Privacy Policy

sourcinga ("we", "us") operates this website and the sourcinga API. We are the data controller for the personal data described below. For any privacy question, contact us at privacy@sourcinga.example.

• Search queries — the text you type into the search bar, so we can run the ranker and, in aggregate, improve recommendations.
• Anonymous session cookie — a random identifier named siq_sid, set the first time you click an outbound link, used to de-duplicate clicks.
• Hashed IP address — we hash your IP address with a daily-rotating salt (sha256(ip + salt)) for fraud prevention. We never store the raw IP.
• User agent — for debugging and to detect automated abuse.
• Outbound click metadata — which merchant, product and recommendation type you clicked, plus a unique click ID passed to the affiliate network so purchases can be reconciled.
• API request logs — for holders of an API key: endpoint, timestamp and key identifier, for abuse prevention and billing.

• We do not store your raw IP address.
• We do not set advertising or cross-site tracking cookies.
• We do not sell your search history — ever. This is rule 6 of our Trust Charter.

sourcinga sets one strictly-necessary cookie: siq_sid, an anonymous session identifier. It is HttpOnly,Secure and SameSite=Lax, with a 180-day lifetime. It carries no personal data.

When you click through to a retailer, that retailer sets its own cookies under its own privacy policy. We have no control over those cookies.

We measure aggregate click activity — how often each recommendation is clicked, which merchants convert well — to improve product quality. These metrics are never fed back into the ranker. Rankings are deterministic and revenue-blind (rules 1, 10 and 11 of our Trust Charter).

When you click a "Buy" button, the request passes through our redirect endpoint (/api/public/go), which attaches the relevant affiliate network's tracking parameters and forwards you to the retailer. See our Affiliate Disclosure for the full picture.

If you use the sourcinga API, we log the endpoint called, the timestamp and your API key identifier for abuse prevention, rate-limit enforcement and billing. Query text sent through the API is treated as an ordinary search query (see above).

• Supabase — database, authentication and storage (EU region).
• Google Gemini (via the Lovable AI Gateway) — generates the plain-English explanation for each recommendation. It receives the structured product data only; it never sees your IP or session ID and never ranks products.
• Affiliate networks — Amazon Associates, Awin, Impact, Partnerize and Skimlinks receive only the outbound referral needed to attribute a purchase.

Our primary infrastructure sits in the EU/UK. Where a sub-processor operates outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision, to safeguard your data.

• Outbound click logs — 12 months, then aggregated and the row-level data deleted.
• API request logs — 90 days.
• Account data — kept while your account is active; deleted on request.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten");
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any of these rights, email us at privacy@sourcinga.example. We aim to respond within 30 days.

We will post any material change to this page and update the "Last updated" date above. Substantive changes affecting registered users will additionally be notified by email.