Privacy, terms and data handling.

Privacy policy

Last updated 22 October 2026

1. Who we are

NoSort is a trading name of Neurosia Limited, Business Registration No. 78674598, Unit B, 11/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong. We are the controller of personal data collected through this website. For data inside client documents, we act as a processor for the client, as described in section 16.

You can reach us at hello@nosort.com.

2. What we collect

• Contact details you submit: name, work email, company, phone, the service you are asking about, and your message.
• Technical data: IP address, browser type, device type, referring page, and pages viewed, collected through our analytics provider.
• Correspondence: emails and messages you send us, and our replies.
• Business records: contracts, invoices and payment records when we work together.
• Client documents: documents a client sends us or gives us access to in order to deliver a workflow. These are handled under section 16.

We do not knowingly collect data from anyone under 18, and we do not buy contact lists.

2a. What we refuse to hold

We do not ask for, and do not store, Social Security numbers, full dates of birth, bank account details or government identity numbers. Certified payroll filings do not require them, so we request payroll exports with the Social Security column removed.

If a file containing that data reaches us anyway, we remove it on receipt, delete the original, and record that we did so. We ask clients to exclude it at source. Holding identifiers we do not need only creates risk for the workers concerned and for the client.

3. Why we use it

• To answer enquiries you send us, and to arrange a call you ask for.
• To deliver, support and invoice the services we have agreed.
• To keep the website working, understand how it is used, and detect abuse.
• To meet accounting, tax and legal obligations.
• To send occasional commercial email about our services, which you can stop at any time.

4. Legal bases

Where data protection law requires a legal basis, we rely on: performance of a contract(delivering the service), legitimate interests (replying to business enquiries, keeping records, preventing abuse, and marketing to business contacts), consent (where we ask for it, including analytics where required), and legal obligation (tax and accounting).

5. Marketing email

We send business-to-business email in line with the US CAN-SPAM Act. Every commercial message identifies us, carries a valid postal address, includes a working unsubscribe method, and is only sent to business contacts relevant to our services. You can opt out at any time by replying "unsubscribe" or using the link in the message. Opt-outs are kept on a suppression list so we do not contact you again.

6. Sharing

We share personal data only with providers who help us run the business, listed in section 8, and with professional advisers, courts or regulators where the law requires it. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use client documents to train third-party models.

7. International transfers

We operate from Hong Kong and use providers in the United States. Where personal data originating in the US or the EEA is transferred, we rely on the provider's contractual safeguards, including standard contractual clauses where applicable.

8. Retention

• Enquiries: 24 months from last contact.
• Trial documents: deleted on request, and in any case within 30 days.
• Client documents: during the engagement, then deleted or returned within 30 days of termination, unless the law requires longer retention.
• Contracts and invoices: kept for the period required by tax and company law.
• Analytics data: a maximum of 14 months.

9. Security

Access is limited to the people delivering the work. We use read-only access wherever the client system permits it, encrypted transport, and per-client isolation. No online service can promise perfect security, so we describe the controls and their limits honestly. If a breach affects your data, we will notify the affected client without undue delay.

10. Your rights

Depending on where you live, you may have the right to know what we hold, to access it, to correct it, to delete it, to restrict or object to processing, to portability, and to withdraw consent. California residents have these rights under the CCPA as amended by the CPRA, including the right not to be discriminated against for exercising them. Because we do not sell or share personal data for advertising, we do not offer a separate opt-out of sale.

Send requests to hello@nosort.com. We acknowledge within 10 business days and respond within 45 days, and we may need to verify your identity or authority for business contacts.

11. Changes

If we change this policy we update the date at the top. Material changes affecting client data are also communicated to clients directly.

Cookies and analytics

We use Google Analytics 4 to understand which pages are used and how visitors arrive. It sets identifiers that persist for up to 14 months and records your IP address, device, referring page and pages viewed. It is not used for advertising, and we do not combine it with the information you submit in the contact form.

You can block analytics with any tracker blocker, and you can opt out of Google Analytics across all sites with the official browser add-on. Blocking it does not affect how the site works for you.

If we ever set marketing cookies, we will ask for consent before doing so.

Terms of service

Last updated 22 October 2026

1. These terms

These terms govern engagements between Neurosia Limited (NoSort, "we") and the business that engages us ("client"). A signed proposal or statement of work takes precedence over these terms where they conflict. By engaging us, the client accepts these terms.

2. The service

We build and operate document automation inside the client's own systems. The system extracts data, applies rules, and prepares the resulting document or posting. We do not act as the client's officer, accountant or legal adviser.

Outputs are drafts until signed. Every output we produce is a draft until the client's authorised officer reviews and signs it. We do not submit statutory filings on the client's behalf, and nothing is filed without the client's written approval. The client is solely responsible for the accuracy and completeness of the data it supplies, for reviewing each output before signature, and for everything filed in its name. The client is the filer of record.

3. Engagements, fees and payment

• Free week: one document set, prepared free of charge, with no obligation.
• Build: a fixed fee per workflow, stated in the proposal, invoiced 50% on start and 50% on acceptance.
• Retainer: a monthly fee covering monitoring, format drift, rule updates and the exception desk, invoiced in advance.
• Invoices are payable within 14 days. Late amounts may accrue interest at 1.5% per month or the maximum permitted by law, whichever is lower.
• The retainer covers keeping an existing workflow accurate. New document types, entities or systems are quoted separately.
• Fees exclude taxes, which are added where required.

