Last updated: July 26, 2026
This Privacy Policy explains how [Legal Entity Name — e.g. “SouceOS LLC”, or your full legal name if operating as a sole proprietor](“SouceOS,” “we,” “us”) collects, uses, and shares information when you use the SouceOS application and website (the “Service”). It applies to visitors, account holders, and the individuals whose data account holders enter into the Service. By using the Service, you agree to the collection and use of information as described here.
Account information.When you sign up, we collect your name, email address, and password (or, if you use “Continue with Google,” the basic profile information Google provides).
Business data you provide. SouceOS is a workspace for managing your sourcing operations. In the ordinary course of using it, you and your team may enter supplier contacts, quotes, sample records and photos, purchase orders, production timelines, and related documents. This data belongs to you — see Section 8.
Payment information. Subscription payments are processed by Stripe. We do not store your full card number on our servers — Stripe handles that directly and shares with us only what's needed to manage your subscription (e.g. plan, billing status, last 4 digits of your card).
Usage and diagnostic data. Once you accept analytics cookies (see Section 3), we use PostHog to understand how the product is used (pages visited, features used, in-app events). We use Sentryto capture error reports when something breaks, so we can fix it — this runs regardless of your cookie choice, since it's necessary to keep the Service secure and working. Both may collect your IP address and browser/device information.
Cookies. See Section 3 below.
We use the information described above to:
We do not sell or share your personal information(as those terms are defined under the CCPA/CPRA — including “sharing” for cross-context behavioral advertising) or your business data, and we have not done so in the preceding 12 months. We don't run ad-targeting pixels or share your data with data brokers or ad networks.
Strictly necessary.We use a session cookie (via Supabase authentication) required to keep you signed in and to operate core site functionality. This cookie can't be switched off, since the Service can't function without it.
Analytics (optional).We use PostHog, which sets its own cookies and/or browser local storage to recognize your browser across visits. This only starts after you accept analytics cookies in the banner shown on your first visit. You can withdraw acceptance at any time by clearing your browser's local storage for this site, or by contacting us. Visitors who decline see no reduction in functionality.
We currently don't serve advertising cookies or work with ad networks, so there is nothing to opt out of on that front; if that changes, we'll update this section and our cookie banner accordingly.
We share information only with the service providers (“subprocessors”) that help us run SouceOS, each bound by contract to use it only to provide their service to us and not for their own independent purposes:
If you use a multi-client Agency workspace, your clients' data is visible to the team members you grant access to within that workspace — you control those permissions. We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to you where required). None of this is a “sale” or “share” of your data under applicable privacy law.
We retain account and business data for as long as your account is active. If you close your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep it longer (e.g. billing records for tax purposes).
If you're a California resident, in the preceding 12 months we've collected the following categories of personal information, for the business purposes described in Section 2: identifiers (name, email, IP address); account credentials; commercial information (subscription plan, billing history); internet/network activity (product usage events, once you accept analytics cookies); and, in your business data, information about third parties you enter (e.g. supplier contacts) that you are responsible for having the right to store. We do not collect or infer sensitive personal information as CCPA defines it beyond account login credentials, and we don't use those credentials for any purpose beyond authenticating you.
As a California resident, you have the right to:
We don't sell or share personal information, so there is no opt-out of sale/ sharing to exercise. To submit a request, email us at the address in Section 14 — we'll verify your identity using the email address on your account and respond within 45 days (extendable by another 45 days for complex requests, with notice). You may use an authorized agent to submit a request on your behalf; we may require proof of that authorization.
If you're in the EEA, UK, or Switzerland, we process your personal data under the following legal bases: account and business data to perform our contract with you; usage/diagnostic data (analytics, error monitoring) based on your consent (analytics) or our legitimate interest in keeping the Service secure and working (error monitoring); and billing records to comply with our legal obligations.
You have the right to:
To exercise any of these rights, contact us at the address in Section 14 — we aim to respond within 30 days. You also have the right to lodge a complaint with your local data protection supervisory authority. See Section 9 for how we transfer data internationally.
The supplier, product, and production data you and your team enter into SouceOS — including any photos, files, or messages you upload or connect — is yours. We act as a processor of that data on your behalf: we don't use it to train models, sell it, or share it beyond what's needed to operate the Service as described above, and none of it is ever made public or visible outside your workspace (or, for Agency plans, the client workspaces you've granted your own team access to). You're responsible for having the rights to any content you upload. To request an export or deletion of your data, contact us at the address in Section 14 and we'll act on it within a reasonable time, subject to the retention exceptions in Section 5.
Our service providers may process data in the United States or other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.
We use industry-standard safeguards (encryption in transit, database-level access controls, and row-level security isolating each workspace's data) to protect your information. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.
SouceOS is a business tool not directed at children, and we do not knowingly collect personal information from anyone under 16.
Emails required to run your account — signup confirmations, billing receipts, security alerts, and service notices — aren't promotional, and you'll receive them as long as you have an account, since they're part of the Service itself. If we ever send promotional or product-update email, it will be sent only to users who've opted in, will clearly identify itself as promotional, and will include a working unsubscribe link honored within 10 business days, consistent with the CAN-SPAM Act. We don't currently send any promotional email.
We may update this policy from time to time. If we make material changes, we'll notify you by email or through the Service before they take effect.
Questions about this policy, or a request under Section 6, 7, or 8? Contact us at logancorney@icloud.com or by mail at [Business mailing address].