Privacy Policy

1. Who we are and the roles we play

SorrelSites (“we”, “us”) provides membership management services to non-profit and membership organizations. We play two different roles. For information about you as a visitor to joinsorrel.com or as a SorrelSites account holder, we decide how the information is used and are directly responsible to you. For the member records an organization keeps in SorrelSites, that organization controls the data — we process it on the organization's behalf and at its direction. If you are a member of an organization that uses SorrelSites, your organization is your primary point of contact for privacy questions and requests about your member record.

2. Information we collect

Visitors to joinsorrel.com: if you use our contact form, we collect your name and email address, any organization name or message you provide, and the page and browser information sent with your request. If you subscribe to the newsletter, we collect your email address and any organization name you provide. If you schedule a conversation, you provide your booking details on Google's scheduling page. Our marketing site also uses Google Analytics (Section 7).

SorrelSites account holders (organization admins, staff, and members with portal logins): name, email address, and password (stored only as a strong one-way hash — we cannot read your password); optional two-step verification and passkey credentials (authenticator secrets are stored encrypted; passkey private keys never leave your device); sign-in history; and, for security throttling, the IP addresses of failed sign-in attempts.

Member records we process for organizations: contact details (name, email, phone, mailing address), membership status and history, any custom fields the organization defines, event registrations and attendance, dues and payment history, communications sent to the member and their delivery status, documents, photos (hidden location metadata such as GPS coordinates is stripped from uploaded member photos), electronic signature records (which include the signer's IP address and browser as signing evidence), meeting recordings and transcripts when the organization enables an online notetaker or records or uploads meeting audio, and location check-ins (recorded only with the member's explicit consent at check-in). What appears in custom fields is chosen entirely by the organization.

Payment information: payments are processed by Stripe. Card numbers are entered directly on Stripe's secure payment surfaces and never touch or get stored on SorrelSites' systems; we store only Stripe's reference identifiers and transaction records (amounts, dates, status).

3. How we use information

• To provide the service: hosting organization websites, maintaining member records, running events, sending the communications organizations compose, and processing dues and payments.
• To operate accounts and billing for organizations that subscribe to SorrelSites.
• To secure SorrelSites: authenticating sign-ins, throttling abuse, verifying webhooks, and keeping audit logs of significant actions.
• To support you and improve the product, including aggregated, non-identifying usage measurement.
• To meet legal obligations.

We do not sell personal information, and we do not use it for third-party advertising.

4. AI features and your information

SorrelSites' AI features can help draft website content, emails, configuration and meeting minutes, and answer questions. Depending on the feature and the information provided, AI providers may receive documents, text, images or audio, including information about people. Some text is scrubbed, but names, speakers and other information may remain. Scanned PDFs enabled for AI reading may be sent as raw file bytes to Google Gemini for text extraction; AI-enabled document content may be sent to providers for extraction, indexing and tasks. AI output can be inaccurate and should be reviewed before use. Some answers to visitors are delivered directly.

Individual file AI-read settings control future retrieval of documents from the library. Folder defaults set the initial AI-read setting for newly discovered files; changing a default does not change existing files. A file attached directly can also be supplied to an AI feature. Turning off library AI-read access does not erase earlier provider requests or logs. Some generation attempts are logged, but those records are not a complete log of every provider call or material sent. We do not use your information to train AI models.

5. Google user data

SorrelSites offers two optional features that use Google OAuth: Sign in with Google, and a Google Meet connection that creates meeting links. This section explains how SorrelSites accesses, uses, stores, shares, protects, retains and deletes the information it receives from Google APIs (“Google user data”). Both features use the same SorrelSites Google OAuth app.

