Privacy Policy

Who we are

Sourcra is responsible for the personal data described in this policy (the "controller" under the GDPR and similar laws). You can reach us about anything in this policy at privacy@sourcra.com.

What we collect

Account information

Sourcra accounts are for companies. When you create an account we collect your name, your business email address on your company's own domain, your company name and, if you provide it, your phone number. If you sign in with your company's Google account, Google shares your name, email address and profile picture with us. Passwords are handled by our authentication provider and are never stored by us in readable form. Account information is needed to create and run your account; everything else you give us is optional, although some features need it (for example, routes need an address).

What you put into Sourcra

The products and regions you search for, requirements you add (such as quantities or certifications), supplier lists you build, and the messages you write or approve.

Location information

Sourcra's maps and logistics features use location in three ways:

• Addresses you enter — such as your company, delivery or warehouse address — to calculate distances and routes to suppliers and show them on maps.
• Approximate location — the country or city inferred from your IP address — to suggest nearby suppliers and a default region.
• Precise device location — only if you allow it in your browser, to show where you are on a map and measure distances from you. We use it only to provide the features you request, we do not keep a history of your movements, and you can switch it off in your browser settings at any time.

We do not use location for advertising and we do not sell it.

Messages Sourcra sends for you

Sourcra's Mail Agent contacts suppliers on your behalf — for example to ask for prices, certificates and product details. You choose how each message is sent:

• From a Sourcra address (the default) — we send the message from a Sourcra email address and name your company in it. Nothing needs to be connected.
• From your own company email address — if you connect your email account, we send messages on your behalf from it. We ask only for permission to send; we do not read, change or delete the emails in your account.

Either way, suppliers' replies come to a Sourcra address so the Mail Agent can track them. We store the messages sent through Sourcra, the replies, any documents suppliers attach (such as certificates or product sheets) and the details we extract from them (for example prices, minimum order quantities or delivery times).

Where available, you can also connect an account on a messaging app; we then ask only for the access needed to send messages on your behalf and to receive the replies to those conversations. Connecting any account is optional and needs your permission on that provider's consent screen, and you can disconnect it at any time — we then stop accessing it.

Sourcra's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Booking a demo

Demo bookings are handled by Cal.com, which collects the name, email address and time you choose and shares them with us. Cal.com processes this data under its own privacy policy.

When you contact us

The contact form on our website opens your own email app; nothing is sent to us until you send the email. We keep the emails you send us and our replies.

Technical data

Like most websites, our hosting provider and our servers receive your IP address, browser and device type, and the pages or features you use, and record them in short-term logs for security and troubleshooting.

Information about suppliers

To show you manufacturers, Sourcra compiles business information about companies from publicly available sources — such as company websites, public business directories and online map listings — and with the help of AI models. This is mostly company-level information (name, location, products, certifications), but it can include business contact details such as a company phone number or sales email. Replies and documents that suppliers send to messages sent through Sourcra can also include the names and contact details of their staff. We process it on the basis of our legitimate interest in helping buyers find manufacturers. If your company appears in Sourcra and you want information corrected or removed, write to privacy@sourcra.com.

Every message Sourcra sends to a supplier says that it was sent by Sourcra's AI assistant on behalf of a named company and links to this policy. A supplier can claim its Sourcra profile to correct its information and choose what the profile shows; claiming requires accepting our Terms and an explicit choice to publish.

How we use personal data

• To provide the service: run your searches, show and verify supplier information, show suppliers on maps and calculate distances and routes, and send and track the messages sent on your behalf.
• To manage your account, confirm that it belongs to a company, respond to your requests and provide support.
• To keep Sourcra secure and prevent abuse, fraud and violations of our Terms.
• To send the notifications and communications you have chosen, as described below.
• To keep supplier information accurate: what suppliers say in replies may be used to check and update our internal supplier records. Details and documents a supplier sends appear on its public Sourcra profile only if the supplier claims the profile and chooses to publish them. Your identity, requirements, quantities, logistics details and quotes stay private to your account: other users never see them, and suppliers see only what is in the messages sent on your behalf.
• To improve Sourcra, using aggregated information about how features are used and de-identified data, as described below.

We do not sell personal data, and we do not use it for advertising or to build advertising profiles. We may use de-identified data — with your identity, your company's identity and personal data removed — to improve Sourcra, including to train our own models. We never use data from your connected accounts to train AI models.

