Sorbaix

Privacy

Last updated on

Sorbaix LLC (“Sorbaix,” “we,” “us,” or “our”) is a Minnesota limited liability company. We are a business and technology consulting firm, and this policy explains what personal information we collect through this website and our email newsletter, why we collect it, who we share it with, and what you can do about it.

We have tried to write this in plain language rather than legalese. If anything here is unclear, email us at privacy@sorbaix.com and we will explain further.

The short version

  • We collect your name and email address if you subscribe to our newsletter, and whatever you choose to tell us if you contact us about our services.
  • We do not collect your postal address, and we do not ask for it.
  • We do not sell your personal information. We have never sold it, and will not in the future.
  • We do not share your information with advertisers or data brokers, and we do not allow anyone to use our site to build advertising profiles of you.
  • You can unsubscribe from our newsletter at any time, using the link in every email we send.
  • You can ask us to show you, correct, or delete what we hold about you, by emailing privacy@sorbaix.com.

The rest of this policy is the detail behind those statements.

Who and what this policy covers

This policy applies to personal information we collect through:

  • this website;
  • our email newsletter;
  • inquiries you send us about our services, whether through a form on this site or by email; and
  • our ordinary business communications with current and prospective clients.

It does not apply to information we process on behalf of a client as part of a consulting engagement. When we handle data inside a client’s own systems, that client is responsible for it and their privacy policy governs it; our obligations to them are set out in our engagement agreement and, where applicable, a data processing agreement.

It also does not apply to information we collect from employees, contractors, or job applicants in that capacity.

Information we collect

Information you give us

Newsletter subscription. Your name and email address. Our newsletter uses a double opt-in: after you submit the form, we email you a confirmation link, and we do not add you to the list until you click it. We record the fact and timestamp of that confirmation so we can demonstrate you consented.

Inquiries and correspondence. If you contact us about our services, we receive whatever you choose to include — typically your name, email address, company, and role, along with the content of your message. Please do not send us confidential or sensitive information in an initial inquiry.

Client engagement information. If you become a client, we process the business contact and billing information necessary to perform and invoice the engagement. Payments are handled by a third-party payment processor; we do not store full payment card numbers on our systems.

Information collected automatically

Server logs. Our hosting provider records standard web request information, including visitor IP address, browser and device type, pages requested, and the referring page. This is a normal part of serving a website and is used for delivery, security, and troubleshooting.

Analytics. We use website analytics to understand which pages are read and how people find us, so we can write better material. We do not sell advertising on this site, we do not run behavioral advertising anywhere, and we do not use analytics or advertising networks that build cross-site profiles of you.

Spam protection. Our contact form uses Cloudflare Turnstile to distinguish real visitors from automated abuse. Turnstile examines browser characteristics and how the page is being interacted with, and sends that signal along with your IP address to Cloudflare, which returns a pass or fail verdict to us. Cloudflare states that Turnstile does not use this data for advertising or ad targeting, and does not sell it. Cloudflare already hosts this site, so no additional company receives your information as a result.

Cookies. We use only the cookies necessary to operate the site and remember basic preferences. We do not set advertising cookies, we do not use third-party tracking cookies, and we do not permit third parties to use this site to build advertising profiles of you. Most browsers let you block or delete cookies; the site will still work if you do.

Information we do not collect

We do not collect Social Security numbers, government identification numbers, precise geolocation, biometric data, or any of the categories treated as “sensitive personal information” under state privacy laws. This website has no user accounts, so we do not collect or store usernames or passwords.

How we use information

We use personal information to:

  • send you our newsletter, if you have confirmed your subscription;
  • respond to your inquiries and communicate with you about our services;
  • deliver, invoice for, and support consulting engagements;
  • understand how our site is used, in the aggregate, so we can improve it;
  • keep the site and our systems secure and prevent abuse; and
  • comply with law and establish or defend legal claims.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

Our email newsletter

We think this deserves its own section, because it is the main reason we hold anyone’s information.

  • We add you to the list only after you confirm through the double opt-in email.
  • We use the list to send our newsletter and occasional notices about our own work. That is all.
  • We do not rent, sell, trade, or lend the list, and we do not send messages on behalf of third parties.
  • Every email includes an unsubscribe link. Unsubscribing takes effect immediately and requires no explanation.
  • Our newsletter system is built and operated by us. The subscriber list lives in our own infrastructure and is not maintained inside a third-party marketing platform.
  • We use Resend to deliver the messages, which means your email address is transmitted to Resend for the purpose of sending. Resend acts as our service provider and is not permitted to use your information for its own purposes.
  • Our emails may record whether a message was delivered and opened, so we can tell whether the newsletter is working and can remove addresses that consistently bounce. We do not use this to build a profile of you.

When we disclose information

We disclose personal information only in these circumstances:

Service providers. Companies that perform functions on our behalf and may process your information only on our instructions. Today these are, in the main:

  • Cloudflare for website hosting and delivery: processing request logs including IP addresses, and Turnstile spam protection on our contact form;
  • Resend for sending our newsletter and transactional email;
  • our analytics provider, payment processor, and ordinary business tools such as email and document storage.

Legal and safety. When we are required to by law, subpoena, or other legal process, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of Sorbaix, our clients, or the public.

