Privacy Policy
Post Sorted (post.wcg.digital) Last updated: 3 November 2026
1. Who we are
Post Sorted is a service provided by Woodrup Creation Group Ltd (“WCG”, “we”, “us”), a company registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS].
We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO NUMBER].
Contact for privacy matters: privacy@wcg.digital
2. The two roles we play
Post Sorted handles personal data in two distinct ways, and your rights differ depending on which applies.
We are a data controller for information about you as a customer or visitor: your account details, billing information, support correspondence and how you use our website. This policy covers that.
We are a data processor for the contents of the post your firm scans and sends to us. That data belongs to your firm’s clients, and your firm is the controller. We process it only on your firm’s instructions under our Data Processing Agreement. If you are a client of an accountancy firm that uses Post Sorted and have a question about your data, please contact your accountant.
3. What we collect about you (as controller)
| Category | Examples | Why |
|---|---|---|
| Account data | Name, work email, firm name, role, password hash | To create and secure your account |
| Billing data | Billing address, VAT number, payment reference. Card details are held by our payment provider, not us | To invoice and collect payment |
| Usage data | Pages visited, features used, login times, IP address, browser | To run, secure and improve the service |
| Support data | Emails and messages you send us | To help you |
| Integration tokens | OAuth tokens for Karbon, Xero Practice Manager, Microsoft 365, Google Workspace | To connect Post Sorted to your systems. Tokens are encrypted and can be revoked at any time |
We do not collect special category data about you.
4. Why we use it (legal bases)
- Performance of a contract: running your account, processing post, billing.
- Legitimate interests: securing the service, preventing fraud, improving features, sending you service updates about Post Sorted. You can object at any time.
- Legal obligation: tax and accounting records, responding to lawful requests.
- Consent: marketing emails, non-essential cookies. You can withdraw consent at any time.
5. Who we share it with
We use a small number of sub-processors to run the service:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Hosting, storage, processing, and AI classification and extraction of scanned documents (Vertex AI Gemini) | UK (London region) |
| Twilio / SendGrid | Receiving scanned post by email; transactional email and notifications | US / EU |
| [Payment provider, e.g. Stripe] | Payment processing | UK / EU |
We never sell your data. We do not share it with advertisers.
We may disclose data where legally required, or to professional advisers, or to a buyer if WCG or Post Sorted is sold (you would be notified).
6. International transfers
All storage and processing of scanned post, including AI processing, takes place in the UK (Google Cloud, London). Where a sub-processor is outside the UK, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, plus the UK–US Data Bridge where applicable.
7. How long we keep it
- Account data: for the life of your subscription plus 12 months.
- Billing records: 6 years (HMRC requirement).
- Usage logs: 12 months.
- Scanned post (as processor): deleted on the schedule your firm sets, default 90 days after processing, or immediately on termination. See the DPA.
8. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Each firm’s data is logically isolated. Access to production systems requires multi-factor authentication and is logged. We do not use your documents to train AI models, and our AI providers are contractually prohibited from doing so.
9. Your rights
Under UK GDPR you can ask us to:
- access the personal data we hold about you
- correct it
- delete it
- restrict or object to how we use it
- give it to you in a portable format
- withdraw consent
Email privacy@wcg.digital. We respond within one month. You can also complain to the ICO at ico.org.uk, though we would rather hear from you first.
10. Cookies
See our Cookie Policy.
11. Children
Post Sorted is a business service and not intended for anyone under 18.
12. Changes
We will post changes here and, for material changes, email account holders. Continued use after a change means you accept it.