Your answers are not stored.
The short version: you can use the compliance checker without an account, and we do not keep your answers. This page explains what happens with the data that does pass through, how we store it, and for how long.
The checker
When you answer the questions, your answers are sent to our server, used to generate your report, and then discarded. We do not save them, and there is no account or profile attached to them. Refreshing the page loses the report, because there is nothing stored to load.
If you ask us to email you your report
If you enter your email address and tick the box to receive your compliance report, we generate it on our server and send it to you through our email provider, Resend (a US-based processor). Your email address and the fact that you consented are shared with Resend for that purpose only. Resend's standard contractual clauses cover the international transfer.
Signing up for occasional UK compliance updates is a separate choice, a second checkbox, unticked by default, that you tick only if you want it. Only if you tick it do we add your email address to our contact list within Resend, tagged with a source label (such as "report\_email") so we can send relevant updates. We keep your contact details until you unsubscribe or ask us to remove them. You can unsubscribe from any email, or write to us at any time to be removed entirely.
The director ID verification tool
Looking up a company sends the company number, or your search text, to the public Companies House register, which returns public information about that company, including its directors' names and whether each has completed identity verification. That is public register data about the company and its directors, not personal data about you, the person doing the lookup.
If a deadline is still outstanding and you choose to be notified about it (and other relevant compliance deadlines) in future, we add your email address to our contact list on the same consent basis as above (tagged with source "checklist\_deadlines" or "idv\_notify"). No email or calendar file is sent to you immediately, notification happens later, and you can unsubscribe or ask to be removed at any time.
The company setup checklist
If you use our company setup checklist at /start/, we store the information you provide: your chosen company name, your email address, whether you have a business website (and its address, if so), and which steps you have completed. If you verify your company with Companies House, we also store your company number and the registered name returned by Companies House, which replaces the company name you originally typed. If you run the compliance check from within the checklist, we also store your answers and which results you have marked as sorted, so you can leave and come back to the same results without starting over. This data is kept so you can resume your checklist later: we email you a link.
It is stored on Supabase, a cloud database provider (hosted in the EU, eu-central-1 region). Supabase is a data processor acting on our instructions; the data is accessible only to our backend servers, not to other users. We keep checklist data for 12 months from your last activity, after which it is deleted. You can ask us to delete it sooner at any time.
If you tick the optional box to receive UK compliance updates, we also add your email to our Resend contact list with the source "startflow" so we can send relevant updates.
When you return to your checklist, we set a small functional cookie (gs\_start\_token) so your browser remembers your place. It stores a random identifier, no personal data, and expires after 30 days. It is strictly necessary for the checklist to function and is not used for tracking or advertising.
Who processes your data
We work with the following data processors:
- Vercel (US) — hosts our website and API. Request logs including IP addresses are retained by Vercel for error diagnosis and may contain technical data from your visits. We do not log your answers or personal data in application logs.
- Supabase (EU, eu-central-1) — stores your company setup checklist data, as described above, on our instructions.
- Resend (US) — delivers emails and stores contact details when you opt in to updates. International transfers are covered by standard contractual clauses.
- Ahrefs Analytics — cookieless page-view counting, no personal data stored.
- Umami — cookieless product analytics, no personal data stored.
Partner links
Some actions in your report link to partner services, such as insurance or software. Those links carry a short, non-identifying reference to the regulation they came from, so the partner network can credit us with a commission if you buy. The reference does not identify you. Clicking one briefly passes through a page on getsorted.today before continuing to the partner, so the link stays working even if the partner changes their web address.
Cookies and analytics
We do not set advertising or profiling cookies, and we do not track you across sites.
We use Ahrefs Analytics, a cookieless service, to count page views in aggregate. It sets no cookies, stores nothing on your device, and never sees your answers. Your IP address is processed transiently to produce anonymous statistics and is not kept.
We also use Umami, another cookieless analytics service, to record anonymous product usage, such as how many people start the checker, how far they get, and which partner links are clicked. It sets no cookies and does not identify you; it cannot be linked back to your answers or your report.
Our company setup checklist uses a strictly necessary functional cookie (gs\_start\_token) to remember your place. It stores only a random identifier, expires after 30 days, and is not used for tracking. You can delete it from your browser settings at any time.
How long we keep data
- Checklist data (Supabase): 12 months from your last activity, or until you ask us to delete it.
- Email contacts (Resend): until you unsubscribe or ask us to remove you.
- Compliance check answers: not stored when you use the standalone checker at /checker/, discarded immediately after generating your report. If you run the check from inside the /start/ checklist, your answers and sorted-status are stored as checklist data (see above), same 12-month retention.
- Analytics data (Ahrefs, Umami): anonymised and aggregated, retention governed by each provider's own policy.
Your rights
You have the right to access, correct, or delete any personal data we hold about you. If you have given us your email address (for a report, a reminder, or a checklist) and you want it removed, write to hello@getsorted.today and we will remove it from all systems. Compliance check answers from the standalone checker at /checker/ are not stored, so there is nothing to show or delete for those; answers from a compliance check run inside a /start/ checklist are deleted along with the rest of that checklist's data.
You also have the right to complain to the ICO if you believe we have mishandled your data. We hope you would talk to us first.
International transfers
Some of our processors are based in the United States (Vercel, Resend). Where personal data is transferred outside the UK, we rely on standard contractual clauses or the processor's UK-specific data processing agreement as the lawful safeguard.
Who is responsible
The data controller is XGR Labs Ltd, a company registered in England and Wales, company number 17107452. Contact: hello@getsorted.today.
Last updated: July 2026