Privacy — Home of Sortie

Privacy Policy

Effective date: 13 May 2026
Type of application: Grocery price comparison, list building, and retail media app

The Sortie app, available at www.sortie.nz (the "App"), is owned and operated by Sortie Limited. Sortie Limited is the data controller and can be contacted at:

hello@sortie.nz
021 190 0113
Flat 1, 41b Church Street, Devonport, Auckland

Purpose

The purpose of this privacy policy (this "Privacy Policy") is to inform users of our App of the following:

```
The personal data we will collect;
```
```
Use of collected data;
```

Who has access to the data collected; and

```
The rights of App users.
```

This Privacy Policy applies in addition to the terms and conditions of our App.

GDPR

For users in the European Union, we adhere to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation (the "GDPR"). For users in the United Kingdom, we adhere to the GDPR as enshrined in the Data Protection Act 2018.

We have not appointed a Data Protection Officer as we do not fall within the categories of controllers and processors required to appoint a Data Protection Officer under Article 37 of the GDPR.

New Zealand Privacy Act 2020

For users in New Zealand, we comply with the Privacy Act 2020 (NZ), which governs the collection, use, storage, and disclosure of personal information. The Privacy Act 2020 replaced the Privacy Act 1993 and introduced stronger obligations for organisations handling personal information.

Under the Privacy Act 2020, you have the right to request access to, and correction of, any personal information we hold about you. You may also lodge a complaint with the Office of the Privacy Commissioner (OPC) if you believe we have interfered with your privacy. Contact details for the OPC are provided in the Complaints section of this Privacy Policy.

Consent

By using our App users agree that they consent to:

The conditions set out in this Privacy Policy.

When the legal basis for us processing your personal data is that you have provided your consent to that processing, you may withdraw your consent at any time. If you withdraw your consent, it will not make processing which we completed before you withdrew your consent unlawful.

You can withdraw your consent by contacting our privacy officer at privacyofficer@sortie.nz or by submitting a request through the account settings in the App.

Legal Basis for Processing

We collect and process personal data about users in the EU only when we have a legal basis for doing so under Article 6 of the GDPR.

We rely on the following legal basis to collect and process the personal data of users in the EU:

Users have provided their consent to the processing of their data for one or more specific purposes.

Personal Data We Collect

We only collect data that helps us achieve the purpose set out in this Privacy Policy. We will not collect any additional data beyond the data listed below without notifying you first.

If you choose not to provide us with the personal data listed below, or if we are unable to collect that data, we may not be able to provide you with certain services or information, or may not be able to carry out an activity you have requested.

Data Collected Automatically

When you use our App, we may automatically collect and store the following information:

```
IP address;
```
```
Device type and operating system;
```

Browser type and version (if accessing via a web browser);

Screens visited and time spent on those screens; and

```
Referring URL or referring application.
```

This data is collected via cookies and similar technologies. Please refer to the Cookies section below for further detail.

Data Collected in a Non-Automatic Way

We may also collect the following data when you perform certain functions on our App:

```
Email address;
```
```
Grocery items listed;
```
```
Receipts;
```

Receipt images captured via your device camera;

Household-level purchase history and spending patterns (derived from receipt data you provide); and

Interactions with sponsored content and smart swap recommendations, including whether you accepted or dismissed a recommendation.

This data may be collected using the following methods:

Provided directly by the user when creating an account or adding items to their grocery list; and

Via camera image taken by the user to capture receipts.

Device Permissions

Our App may request access to the following features of your device:

Camera

We request access to your device camera solely to allow you to photograph receipts for upload. We do not access your camera at any other time or for any other purpose.

Push Notifications

We may request permission to send push notifications to your device. These notifications may include reminders, account updates, and, where you have consented, promotional messages. You can disable push notifications at any time through your device settings. Disabling notifications will not affect your ability to use the core features of the App.

Location

We do not request or collect your location data. The App does not use GPS, network-based location, or any other location service.

Cookies

A cookie is a small file stored on your device. Our App may use cookies or similar technologies (such as local device storage) when accessed via a web browser, and may use mobile identifiers when accessed via a mobile device. We use these technologies to maintain session state, remember user preferences, and collect anonymous usage analytics. We do not use cookies for targeted advertising.

You can control cookies through your browser settings, or reset mobile advertising identifiers through your device settings. Disabling these technologies may limit certain functionality of the App. By continuing to use our App, you consent to our use of these technologies as described in this Privacy Policy.

How We Use Personal Data

Data collected on our App will only be used for the purposes specified in this Privacy Policy or indicated on the relevant screens of our App. We will not use your data beyond what we disclose in this Privacy Policy.