Business transfer. If Sorbaix is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you and this policy will continue to apply to the transferred information unless and until you are told otherwise.

With your direction. When you ask us to share something, or agree to it.

We do not sell or share your information

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws. We have not done so in the twelve months preceding the effective date of this policy, and we do not intend to. We also do not disclose personal information to third parties for their own direct marketing purposes.

How long we keep information

  • Newsletter subscribers — until you unsubscribe. After you unsubscribe we retain a minimal suppression record (your email address and the fact you opted out) so we do not accidentally email you again.
  • Inquiries that do not become engagements — generally up to two years, so we have context if you come back to us.
  • Client engagement records — for the duration of the engagement and afterward as needed for our legal, tax, and professional obligations, typically seven years.
  • Server logs and analytics — for a short period, generally no more than twelve months.

We delete or de-identify information when we no longer have a business or legal reason to keep it.

How we protect information

We use reasonable administrative and technical measures appropriate to a firm of our size, including encryption in transit, access controls, and limiting access to the people who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your choices and rights

Wherever you live, you may ask us to:

  • tell you what personal information we hold about you;
  • give you a copy of it;
  • correct it if it is wrong;
  • delete it; and
  • stop emailing you, at any time.

To make a request, email privacy@sorbaix.com. We will respond within the time the law requires, and within 45 days at the latest. We may need to verify your identity before acting — usually by confirming you control the email address associated with the information. You may use an authorized agent where the law allows it.

We will not discriminate against you for exercising any of these rights. We do not offer financial incentives in exchange for personal information; if that ever changes, we will disclose the terms before you participate.

Additional information for California residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), requires certain businesses to provide additional detail to California residents. We may not currently meet the CCPA’s applicability thresholds, but we provide this information voluntarily, and we extend the same rights described above to everyone regardless of where they live.

Notice at collection

In the twelve months preceding the effective date of this policy, we have collected the following categories of personal information. For each, we identify why we use it and who we disclose it to. We do not sell or share any of it.

Identifiers and contact information such as your name, email address, and any phone number you choose to give us.
Why: to send the newsletter, respond to you, provide our services, secure our systems, and comply with law.
Disclosed to: service providers; recipients required by law.
Sold or shared: No.

Professional or employment information such as your company, industry, and job title, where you choose to provide it.
Why: to respond to you and provide our services.
Disclosed to: service providers; recipients required by law.
Sold or shared: No.

Commercial and customer service interaction information the content of the inquiries and messages you send us.
Why: to respond to you, provide our services, and improve what we offer.
Disclosed to: service providers; recipients required by law.
Sold or shared: No.

Internet and network activity information such as IP address, browser and device type, pages viewed, and referring page.
Why: to deliver and secure the site, and to understand site usage in the aggregate.
Disclosed to: service providers; recipients required by law.
Sold or shared: No.

We do not collect or process sensitive personal information as the CCPA defines it, so there is nothing for you to limit under the CCPA’s right to limit the use of sensitive personal information. For retention, see “How long we keep information” above. To exercise any CCPA right, see “Your choices and rights” above.

Shine the Light

California’s “Shine the Light” law gives California residents the right, in certain circumstances, to request information about how we disclose personal information to third parties for those third parties’ own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Residents of other states

Several states (including Minnesota, where we are formed, as well as Colorado, Connecticut, Oregon, Texas, Virginia, and others) give residents rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. We do not engage in targeted advertising, sale of personal information, or profiling that produces legal or similarly significant effects.

We extend the access, correction, deletion, and portability rights described above to residents of every state, whether or not the relevant law applies to a firm our size. If we deny a request, you may appeal by replying to our response; if we deny your appeal, you may contact your state attorney general.

If you are in the European Economic Area or the United Kingdom

Our legal bases for processing are:

  • Consent, for the newsletter. You may withdraw consent at any time by unsubscribing, without affecting processing that already happened.
  • Legitimate interests, for responding to inquiries, securing our site, and understanding aggregate site usage.
  • Performance of a contract, for delivering and invoicing consulting engagements.
  • Legal obligation, where we are required to retain or disclose information.

You also have the right to object to processing based on legitimate interests, to request restriction of processing, and to lodge a complaint with your local supervisory authority.

Sorbaix is based in the United States, and our service providers are primarily located there, so information you give us is processed in the United States. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards, including the European Commission’s standard contractual clauses.

Children’s privacy

This site is intended for a professional audience. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email privacy@sorbaix.com and we will delete it.

Our site and newsletter may link to sites we do not operate. We are not responsible for their content or privacy practices, and this policy does not apply to them. Read their policies before giving them information.

Changes to this policy

We may update this policy as our practices or the law change. When we do, we will revise the “Last updated” date shown at the top of this page. If a change is material (for example, if we begin collecting a new category of information) we will give affected subscribers notice by email before it takes effect. Continuing to use the site after an update means you accept the revised policy.

Contact us

Questions, requests, or complaints about this policy or your personal information:

Sorbaix LLC
4455 Village Lake Dr SE #126
Prior Lake, MN 55372
Minnesota, United States
privacy@sorbaix.com

We read every message sent to that address.