Privacy Policy

Soriela ("Soriela", "we") is the controller for the personal data described in this policy. You can reach us about anything on this page at info@soriela.com.

Where Soriela processes project data on behalf of a customer, the customer is the controller and Soriela acts as a processor under a data processing agreement. In that case the customer's own privacy notice governs how that data may be used, and this policy describes what we do as their processor.

When you visit this website. Our hosting provider records standard server data — IP address, browser and device type, pages requested, and the time of the request — to serve the site and keep it secure. With your consent, and only then, we also measure visits and our advertising — see section 6.

When you ask for a demo on this website. The email address you give us; the page and the button you asked from; the page that referred you and any campaign tags in the link you followed; and your browser's language, time zone, screen size and device type. We also count clicks on the "Book a demo" and "See Soriela in action" buttons — which button, on which page, from which referring page — without your address or any identifier kept in your browser, so we can tell which pages work.

When you contact us or meet with us. Your name, email address, company, anything you choose to write to us, and the time and date of any meeting we arrange.

When you use the free tools on this website. The documents you upload and anything you type to describe the project; your IP address, browser and device type and language; an identifier kept in your browser (see section 6); the page that referred you; how far through the tool you got; the result the tool produced; and — once you ask for that result — the email address you give us, and whether you ticked the box to hear from us again. Project documents usually name people. Upload only what you are entitled to share; we process what is in them solely to produce your result.

When you use the Soriela product. Account data (name, work email, organisation, role and authentication data), usage and audit logs, and the project data Soriela reads from the sources your organisation connects — issues, plans, documents, messages, mail and calendar entries, and the names of the people involved in them. Soriela reads the sources your organisation chooses to connect, with the scopes it grants, and nothing else.

We do not seek special categories of personal data, and the product is not intended to be used to process them.

• To provide the product and the website — performance of a contract (Art. 6(1)(b) GDPR), or our legitimate interest in operating our site (Art. 6(1)(f)).
• To run a free tool you started and send you its result, including the invitation in that email to open the same project in Soriela — steps taken at your request (Art. 6(1)(b)). Limiting each tool to one free run a day per person, and measuring how the tools are used so we can improve them, is our legitimate interest (Art. 6(1)(f)).
• To respond to enquiries and run demos, including writing back to arrange the demo you asked for — steps taken at your request before entering a contract (Art. 6(1)(b)), or legitimate interest (Art. 6(1)(f)). Counting clicks on the demo buttons, so we know which pages work, is our legitimate interest (Art. 6(1)(f)).
• To secure our systems, prevent abuse and keep audit logs — legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)).
• To measure visits to this website and what our advertising brings in — consent (Art. 6(1)(a)), asked for when you first visit and withdrawable at any time; see section 6.
• To send occasional product or event email — consent (Art. 6(1)(a)), withdrawable at any time using the link in the message or by writing to us.
• To meet accounting, tax and other legal duties — legal obligation (Art. 6(1)(c)).

We do not sell personal data, and we do not use customer project data to train third-party or foundation models.

Soriela sends project content to large language models in order to produce summaries, risks, briefings and answers. Which models, and where they run, depends on the deployment your organisation chooses — see our security and deployment page.

In our hosted service they are open-weight models that Soriela runs itself, on a GPU server at Scaleway in Paris, France, or — only when that server cannot be reached — on GPU servers at Nebius in Finland. No third-party AI service receives your project content. Outputs are linked back to the source they came from, so a person can always check what an answer was based on.

Documents uploaded to the free tools on this website are read by the same models, on the same servers. They are not used to train any model, ours or anyone else's.

Soriela's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

This section covers what Soriela receives from Google when someone connects a Google account to a Soriela workspace: Google Drive, Sheets, Docs, Slides, Calendar, Gmail or Google Chat. Where it is more specific than the rest of this policy, this section is the one that applies.

What Soriela reads, and why

Soriela only reads. It never sends email, posts in a Space, creates or changes events or files, or deletes anything in your Google account. It asks Google for an app's permissions only when someone connects that app, and Gmail and Google Chat use a Google connection of their own, so you can grant one without the other.