4. Client responsibilities

• Provide timely access to the systems and documents needed to deliver the work.
• Ensure it is authorised to grant that access and to share the documents with us.
• Exclude Social Security numbers, bank details and government identity numbers from any file sent to us. If such data is received, we redact it on receipt and delete the source. We are not liable for data sent in breach of this instruction.
• Nominate an officer who can approve exceptions and sign filings.
• Review outputs as reasonably requested, and tell us promptly if something is wrong.
• Comply with the law applicable to its own business, including prevailing wage, insurance and tax obligations.

5. Acceptable use

The client must not use the service to break the law, to process data it has no right to process, or to interfere with systems it does not control. We may suspend work where continuing would require us to act unlawfully.

6. Third-party systems

We integrate with systems we do not control, such as the client's ERP, payroll provider and agency portals. We are not responsible for their availability, their changes, or their output, though we will adjust our workflows to accommodate reasonable changes as part of the retainer.

7. Intellectual property

• We own our methods, tooling, prompts, templates and reusable components.
• The client owns the configuration and code built specifically for it, and may take it elsewhere on termination.
• The client owns its documents and data. We receive a limited licence to process them solely to deliver the service.
• We may describe the engagement in general terms, without the client's name or confidential detail, unless the client agrees otherwise in writing.

8. Confidentiality

Each party keeps the other's confidential information confidential, uses it only for the engagement, and protects it with reasonable care. This survives termination. It does not cover information that is public, independently developed, or required to be disclosed by law, provided the other party is notified where lawful.

9. Data protection

Client documents are processed under section 16. Where the client is subject to US state privacy law, we act as a service provider or processor and will not sell or share the data, retain it beyond the engagement, or use it for our own purposes.

10. Warranties

We warrant that we will perform with reasonable skill and care, and that the system will meet the accuracy threshold stated in the proposal while it is under an active retainer. If field accuracy falls below that threshold, our obligation is to correct the affected outputs and resubmit them at no charge, and this is the client's exclusive remedy for an accuracy failure. Except as stated, the service is provided without other warranties, express or implied, including fitness for a particular purpose. We do not warrant that any filing or posting will be accepted by a third party.

11. Liability

Neither party is liable for indirect or consequential loss, lost profits, lost business, or loss of goodwill. Our total liability, whether in contract, tort (including negligence), statute or otherwise, is limited to the fees paid by the client in the three months before the event giving rise to the claim. This limit applies in aggregate to all claims arising from an engagement.

We are not liable for penalties, fines, interest, withheld payments, liquidated damages or assessment costs imposed on the client by any agency, owner, insurer or other third party. The client is the filer of record and bears that risk. Nor are we liable for loss caused by data the client supplied, by a system the client controls, or by a decision the client approved.

The client's exclusive remedy for an inaccurate output is correction and resubmission at our cost. Nothing in these terms limits liability for fraud, wilful misconduct, death or personal injury, or any liability that cannot lawfully be limited.

12. Indemnity

The client indemnifies us against third-party claims arising from documents or instructions it supplied, or from its own failure to comply with the law. We indemnify the client against third-party claims that our work infringes intellectual property rights, provided the client notifies us promptly and lets us conduct the defence.

13. Term and termination

A retainer runs monthly and either party may end it with 30 days' written notice. A build may be terminated for material breach that is not cured within 14 days of notice. On termination the client receives its documents and any configuration built for it, and we delete client data within 30 days except where retention is required by law.

14. Force majeure

Neither party is liable for delay caused by events beyond its reasonable control, provided it notifies the other promptly and mitigates the effect.

15. Governing law and disputes

These terms are governed by the laws of the Hong Kong Special Administrative Region, and the courts of Hong Kong have exclusive jurisdiction, except that either party may bring a claim in small claims court where the amount allows. Before starting proceedings, the parties will attempt to resolve the dispute in good faith for 30 days. Nothing here removes a mandatory consumer protection available in the client's own jurisdiction.

16. Client documents and data processing

For documents supplied by a client, the client is the controller and we are the processor. We process them only on the client's documented instructions, only to deliver the service, and only for the term of the engagement. We apply the following:

• Access limited to personnel delivering the work, under confidentiality obligations.
• Read-only access to client systems where the system permits it.
• Documents used only to produce the agreed output, never to train models for other clients.
• Deletion or return within 30 days of termination, with a certificate of deletion on request.
• Notification to the client without undue delay after becoming aware of a personal data breach.
• Assistance with the client's own obligations, including requests from individuals, within reason.

The client is responsible for having a lawful basis to share the data with us, including any personal data about its workers, vendors or customers.

17. Changes to these terms

We may update these terms. The version in force when an engagement begins governs that engagement, unless both parties agree otherwise in writing.

Subprocessors

These are the third parties that may process data on our behalf. We keep this list current.

• Vercel Inc. (United States): website hosting and delivery.
• Google LLC (United States): business email (Workspace), contact form delivery (Apps Script and Google Sheets), and analytics (Google Analytics 4).

We will give notice before adding a subprocessor that processes client documents, so the client can object.

Contact

Neurosia Limited, Business Registration No. 78674598
Unit B, 11/F, Yam Tze Commercial Building, 23 Thomson Road, Wan Chai, Hong Kong

Email hello@nosort.com for privacy requests, legal notices or questions about these documents. We reply within one working day.

If you are a client and need a signed data processing agreement on your own template, ask us and we will execute it before work begins.