Privacy Notice

Last updated: 25 October 2026

This notice covers Credit Sorted Pipeline: this website, the demo, and the hosted app at app.creditsorted.co.uk. It explains what personal data is held, why, and the rights people have under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Credit Sorted is operated as a sole trader by Mustafa Alsoodany, trading address 122 Portswood Road, Southampton, SO17 2FW. For any privacy question, email hello@creditsorted.co.uk.

2. Two different roles

For advisers and firms that use the app, we are the controller of the account details we need to run it: who can sign in, and to which firm.

For the clients a firm records in the app, the firm is the controller and we are its processor. We hold those records only to provide the service, on the firm's instructions, under a data processing agreement. If you are a client of a mortgage firm and have a question about your record, contact that firm first; they decide what is kept and for how long. We will help them answer you.

3. What we hold about advisers, and why

• Name and work email address, and the firm you belong to, so you can sign in and your colleagues can see who did what. Lawful basis: performing our contract with your firm.
• Sign-in links and sessions, so you stay signed in. Lawful basis: contract.
• The firm's name, branding, seat count and billing status, to run and invoice the account. Lawful basis: contract, and our legal obligation to keep business records.
• Anything you email us, to answer it. Lawful basis: our legitimate interest in supporting customers.

4. What the app does not do

It runs no credit searches, connects to no credit reference agency, and holds no bank credentials, account numbers, card details or identity documents. We do not sell personal data, use it for advertising, or analyse firms' client records for any purpose of our own.

5. Cookies and tracking

This website sets no cookies of its own and loads no analytics or advertising trackers. The hosted app sets one strictly necessary cookie, which keeps you signed in. It cannot be read by page scripts and is deleted from our server when you sign out. The app also keeps a working copy of the firm's records in your browser's storage so it works offline.

6. Who else processes data

Both may process data outside the UK, including in the United States. Where they do, the transfer is covered by an approved safeguard such as the UK International Data Transfer Addendum or the UK Extension to the EU–US Data Privacy Framework.

7. How long we keep it

• Sign-in links: 15 minutes, single use.
• Sessions: 30 days, or until you sign out or are deactivated.
• Invitations: 7 days, or until cancelled.
• Fault logs: 30 days, holding no personal data.
• Adviser and client records: while the firm is a customer. When an account ends, everything is deleted within 30 days.
• A client the firm deletes is erased at once. A marker holding only an id and a date is kept for 180 days so the firm's other devices learn of the deletion.

8. How it is protected

Everything travels over HTTPS. There are no passwords: advisers sign in by a single-use email link that expires after 15 minutes. Every request is limited to the signed-in adviser's own firm. Data at rest is encrypted by Cloudflare.

9. Your rights

You can ask to access, correct or erase your data, restrict or object to its use, or receive it in a portable format. Advisers can email us. Clients of a firm should ask the firm, which can do all of this in the app directly. We reply within one month.

10. Complaints

Please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

11. Changes

If this notice changes, the new version will be posted here with a new date, and account owners will be told by email of any material change.

See also the Terms of Service.