Privacy Policy

Operator

This service is operated by the SourceSight team. For privacy-related questions, contact support@sourcesight.app and we will respond within a reasonable time.

What we collect

• Account details: email, name, optional company/brand and language preference.
• Project configuration: company name, brand aliases, product keywords, target market and selected engines.
• Monitoring results: audit snapshots (engine answers, citations, scores) and site health records.
• Communications: inquiries, requests and tickets you submit via our contact form or email.
• Necessary technical data, such as IP addresses, used only for security, abuse prevention and to pick a default language based on your region.

Payments are handled by our payment provider (hosted billing); we do not collect or store your payment card number.

How data is used

• Brand names and keywords are used solely to run the monitoring you authorize: they are sent to the engines you select to retrieve answers and citations, and the results are stored as snapshots for you to view.
• We do not train models on your data, sell your data or use it for ad targeting.
• Some AI engines (such as DeepSeek and Zhipu GLM) may use submitted content for improvement or training under their own policies: before enabling such engines, please read their data policies and acknowledge them.

Who receives data

We share data with subprocessors only to the extent necessary to provide the Service, including: AI engines (the engines you select and enable for a project), payments (payment provider), cloud hosting (UCloud, Hong Kong), database (self-hosted PostgreSQL, Hong Kong), email (Resend) and DNS/CDN (Cloudflare). The full list, notice rules and objection rules are set out in the DPA and the Security & Compliance page.

Legal basis

Accounts and services are processed as necessary to perform our contract (Art. 6(1)(b) GDPR); contact-form confirmation emails are based on your explicit consent (Art. 6(1)(a)) and can be withdrawn at any time; security and abuse prevention rely on legitimate interest (Art. 6(1)(f)).

Cookies

• Login session: keeps you signed in (HttpOnly, SameSite=Lax) for up to 30 days, and expires when you sign out.
• Language preference: remembers your chosen interface language for 1 year.
• In-app notice preference: stored when you dismiss certain in-app notices, so we remember that choice for 30 days.

We do not use advertising tracking or third-party analytics cookies. Disabling cookies may make core features such as sign-in unavailable; you can clear cookies in your browser at any time.

Data security

• In transit: communications between the app and our servers are encrypted with TLS.
• At rest: data is encrypted at the storage layer by our hosting and database providers.
• Access control: only core operations staff can access production systems, on a least-privilege basis, and every access is logged.
• Account credentials: your login password is stored only as an encrypted hash, so we cannot read your plaintext password.
• Payments: checkout is handled by our payment provider (hosted billing); we do not handle or store your payment card information.

See the Security & Compliance page for details.

Retention and deletion

Snapshots are kept according to the plan in place when the project was created: 1 month on Free, 12 months on Lite and above; plan changes never retroactively delete them. Deleting a project cascades all its snapshots. After you request account deletion, your personal data, projects and snapshots are removed within 30 days (except where retention is required by law). If you need an export, use the product's export features before deletion.

Cross-border transfers

The application and database are hosted in Hong Kong (UCloud). Overseas engines process in the US/EU; Chinese engines run in mainland China and require you to acknowledge their data policy before enabling them. Transfers are safeguarded by EU Standard Contractual Clauses (SCCs) where applicable.

Marketing email and unsubscribe

Contact-form confirmation emails are sent only after you submit the form. To stop receiving them, contact support@sourcesight.app at any time; this does not affect platform features.

Your rights

Under applicable laws such as GDPR, CCPA and PIPL, you may request access, export, correction or deletion of your personal data. We will make reasonable efforts to respond within 30 days (extendable for complex requests, with notice).

How to exercise your rights: account details and language preference can be managed in settings; project data can be exported using the product's export features; deletion of personal data and account deletion can be requested in settings. For other assistance, email support@sourcesight.app; to protect your account, we may first verify your identity.

After deletion: your right to use the Service ends and account benefits lapse. If you have unused paid benefits before deletion, please submit a refund request in accordance with the Refund Policy first.

Policy updates

We may update this policy from time to time. For material changes, we will notify you via in-app notices or the email address on your account, and update the date at the top of this page. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy; where applicable law requires separate consent, we will obtain it.