not sell your personal information. We share data only in these cases:

• Webhooks: Form submissions, booking, and order data are forwarded to webhook URLs you configure.
• Service providers (sub-processors): We use third-party providers — including Clerk (authentication), Render (hosting & database), Stripe (payments), and Resend (email delivery) — to operate the Service. The full, current list is on our Sub-processors page.
• Calendar providers: Booking events are created in the calendar you connect, such as Google Calendar.
• Advertising measurement: when an account is created from a visit that began with a click on one of our Google ads, we report that sign-up to Google Ads, and later the account's first published widget and first payment (with its amount), by sending the ad click identifier, the name of the event and its time. We send no name, email address or form content, and we report nothing for accounts that did not arrive through an ad click.
• Lead tracking: we send WhatConverts a record of each contact-form message, chat and account started on sorraia.app (see Lead Tracking on sorraia.app above). WhatConverts reports the leads that carry a Google ad click identifier to Google Ads.
• Legal requirements: We may disclose information if required by law.

5. Data Security

We implement industry-standard security measures including encrypted connections (HTTPS), secure authentication via Clerk, and database encryption at rest. OAuth tokens for calendar integrations are stored securely by Clerk and never stored in our own database.

6. Data Retention

We retain your account data, form submissions, and orders for as long as your account is active. You may delete your forms, submissions, and account at any time. Webhook-forwarded data is subject to the retention policies of the receiving service.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect calendar and social account integrations at any time
• Export your form submissions and orders

8. Cookies

The Sorraia dashboard uses session cookies managed by Clerk for authentication. Our public website sets two cookies of its own, sorraia_ft and sorraia_lt, which remember how you found us (see How You Found Sorraia above); you can delete them in your browser settings at any time. Under the same conditions WhatConverts sets three cookies of its own there, wc_client, wc_client_current and wc_visitor (see Lead Tracking on sorraia.app above), which you can delete the same way. Embedded widgets on third-party sites may read existing third-party tracking cookies on those sites but do not set any cookies of their own. Our public website pages, but not the dashboard, count visits with Ahrefs Web Analytics, which does not use cookies; Ahrefs receives the address of each page viewed, including any campaign tags in it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service.

10. Contact Us

If you have questions about this Privacy Policy, or wish to exercise your data rights, please contact the data controller, Sado Labs Inc., at support@sorraia.app.

Sado Labs Inc. · 251 Little Falls Drive, Wilmington, DE 19808 · +1 302 618 1154