The data we collect when the user performs certain functions may be used for the following purposes:

To classify and sort grocery list items;

To process receipt data using AI services to extract and categorise items and spending;

To provide insights to users on spending trends;

To display relevant sponsored content and advertisements within the App, based on your grocery list activity and the category or subcategory you are browsing (see Advertising and Retail Media section below);

To generate aggregated, de-identified commercial insights that may be shared with FMCG brand partners (see Data Insights and Brand Reporting section below); and

To communicate with users about their account, including service notifications and, where consent has been given, marketing emails.

Advertising and Retail Media

The App includes a retail media platform through which FMCG brands may display sponsored content, product recommendations, and advertisements to users. This advertising is served based on contextual signals, specifically the grocery categories and subcategories you are actively browsing or shopping within. For example, if you are viewing the Honey category, you may see a sponsored product from a honey brand.

We do not use cross-site tracking, third-party cookies, or behavioural profiling to serve advertising. All ad targeting is based on in-app, first-party contextual signals only.

We may also display smart swap recommendations, which suggest alternative or sponsored products that are relevant to items on your list. Your response to these recommendations (for example, whether you accepted or dismissed a suggestion) is recorded and may be used to improve recommendation quality and to provide performance reporting to brand partners in aggregated form.

If you do not wish to see sponsored content, you may contact our privacy officer to discuss your options. Core App functionality is not conditional on your engagement with advertising.

Data Insights and Brand Reporting

A core part of Sortie's commercial model involves providing FMCG brands and other commercial partners with aggregated, de-identified insights derived from user grocery and purchasing data. This may include, for example, category-level purchase frequency, brand preference trends, and household spending patterns.

We want to be clear about what this means for your data:

Data shared with commercial partners is always aggregated and de-identified. We do not share individual user profiles, personally identifiable information, or household-level data that could identify you.

We do not sell your personal data to third parties.

Insights products are derived from the collective behaviour of our user base and are intended to inform brand and category strategy, not to target or profile individual users.

If you have questions about how your data contributes to these insights, please contact our privacy officer.

International Data Transfers

Sortie Limited is based in New Zealand. However, some of the third-party service providers we use to operate the App, including cloud hosting and AI services, may store and process your data on servers located outside New Zealand, including in the United States and other jurisdictions.

Where your data is transferred outside New Zealand, we take reasonable steps to ensure it receives an appropriate level of protection, consistent with the requirements of the Privacy Act 2020 and, where applicable, the GDPR. This includes relying on contractual safeguards with our service providers.

By using the App, you consent to your personal data being transferred to and processed in countries outside New Zealand as described in this Privacy Policy.

Who We Share Personal Data With

Employees

We may disclose user data to any member of our organisation who reasonably needs access to user data to achieve the purposes set out in this Privacy Policy.

Third-Party Service Providers

We may share personal data with trusted third-party service providers who assist us in operating the App and delivering our services, including cloud hosting, analytics, and crash reporting providers. These providers are contractually required to handle your data securely and only for the purposes we specify.

Artificial Intelligence Services: Google Gemini

Our App uses Google Gemini, an artificial intelligence service provided by Google LLC, to process receipt images and grocery data. When you scan a receipt, the image or extracted data may be transmitted to Google Gemini for analysis. Google LLC processes this data in accordance with its own privacy policy, available at https://policies.google.com/privacy. We do not use AI-processed data for any purpose beyond those set out in this Privacy Policy. You should be aware that data shared with Google Gemini may be processed on servers outside New Zealand.

FMCG Brand Partners

We may share aggregated, de-identified insights with FMCG brands and commercial partners as described in the Data Insights and Brand Reporting section above. No personally identifiable information is shared with brand partners.

App Distribution Platforms

The App is distributed via the Apple App Store and Google Play Store. Apple Inc. and Google LLC operate these platforms and collect their own data independently when you download and use apps through their stores. This data collection is governed by Apple's Privacy Policy (https://www.apple.com/legal/privacy) and Google's Privacy Policy (https://policies.google.com/privacy) respectively. Sortie Limited has no control over the data collected by these platforms.

Other Disclosures

We will not sell or share your data with other third parties, except in the following cases:

```
If the law requires it;
```

If it is required for any legal proceeding;

To prove or protect our legal rights; and

To buyers or potential buyers of this company in the event that we seek to sell the company.

If you follow links from our App to another website or application, please note that we are not responsible for and have no control over their privacy policies and practices.

How Long We Store Personal Data

User data will be stored until the purpose for which the data was collected has been achieved, or until the user requests deletion of their data.

Receipt images are retained for no longer than 12 months from the date of upload, after which they are permanently deleted. Derived transaction data (such as categorised spending records) may be retained for longer to support spending insights features, but receipt images themselves are not kept beyond this period.