• Data we access with Sign in with Google (the openid, email and profile scopes): your Google account identifier, your email address, and your name. Google also makes your profile picture available; SorrelSites does not read or store it.
• Data we access with the Google Meet connection (the openid, email and https://www.googleapis.com/auth/meetings.space.created scopes): the email address of the Google account being connected, and permission to create Google Meet meeting spaces. When SorrelSites creates a meeting space, Google returns that meeting's link and meeting code. This permission covers only meeting spaces SorrelSites itself created. SorrelSites does not read your calendar, contacts, email, files or any meeting it did not create, and requests no other Google permissions. Google accounts connected before October 2, 2026 granted the older calendar.events permission instead, which SorrelSites no longer uses; disconnecting the account removes it.
• How we use it: sign-in data is used only to authenticate you and to create or link your SorrelSites account. The connected account's email address is used only to label the connection in your organization's admin console. The Meet permission is used for exactly one operation: creating a meeting space when an administrator clicks Create link on a meeting in SorrelSites. The link Google returns is saved on that meeting and shown to the people the organization invites. Nothing is created on your calendar.
• What we do not do: we do not sell Google user data, use it for advertising, or use it to build profiles of you. We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models, and we do not supply data received through the Google Meet permission to AI features.
• How we share it: SorrelSites does not transfer Google user data to anyone else, except (a) the meeting link, which is shared with the people the organization invites to that meeting; (b) the cloud provider that hosts SorrelSites (Google Cloud), which stores it on our behalf; (c) when necessary for security purposes, such as investigating abuse, or to comply with applicable law; and (d) as part of a merger, acquisition or sale of assets, only after obtaining your explicit prior consent.
• Who can see it: people in your organization who can manage Connected services see the email address of a connected Google account. SorrelSites staff do not read Google user data unless you ask us to (for example, in a support request), it is necessary for security purposes, or it is required by law.
• How we protect it: Google user data travels only over encrypted connections (HTTPS) and is encrypted at rest. The OAuth tokens Google issues for the Meet connection carry an additional layer of encryption with Google Cloud KMS. Sign in with Google stores no Google tokens at all.
• How long we keep it and how to delete it: your Google account identifier is kept while Google sign-in is linked to your SorrelSites account, and we delete it when you ask us to unlink it. A Meet connection's tokens and email address are kept while the connection exists; disconnecting it in Connected services deletes them immediately and asks Google to revoke SorrelSites' access. A meeting link already created stays on its meeting until the organization removes it. You can also revoke SorrelSites' access at myaccount.google.com/permissions, or contact us through our contact form to ask us to unlink Google sign-in or delete your Google user data. Closing your SorrelSites account removes stored Google user data, subject to the backup period in Section 10.

SorrelSites' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Google Drive is separate from both features above and does not use the Google consent screen. An organization may share designated folders from My Drive or Shared Drives with a SorrelSites-provided service account. People who can access Files can open and download the shared-folder files without their own Google access. Files attached to published events or board meetings may also be available to people who can see them. Where the organization grants write access, staff with permission to manage files can upload or rename files in those folders. Access to files and use by AI features are separately controlled by the organization, as described in Section 4; Drive content is never used to train AI models.

6. Cookies

SorrelSites' application surfaces (admin console, member portal, and organization sites) use only strictly necessary cookies: a session cookie that keeps you signed in (httpOnly, so scripts cannot read it), a companion security cookie that protects against request forgery, and — if you choose “remember this device” for two-step verification — a trusted-device cookie that lasts 30 days. There are no advertising or cross-site tracking cookies on any SorrelSites application surface. Our marketing site, joinsorrel.com, additionally sets Google Analytics cookies as described in Section 7; you can block cookies in your browser settings.

7. Website analytics (joinsorrel.com only)

On our public marketing site we use Google Analytics to understand how visitors find and use the site. Google Analytics sets cookies and processes usage data such as pages viewed and approximate location derived from your IP address; it does not receive your name or contact details, and we do not use it to advertise to you. Analytics runs only on joinsorrel.com — never in the admin console, member portal, or on organization websites. You can opt out with Google's browser opt-out add-on (tools.google.com/dlpage/gaoptout) or by blocking analytics cookies.

