Effective 11 September 2026
SOREG LTD (“Soreg”, “we”, “us”), a Delaware corporation, operates soreg.ai. This policy explains what we collect through this website, why, and what you can do about it.
This policy covers the soreg.ai website only. It does not cover the Soreg product. Soreg is deployed inside our customers’ own environments, and personal data processed there is governed by our agreement with that customer, under which we act as a processor rather than a controller. See “The product is separate” below.
Information you give us. If you submit the sample-report form, we collect your full name, work email address, and company. You may also provide your job title and organisation size, which are optional. You must select which regulatory framework applies to you, so that we can send the matching sample report. We also record which page you submitted from, so that we know which part of the site prompted the request.
If you tick the box asking to hear from us more generally, we record that you did.
If you email us at hello@soreg.ai or early-access@soreg.ai, we receive whatever you put in that email.
If you book a call, you provide your name, email, and a chosen time to our scheduling provider.
Information collected automatically. The Soreg website sets no cookies, carries no advertising trackers, loads no third-party fonts, and stores nothing in your browser. That is why you are not asked to accept anything when you arrive: there is nothing kept on your device to consent to.
We do count traffic. We use Cloudflare Web Analytics, which records page views and the site you arrived from, in aggregate. It is cookieless — it stores nothing on your device, does not follow you to other websites, and does not build a profile of you. Cloudflare receives the IP address of the request in the course of producing those counts. We use the result to see which parts of the site people find useful, and for nothing else.
Our hosting provider processes standard server request data, including IP addresses, as a necessary part of serving the site and protecting it from abuse.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under the CCPA as amended, we have not sold or shared personal information in the preceding twelve months. We do not use personal information for automated decision-making or profiling.
We use these service providers:
HubSpot — our customer relationship management system. Form submissions are sent there, which is where your name, email, company, job title, organisation size, and selected framework are stored.
Calendly — our scheduling tool. Calendly loads only when you choose to open the booking window; it is not loaded when you simply browse the site. If you open it, Calendly receives your IP address and browser information and sets its own cookies, and if you book, it receives the details you enter.
Cloudflare — our website analytics provider. Cloudflare Web Analytics counts page views without cookies and without tracking you across other sites. It receives the IP address of requests to this site in order to produce those counts.
Microsoft — Azure Static Web Apps hosts this website. Microsoft 365 hosts our business email, so if you write to us, your message and address are held there.
We may also disclose information where legally required, or to establish or defend legal claims.
Where the GDPR or UK GDPR applies, we rely on:
Legitimate interests (Art. 6(1)(f)) — to respond to your request for a sample report, to follow up about that request, to operate a secure website, and to measure in aggregate how the site is used. You may object at any time.
Consent (Art. 6(1)(a)) — for marketing that goes beyond the sample report you asked for. We ask for this separately on the form, by an unticked box, and you can withdraw it at any time through the unsubscribe link in any such email or by emailing us. Withdrawing consent does not affect anything we sent before you withdrew it, and it does not stop us replying to something you asked us about.
Lead records: 24 months from your last interaction with us, after which they are deleted — unless you have become a customer, or we need to keep them to comply with a legal obligation or to defend a legal claim.
Email correspondence is kept for as long as needed to deal with the matter and for a reasonable period afterwards. Marketing consent records are kept for as long as we rely on the consent, and for a reasonable period after withdrawal so that we can demonstrate we honoured it.
If you are in the EU, UK, or a comparable jurisdiction, you have the right to access your personal data, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. You may also complain to your local supervisory authority, and we would appreciate the chance to address it first.
If you are a California resident, you have the right to know what personal information we collect and how we use it, to delete it, to correct it, and to opt out of sale or sharing — though as stated above we do neither. We will not discriminate against you for exercising these rights. You may use an authorised agent.
Residents of Virginia, Colorado, Connecticut, Utah, and other US states with comparable laws have broadly equivalent rights.
To exercise any of these, email privacy@soreg.ai. We respond within the time the applicable law requires — 45 days under the California and comparable US state laws, one month under the GDPR. We may need to verify your identity first, which for a request of this kind usually means confirming that you control the email address concerned. If we refuse a request we will tell you why, and how to challenge it.
We are in the United States, and our service providers process data there. If you are outside the US, your information will be transferred there.
Where the GDPR or UK GDPR applies, we rely on the European Commission’s Standard Contractual Clauses — with the UK Addendum where relevant — incorporated into our agreements with HubSpot, Calendly, Cloudflare, and Microsoft.
We are in the process of appointing a representative in the European Union and the United Kingdom under Article 27. Until that appointment is complete, please direct any request or complaint to privacy@soreg.ai, which we monitor and which reaches us directly.
Nothing in this policy describes what the Soreg product does with data inside a customer’s systems. The Soreg gateway runs within the customer’s own environment; personal data flowing through it stays there, and we do not receive it. Where we process personal data on a customer’s behalf, we do so as a processor under that customer’s instructions, governed by a data processing agreement rather than by this policy.
We take reasonable technical and organisational measures to protect the information we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. To report a security issue, email security@soreg.ai.
This site is aimed at businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children.
We may update this policy. If we make a material change we will update the effective date above, and where the change is significant we will take reasonable steps to notify you.