You will be notified if your data is kept for longer than the periods described above.

Account Deletion

You may request deletion of your account and all associated personal data at any time by contacting our privacy officer at privacyofficer@sortie.nz or through the account settings in the App.

Upon receiving a valid deletion request, we will delete your personal data within 30 days, except where we are required by law to retain certain information for a longer period. Where retention is required, we will inform you of the reason and the applicable retention period. Data shared with third-party service providers will be subject to those providers' deletion timelines in accordance with their contractual obligations to us.

How We Protect Your Personal Data

To protect your data, we use industry-standard encryption for all mobile communications and store receipt information in secure cloud environments. Access is strictly limited to authorised personnel bound by confidentiality agreements, and we prioritise secure login procedures. Our practices are designed to comply with the New Zealand Privacy Act 2020.

While we take all reasonable precautions to ensure that user data is secure and that users are protected, there always remains the risk of harm. The internet as a whole can be insecure at times and therefore we are unable to guarantee the security of user data beyond what is reasonably practical.

Privacy Breach Notification

Under the Privacy Act 2020, we are required to notify the Office of the Privacy Commissioner and affected individuals if a privacy breach occurs that is likely to cause serious harm. In the event of such a breach, we will notify affected users as soon as reasonably practicable, providing details of the nature of the breach, the information affected, and the steps we are taking in response.

If you believe a privacy breach involving your personal data has occurred, please contact our privacy officer immediately at privacyofficer@sortie.nz.

Your Rights as a User

Rights Under the GDPR (EU/UK Users)

Under the GDPR, you have the following rights:

```
Right to be informed;
```
```
Right of access;
```
```
Right to rectification;
```
```
Right to erasure;
```
```
Right to restrict processing;
```
```
Right to data portability; and
```
```
Right to object.
```

Rights Under the NZ Privacy Act 2020 (New Zealand Users)

Under the Privacy Act 2020, you have the right to:

Request access to personal information we hold about you;

Request correction of personal information that you believe is incorrect, out of date, incomplete, misleading, or obtained in breach of the Privacy Act; and

Lodge a complaint with the Office of the Privacy Commissioner if you believe we have interfered with your privacy.

Children

We do not knowingly collect or use personal data from children under 16 years of age. If we learn that we have collected personal data from a child under 16 years of age, the personal data will be deleted as soon as possible. If a child under 16 years of age has provided us with personal data, their parent or guardian may contact our privacy officer.

How to Access, Modify, Delete, or Challenge the Data Collected

If you would like to know if we have collected your personal data, how we have used your personal data, if we have disclosed your personal data and to whom, if you would like your data to be deleted or modified in any way, or if you would like to exercise any of your other rights under the GDPR or the Privacy Act 2020, please contact our privacy officer here:

Privacy Officer at Sortie
privacyofficer@sortie.nz
021 190 0113
Flat 1, 41b Church Street, Devonport, Auckland

Do Not Track Notice

Do Not Track ("DNT") is a privacy preference that you can set in certain web browsers. While our App is a mobile application, we do not track users across third-party websites or applications and do not respond to DNT signals.

How to Opt-Out of Data Collection, Use or Disclosure

In addition to the method(s) described in the How to Access, Modify, Delete, or Challenge the Data Collected section, we provide the following specific opt-out methods:

You can opt-out of marketing emails by not accepting this during account creation, or at any time by contacting our privacy officer or using the unsubscribe link in any marketing email.

You can opt-out of push notifications at any time through your device settings.

You can opt-out of AI processing of your receipt data by not using the receipt scanning feature of the App.

You can opt-out of seeing sponsored content and advertising by contacting our privacy officer at privacyofficer@sortie.nz.

Modifications

This Privacy Policy may be amended from time to time in order to maintain compliance with the law and to reflect any changes to our data collection process. When we amend this Privacy Policy we will update the "Effective Date" at the top of this Privacy Policy. We recommend that our users periodically review our Privacy Policy to ensure that they are notified of any updates. If necessary, we may notify users by email of changes to this Privacy Policy.

Complaints

If you have any complaints about how we process your personal data, please contact us through the contact methods listed in the Contact Information section so that we can, where possible, resolve the issue. If you feel we have not addressed your concern in a satisfactory manner you may contact a supervisory authority.

For New Zealand users, you have the right to lodge a complaint directly with the Office of the Privacy Commissioner (OPC):

Office of the Privacy Commissioner
www.privacy.org.nz
0800 803 909

For EU users, you have the right to lodge a complaint with your local data protection supervisory authority.

Contact Information

If you have any questions, concerns or complaints, you can contact our privacy officer at:

privacyofficer@sortie.nz
021 190 0113
Flat 1, 41b Church Street, Devonport, Auckland