• Your Google account (openid, email, profile), with every connection: your Google account ID and email address, so that Soriela knows whose account a connection is and can show it to you. Soriela does not keep your name or picture from Google.
• Google Drive, Sheets, Docs and Slides (drive.file): only the files you pick.
  • You pick them in Google's own file picker, which runs in your browser. Soriela never lists or searches your Drive: Google tells it which files you picked, and Soriela can open those and no others. Folders cannot be picked.
  • For a file added as a source, Soriela reads its contents and keeps them up to date: the first tab of a spreadsheet; the text, tables and links of a document; the text and speaker notes of a presentation; and the file's name, dates and the names of its owners and editors.
  • Files you import into a workspace's knowledge base are copied into Soriela so the AI can search them.
  • Google's consent screen says this permission lets Soriela see, edit, create and delete the files you use with it. Soriela only reads them.
  If you connected Google Drive before 19 October 2026, you gave Soriela read access to your whole Drive (drive.readonly). Soriela no longer asks for it, and uses it only to keep reading the files your sources already name until you next sign in to Google in Soriela; you then pick those files once more. Removing Soriela's access at Google (see below) ends that older permission at once.
• Google Calendar (calendar.calendarlist.readonly, calendar.events.readonly): the list of your calendars, so you can choose one; then, from the calendar you connect, its events from 180 days back to 60 days ahead — title, description, location, time, status, organiser, attendees and recurrence — to show the project's meetings, flag clashes and inform the AI's analysis.
• Gmail (gmail.readonly): only the messages in your inbox that contain the keyword set when the Gmail source was added, usually the project's name — their sender, recipients, date, subject and text. Soriela does not download attachments and reads no other messages.
• Google Chat (chat.spaces.readonly, chat.messages.readonly, chat.memberships.readonly): the list of named Spaces you belong to, so you can choose one — never direct messages or group chats; then, from the Space you connect, its messages, with their author, time and thread, and its list of members.
• The people in that Space (directory.readonly, contacts.readonly): the name and email address of each person who wrote in or belongs to the Space you connected, looked up in your organisation's directory or, on a personal account, in your Google Contacts, so that each message shows who wrote it. Soriela reads nobody else from your directory or contacts.

How we use it

Only to provide the Soriela features your workspace uses: keeping the project's tasks, plans, meetings, messages, emails, documents and contacts in step with their source; the project's health score, risks, summaries and briefings; answers in Soriela's AI chat; search; and the reports, alerts and reminders your workspace chooses to receive by email. We do not use it to serve or target advertising, we do not sell it, and we do not use it to assess anyone's creditworthiness or for lending.

AI models

Soriela's AI features run on open-weight models that Soriela runs itself, on the GPU servers named below. No third-party AI service receives your Google data. It is processed only to produce results for your workspace. Data received through Google APIs is not used to develop, improve or train generalised or non-personalised AI or machine-learning models, and it is never used to train any model, ours or anyone else's.

Where it is stored and processed

• Stored at Amazon Web Services in Stockholm, Sweden (AWS region eu-north-1): in Soriela's database, which is encrypted at rest, and on Soriela's server there, which keeps the latest copy of each source's sync and the files imported into a knowledge base. The tokens Google issues to let Soriela read your account are encrypted again by Soriela (AES-256-GCM) before they are stored.
• Processed by the AI on a GPU server at Scaleway in Paris, France, or, only when that server cannot be reached, on GPU servers at Nebius in Finland, over an encrypted connection.

Who can see it

In Soriela, the data from a source is visible to the members of the workspace it was connected to, according to their roles, and to the people your workspace sends its reports and alerts to. Nobody at Soriela reads it, except: when you ask us to and agree to our viewing specific data, for example to look into a problem you report; when it is necessary for security, such as investigating a bug, abuse or a security incident; when the law requires it; or once it has been aggregated and anonymised, to run the service. Access to our admin tools is limited to named staff, and every request made in them is logged.

Who else processes it

Only the service providers that run Soriela for us, on our instructions and under contract: Amazon Web Services (hosting, Sweden), Scaleway (AI processing, France), Nebius (AI processing only when the Scaleway server cannot be reached, Finland), and Google itself, which delivers the email Soriela sends — reports, alerts and reminders can quote what was synced. We do not transfer data received through Google APIs to anyone else, except where the law requires it, or as part of a merger or acquisition, and then only with your explicit consent first.