8. Service providers we rely on

We share personal information only with the service providers that help us run SorrelSites, each limited to its purpose:

• Google Cloud — hosting, databases, file storage, encryption key management, and secret storage for SorrelSites (United States).
• Stripe — payment processing for organization subscriptions and for the dues and event payments organizations collect (Stripe receives payer name and email; card details go directly to Stripe).
• Twilio SendGrid — email delivery (receives recipient addresses and message content).
• Twilio — delivery of enabled communications (receives recipient phone numbers and message content).
• Browser push services (Google, Apple, Mozilla) — deliver push notifications; notification content is encrypted so the push service cannot read it.
• Recall.ai — recording and transcription for online meetings when the organization enables the meeting notetaker (processes meeting audio, captions, and participant names). Phone recordings or uploaded audio may be sent to the configured AI model for transcription.
• AI model providers (Anthropic and Google) — provide AI features, including document extraction, indexing and assisted tasks, as described in Section 4.
• Google Analytics — marketing-site usage measurement only (Section 7).
• Have I Been Pwned — when you set a password we check a privacy-preserving fingerprint (the first five characters of a hash) against known breach lists; your password never leaves our systems.

9. How we protect information

• All traffic is encrypted in transit (HTTPS), and data is encrypted at rest by our cloud provider; especially sensitive stored fields, such as connector tokens, carry an additional layer of encryption with managed keys (Google Cloud KMS).
• Sessions use httpOnly cookies that scripts cannot read, with request-forgery protection on authenticated state-changing requests.
• Passwords are stored only as strong one-way hashes; new passwords are screened against known breaches; sign-in attempts are throttled.
• Two-step verification and passkeys are available to every account and required for SorrelSites staff; changing your password signs out all existing sessions.
• Tenant-owned data is scoped to the organization, and inbound webhooks from payment and delivery providers are cryptographically verified.
• Significant actions are recorded in audit logs, and SorrelSites staff access to organization data is limited and logged.

No system is perfectly secure, but if we learn of a breach affecting your personal information we will notify affected organizations and authorities as required by law.

10. Data retention and deletion

• Active accounts: we keep your information for as long as your organization's account is active.
• Individual member records: organization admins can permanently delete a member record at any time; deletion takes effect immediately in the application.
• Electronic signature records: retained for the period the organization configures (7 years by default, reflecting common document-retention practice), then purged down to a minimal audit stub (signer name and email, document title, and signing date) that preserves the integrity of the signing history.
• Cancelled subscriptions: a voluntary paid cancellation moves the organization to the Free board plan rather than automatically deleting its account. Some other account states can lead to a read-only period followed by account closure and deletion. See Plan & billing or contact us through our contact form for the applicable status and information about deletion and retention; residual copies may persist in encrypted backups for a limited period before being overwritten.
• We may retain records we are legally required to keep (for example, financial and tax records) and minimal logs needed for security and abuse prevention.

11. When we share information

Beyond the service providers in Section 8, we share personal information only: at an organization's direction (for example, when it publishes a member directory on its site — always subject to per-field visibility controls and each member's opt-out); to comply with law or valid legal process; to protect the rights, safety, or security of SorrelSites, our users, or the public; or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to the transferred information. We never sell personal information. Google user data is shared only as Section 5 describes.

12. Your rights and choices

• Members of organizations: your organization controls your member record — contact your organization to access, correct, export, or delete it. SorrelSites also gives you direct self-service controls: a member portal to view and update your profile, directory visibility preferences including a full opt-out, per-channel communication preferences, and a one-click unsubscribe link in every broadcast email.
• Account holders: you can view and update your account details in settings, disconnect Google sign-in, manage two-step verification and passkeys, and contact us at our contact form to request a copy or deletion of your account information.
• Depending on where you live, you may have additional statutory rights (such as access, portability, correction, or erasure). We honor valid requests; where we process data on an organization's behalf, we will route your request to that organization and assist it in responding.

13. Where information is processed

SorrelSites is operated from the United States, and uses Google Cloud infrastructure in the United States to process and store information. If you use SorrelSites from outside the United States, your information is transferred to and processed in the United States. Other service providers may process information in other locations under their own terms.

14. Children

SorrelSites accounts are for adults, and our services are not directed to children under 13. Organizations may keep member records that relate to minors (for example, youth programs) — the organization controls those records and is responsible for obtaining any required parental or guardian consent, and SorrelSites' signature tools support a guardian signing on a minor's behalf.

15. Changes to this policy

We may update this policy as the service evolves. For material changes we will notify organizations by email or in the admin console before the changes take effect. The “Last updated” date below reflects the current version.

16. Contact us

For privacy questions or requests, contact us at our contact form. If you are a member of an organization that uses SorrelSites, please also contact your organization, which controls your member record.