Notifications and communications

We contact you only through the channels you allow. You can change your choices at any time in your account settings or by writing to privacy@sourcra.com.

• Service emails — account, security and billing notices, and updates on your searches and supplier conversations. These are part of the service: you can turn off non-essential updates, but not security and account notices.
• Marketing emails — product news and offers, sent only where you have agreed or where the law otherwise allows. Every marketing email has an unsubscribe link.
• Text messages (SMS) and phone calls — only if you give us your phone number and opt in, and only for the purposes you choose, such as an alert when a supplier replies or a support or demo call you request. Message frequency varies and message and data rates may apply. Reply STOP to stop text messages or HELP for help. Agreeing to text messages is not required to use Sourcra.
• Browser and in-app notifications — only after you allow them in your browser or in the application. You can turn them off in your browser settings at any time.
• Messaging-app notifications — only if you opt in to receive updates on a messaging app. You can opt out in the app or in your settings.

We do not sell your phone number or share it with third parties for their marketing.

AI processing

Sourcra uses third-party AI model providers to interpret your searches, find and summarize supplier information, and help draft and read messages. Only the parts of your content needed for a task are sent to the provider, which processes them to produce a result and does not use them to train its own models. A list of our subprocessors is available on request at privacy@sourcra.com. AI output can be inaccurate; see our Terms of Service. We do not make decisions about people that have legal or similarly significant effects based solely on automated processing.

Legal bases (EEA, UK and similar laws)

• Contract — to provide the service you signed up for.
• Legitimate interests — to keep Sourcra secure, improve it, and compile business information about manufacturers.
• Consent — where required, for example when you connect an email or messaging account, agree to receive marketing emails, text messages or browser notifications, or allow precise location. You can withdraw consent at any time.
• Legal obligation — where we must keep or disclose data by law.

Who we share data with

We share personal data only as needed to run Sourcra, and only with:

• Service providers that process data for us: hosting and content delivery, database and authentication, AI model providers, map, geocoding and business-listing providers, demo scheduling (Cal.com), providers that deliver text messages and notifications, and the email or messaging providers of the accounts you connect.
• The suppliers you contact — they receive the messages sent on your behalf from a Sourcra address or from your connected account, including your company name and the details of your request. Suppliers handle what they receive under their own policies.
• Authorities or other parties when required by law, or to protect the rights and safety of our users or Sourcra.
• A successor in a merger, acquisition or sale of assets, under this policy.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under California law.

International transfers

Sourcra and its service providers operate in the United States and other countries, so your data may be processed outside the country where you live. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Email and messaging providers you connect process messages in their own countries, which may include countries without an EU adequacy decision, such as China.

Retention

We keep account data while your account is active. When you delete your account, we delete your account data and content within 30 days and remove it from backups within 90 days. Search and usage records are deleted or de-identified so they can no longer be linked to you or your company. Information about suppliers that is not personal data stays in Sourcra, without any link to who searched for it. Messages already delivered to suppliers remain in their mailboxes. Server logs are kept for a short period. We may keep data longer where the law requires it or to resolve disputes, prevent fraud or enforce our Terms.

Security

We protect data with measures such as encryption in transit (HTTPS), access controls and limited staff access. No system is completely secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Your rights

Depending on where you live — for example under the EU or UK GDPR, Türkiye's KVKK, or California's CCPA — you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To use these rights, write to privacy@sourcra.com; we may need to verify your identity first. Where the law allows, you can also make a request through an authorized agent, whom we may ask for proof of authorization. We will not treat you differently for exercising them. You can also complain to your local data protection authority.

Cookies and local storage

Our website does not use advertising or analytics cookies. The Sourcra web application stores your sign-in session in your browser's local storage so you stay signed in; it is strictly necessary for the service. The demo booking window is provided by Cal.com and may set its own cookies, and our pages load fonts from a third-party font service, which receives your IP address. If we add analytics, we will update this policy first. We do not track visitors across other websites, so browser Do Not Track and Global Privacy Control signals do not change how we handle data: there is no sale or sharing of personal information to opt out of.

Children

Sourcra is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children.

Changes to this policy

When we change this policy we update the date at the top. If a change is material, we will notify account holders by email or in the application before it takes effect.

Contact

Questions or requests about privacy: privacy@sourcra.com. For help with your account, see Support.