How long we keep it, and how it is deleted

• While it is connected. Soriela keeps what it syncs from a Google source for as long as the source's project exists, and updates it at every sync. Items later deleted in Google are marked as removed in Soriela rather than erased, and synced emails are kept. What the AI produced from it — summaries, tasks, risks and answers — and Soriela's records of the AI's work, which include what the AI was given, stay with the project too.
• Disconnecting. Disconnecting Google from a project's sources revokes Soriela's access at Google at once — unless the same Google account is still connected to Soriela somewhere else — and deletes the sources that used the connection, with what they synced. Sources you are not allowed to manage are kept, but stop syncing until someone reconnects them. Disconnecting under Connected accounts on your profile revokes the access in the same way, but leaves what was synced in place.
• Removing a member. The Google connections that person made for the workspace are revoked and removed. Sources that used them stop syncing until someone reconnects them, and what was synced stays with the workspace.
• Deleting a source deletes what Soriela synced from it, and its copy of the last sync, at once — except the people it found, who stay in the project's contacts, and values it filled in among the project's details. Deleting a project deletes everything Soriela's database holds for it at once, including the AI's results and records.
• Deleting a workspace stops all syncing and AI work for it at once. For 30 days we can restore it if you ask; then it is permanently deleted, with everything synced into it, and its Google connections are revoked.
• Deleting your account signs you out everywhere at once. 30 days later the account is anonymised, every Google connection you made is revoked and removed, and any workspace where you were the only member is permanently deleted. What you contributed to shared workspaces stays with them. Signing in again within the 30 days cancels the deletion.
• Copies that are not removed at once. Some files on our server are not yet removed automatically: a deleted project's last syncs, files taken out of a knowledge base, the working files and logs of setting up a source's mapping, and the records of the checks Soriela runs on the AI's answers, which quote what they checked and of which only the most recent are kept. Server logs, kept for up to 400 days, can contain parts of synced content when a sync fails. Backups keep deleted data for a time: daily database backups for 7 days, and an occasional snapshot taken before maintenance work until we delete it. Write to info@soriela.com and within one month we delete what is left on our servers, and anything else Soriela holds from your Google account; data in a backup goes when that backup is deleted.

How to revoke Soriela's access

• In Soriela: in a project's Project Configuration, open Project sources, choose Connect source, pick the Google app and choose Disconnect; or remove the connection under Connected accounts on your profile. What each of these deletes is set out above.
• At Google: open myaccount.google.com/permissions (opens in a new tab), select Soriela and remove its access. If you also connected Gmail or Google Chat, Soriela has two entries there, one for Drive and Calendar and one for Gmail and Chat; remove each. Soriela can then no longer read anything from your account, and what it already synced stays in your workspace until it is deleted as described above. A Google account connected to Soriela before 19 October 2026 may still show permissions there that Soriela no longer uses, such as Gmail; removing Soriela's access clears them, and you can then reconnect only what you use.

Most of what this website keeps in your browser is strictly necessary to serve the page and remember your choices, and needs no consent. Measurement does. With your consent, and only then, the site loads two third-party tools:

• Google Analytics (Google) counts visits and which pages are read. It sets the _ga cookies, which last up to two years.
• The OpenAI Ads pixel (OpenAI) tells us whether a visit came from an ad we ran in ChatGPT, and whether that visitor then clicked "Book a demo". It sets the __oppref cookie, which lasts 30 days, and the __obref cookie, which lasts a year. When you click "Book a demo", our server also reports that click to OpenAI, with your IP address, your browser's user agent, the page you clicked on and the pixel's two references, so that it still counts if your browser blocks the pixel. We do not send your name, your email address or anything you typed.

We ask the first time you visit: "Accept all" loads both, "Only necessary" loads neither, and then nothing is sent to Google or OpenAI. You can change your mind at any time with "Cookie settings" at the bottom of every page; withdrawing consent also removes their cookies from this site. Your choice is kept in your browser's local storage, so we do not ask on every page.

