Plain language about what Sofrito collects and why.

Browsing this site

There are no audience-measurement scripts, advertising tags, or tracking cookies on this website. We do not build a profile of your visit.

Two services still receive requests when a page opens. Cloudflare Pages hosts the site and processes request information such as IP address, timestamp, requested URL, and user agent to deliver and protect it. Page fonts load from Google Fonts, so your browser also requests those files from Google. Sofrito does not read either service's request records for marketing.

Cookies and similar technologies

The public pages of this site set no cookies at all — no audience-measurement cookie, no advertising cookie, no cross-site tracking. There is no cookie banner because there is nothing to consent to.

Three narrow exceptions exist, and none of them follows you anywhere:

• The automated human check. Cloudflare Turnstile may set a short-lived token on the application and contact pages to tell a person from a bot. It is not used to identify or profile you.
• Signed-in sessions. The customer workspace and the operator console set a session cookie once you sign in, so you stay signed in. It is removed when you sign out.
• Your own browser’s storage. The application form saves your draft answers in your browser so a refresh does not lose them. That draft stays on your device.

If you submit an application

The secure application stores what you provide: identity and contact details, business details, exact location count, service preferences, answers, selected record categories, uploaded sample records, fit confirmation, payment option, required acknowledgments, deliberately entered initials and typed signature, and the exact versioned agreement snapshot and acceptance time.

The server also records submission time, your browser's user-agent string, the country reported by Cloudflare, a one-way hash of your IP address for abuse controls and duplicate detection, and a referral source from the page URL or referring site. Sofrito does not store the IP address itself.

Selected sample files go to the restricted customer intake after email verification. Files are limited by the displayed type, size, and count rules. Card details are entered only on Stripe-hosted checkout; Sofrito stores provider identifiers and verified payment state, not card numbers.

If you use the contact form

The contact form collects your name, your email address, an optional business name, the topic you chose, and your message. The server also runs the automated human check and keeps a short-lived, one-way hash of your IP address to limit abuse and to stop a double-tapped button sending the same message twice. The IP address itself is not stored.

Your message is delivered to Sofrito’s hello@trysofrito.com inbox by our email provider as plain text, with your address set as the reply-to so a person can answer you. It is used to answer you and for nothing else: it is not added to a marketing list, not used to build a profile, and not shared outside Sofrito except with the email provider that carries it. There is no marketing opt-in on the form.

Please do not send card numbers, passwords, or government ID numbers through the form — email is not the right place for them, and Sofrito does not need them.

Contact messages are kept while the conversation is useful and deleted within 24 months, sooner on request.

How we use application information

We use it to review fit, contact you about the application, and manage Founding Access capacity. De-identified research use and permission to contact you about a testimonial are required conditions of Founding Access, acknowledged separately from the required service and data consents. Testimonial contact is permission to ask only; identifiable publication requires separate written permission. We do not sell personal information.

Who processes it

Cloudflare hosts the site, runs server endpoints, and provides the automated human check. Supabase stores restricted application, agreement, intake, workspace, and payment-status records. Stripe hosts checkout and handles card details. Resend sends access and service email. If these providers change, this list will change with them.

How the application is protected

The browser has no direct database credential. Server endpoints enforce the verified intake or staff session, tenant scope, and allowed fields. Anonymous and ordinary signed-in database roles do not receive direct table access to restricted application, agreement, billing, or intake records.

How long we keep applications

Declined or withdrawn applications are deleted within 24 months after review. The current database includes a restricted deletion procedure, but it is not automatically scheduled. Sofrito must run that procedure operationally until a schedule is implemented and verified. Applications from businesses that join are kept for the engagement and then governed by the customer agreement and fuller customer-data policy. You may ask for deletion sooner at any time.

Required conditions of Founding Access

Two uses that were previously optional are now required conditions of Founding Access, acknowledged separately when you sign:

• De-identified research use. Sofrito may use de-identified themes — patterns, categories of finding, and aggregate observations — to improve the service and its methods. This never includes your raw records, your figures, or anything that identifies your business, and customer records are not used to train a general model.
• Testimonial contact. Sofrito may contact you to ask whether you would give a testimonial. That is all it permits. Publishing your name, your business identity, an identifiable quote, or your results requires your separate written permission given at the time, and you can decline a request with no effect on your service.

These conditions apply to customers who sign the Founding Cohort agreement. They do not apply to someone who only browses the site or sends a contact message.

Your rights and how to exercise them

Whatever information Sofrito holds about you — an application, a contact message, or customer records — you may ask us to:

• tell you what we hold and why;
• give you a copy;
• correct something that is wrong;
• delete it; or
• stop using it for a particular purpose.

Email hello@trysofrito.com or use the contact form and choose the Privacy & Data topic. We confirm within five business days and complete the request within thirty days. You do not need to give a reason, and asking will never affect an application review or the service you receive.

We may need to confirm you are who you say you are before acting on a request, and we may keep records where a documented legal or protective obligation requires it — in which case we tell you which category was retained and why. If you are not satisfied with how we handled a request, say so and a person will look at it again.

Contact

Questions or corrections: hello@trysofrito.com.