Data Processing Agreement
Last updated: 2026-09-08
Operator
This service is operated by the SourceSight team. For support, billing or privacy matters, contact support@sourcesight.app.
Roles
You are the controller; SourceSight is the processor acting on your instructions for project configuration and snapshot data.
Processing scope
Processing is limited to brand names, keywords, question text, engine answers and citations needed for monitoring.
Training policy
SourceSight does not train any model on your data. Some AI engines (such as DeepSeek and Zhipu GLM) may use submitted content for improvement or training under their own policies; if your purchased plan includes such engines, please read their data policies and acknowledge them before enabling. If submitted content involves personal data or requires third-party authorization, you are responsible for obtaining any necessary consent and for compliance.
Duration and termination
This Agreement lasts for the subscription term. After termination of the Service or this Agreement, we will delete your personal data, projects and snapshots within 30 days. If you need an export, please export through the product's existing features before termination; we are not obligated to provide custom development or additional export services (except where required by law).
Confidentiality and security
Personnel are bound by confidentiality. Data is encrypted in transit and at rest, accessed on a least-privilege basis, with audit logging of access.
Subprocessors
We operate under a general prior authorization: we may add, replace or remove AI engines and infrastructure providers without seeking separate approval. Before adding or replacing a subprocessor, we will notify you via product announcements or email (except for emergency security replacements). If you do not agree to a new subprocessor, you may terminate the affected services after receiving notice; fees after termination are handled under the Terms of Service and the Refund Policy. Your objection does not prevent us from launching the service. We are responsible for acts of our subprocessors that breach data protection obligations, limited to damage directly caused by such breach and subject to the liability limitations in the Terms of Service.
Cross-border transfers
The application and database are hosted in Hong Kong (UCloud). Overseas engines process in the US/EU under safeguards such as EU Standard Contractual Clauses; Chinese engines run in mainland China and require informed consent before you enable them.
Data subject rights
After receiving your written request and necessary information, we will cooperate within a reasonable time. You bear any costs arising from requests that are unreasonable, repetitive or require additional expense.
See the rights summary in the Privacy PolicyData breach notification
After confirming a security incident involving your personal data, we will notify you within 72 hours, including the known scope of impact, likely consequences and remedial measures taken or planned, supplementing missing information as it becomes available. This does not apply to encrypted or non-identifiable data, information that does not involve personal data, or situations that do not constitute a personal data breach. Notification sent to the email address on your account is considered delivered; you should promptly provide information reasonably required by us, and we are not liable for delayed notification caused by your failure to do so. This notification obligation does not constitute an admission of liability and does not trigger refunds or compensation; liability and compensation remain governed by the Terms of Service.
Conflicting instructions and legal requirements
If we reasonably believe your processing instructions violate applicable law, we will suspend the relevant instructions and notify you. If disclosure of your data is required by law, we will notify you in advance to the extent permitted by law, unless such notification is prohibited.
Compliance inquiries
If you have questions about our compliance in processing personal data, contact support@sourcesight.app and we will reply in writing within a reasonable time. Except where required by applicable law, we are not obligated to provide third-party certification reports, accept on-site audits or open internal systems.
Agreement updates
We may update this DPA from time to time. If a material change occurs, we will notify you via in-app notification or the email address on your account, and update the date at the top of this page. Your continued use of the Service after the change takes effect constitutes acceptance of the updated DPA; where applicable law requires separate consent, we will obtain it as required.