The free tools keep two things in your browser's local storage, and only once you start a tool — never on a page view: a random identifier, used together with your IP address to limit each tool to one free run a day, and the reference of a run in progress, so that reloading the page does not lose it. Neither is used for advertising or to follow you to other sites, and you can clear both from your browser at any time.

The site's web fonts are served from soriela.com itself, not by a third party. The free tools send what you upload to app.soriela.com, which is where the Soriela service runs, and so does the demo form, with the address you enter and the click counts described in section 2. The demo form keeps nothing in your browser.

The Soriela product itself uses strictly necessary cookies to keep you signed in. You can block cookies in your browser, but the product will not work without the necessary ones.

We share personal data only with service providers who process it on our behalf, under contract, and only for the purposes above. For the Soriela service they are:

• Amazon Web Services — our servers, database, stored files, logs and backups, in Stockholm, Sweden (AWS region eu-north-1);
• Scaleway — the GPU server Soriela's AI models run on, in Paris, France;
• Nebius — GPU servers the AI falls back to only when the Scaleway server cannot be reached, in Finland;
• Google — delivery of the email Soriela sends, such as reports, alerts and reminders, which can quote project content.

We also use email, calendar and office tools to run our own business, and professional advisers where they need it. On this website, and only if you consent to it, Google (Google Analytics) and OpenAI (for the ads we run in ChatGPT) measure visits and advertising — see section 6.

We may also disclose data where we are legally required to, and to a buyer in the context of a merger or acquisition — in which case this policy continues to apply to the data transferred. Data received through Google APIs is only ever shared on the stricter terms in section 5.

We are based in Europe and prefer processing within the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with additional safeguards where they are needed. You can ask us for a copy of the mechanism used for a specific transfer.

• Documents uploaded to the free tools, and what you typed to describe the project — 30 days, so that the invitation in your email can open them in a Soriela workspace, then deleted automatically. Write to us and we delete them sooner.
• The result a free tool produced, the email address you gave and the record of how the tool was used — up to 24 months. If you ticked the box, your address stays on our mailing list until you unsubscribe.
• Enquiries and demo requests — up to 24 months after our last exchange, unless you ask us to delete them sooner. The click counts behind the demo buttons, which carry no address, are kept for 400 days.
• Customer account and project data — for the life of the agreement. On termination it is deleted or returned within the period set out in the agreement, normally 30 days, unless we must keep it longer by law.
• Security and audit logs — a limited retention period proportionate to the purpose.
• Invoices and accounting records — for the statutory retention period.

Disconnecting a source stops Soriela reading it. Deleting a project deletes what Soriela's database holds for it at once, a deleted workspace is permanently deleted 30 days later, and a deleted account is anonymised 30 days later, while what its owner contributed to shared workspaces stays with them. Section 5 sets this out in detail for Google sources. Other sources are deleted the same way, and the copies section 5 lists as not removed at once — files on our server, server logs and backups — exist for them too.

Connections to your tools are scoped, and you can revoke them at any time from the source system or from Soriela. Data is encrypted in transit, our database is encrypted at rest, and the credentials that connect your tools are encrypted again by Soriela. Access inside Soriela is limited to the people who need it, and administrative actions are logged. Single-tenant, self-hosted and air-gapped deployments are available so that project data need never leave your own environment — see the security page for what is offered today.

If a personal data breach occurs, we notify the supervisory authority and affected customers as required by Art. 33 and 34 GDPR.

If you are in the EEA or the UK you have the right to:

• access the personal data we hold about you, and receive a copy;
• have inaccurate data corrected;
• have data erased, where the grounds in Art. 17 apply;
• restrict or object to processing based on legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, without affecting processing already carried out;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects — Soriela's outputs are decision support for a person, not automated decisions of that kind.

Write to info@soriela.com and we will respond within one month. If Soriela holds your data on behalf of a customer, send your request to that customer and we will support them in answering it.

You can also complain to a supervisory authority — ours is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (opens in a new tab), and you may instead go to the authority where you live or work.

Soriela is a business product. It is not directed at children and we do not knowingly collect data from anyone under 16.

We update this policy when what we do changes. The date at the top is the version in force. Where a change materially affects you, we will tell customers directly rather than relying on you to re-read the page.

Questions, requests and complaints about this policy: info@soriela.com.