Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how SourcerOS Ltd ("we", "us", "our") collects, uses, stores, and protects personal data when you use SourcerOS ("the Service") at sourceros.io.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

SourcerOS Ltd is the data controller for personal data you provide directly to us (your account information, billing details, and settings).

For personal data you input about third parties (seller leads, investors, co-sourcers), you are the data controller and we act as your data processor.

For questions about this policy, contact our data controller at: support@sourceros.co.uk

2. What Data We Collect

2.1 Account Data (data you provide directly):

Name and email address (required to create an account)
Company name and phone number (optional profile information)
Billing information (processed by Stripe — we do not store full card details)
Profile preferences and settings

2.2 Usage Data (collected automatically):

Pages visited and features used within the Service
Login timestamps and session information
Browser type and device information
IP address

2.3 Third-Party Contact Data (data you input about your contacts):

Seller lead information: names, phone numbers, email addresses, property addresses, personal circumstances (divorce, probate, financial difficulty, etc)
Investor information: names, contact details, company names, investment criteria, financial information
Compliance documents you upload: passport copies, AML certificates, bank statements, and other identity documents
Co-sourcer information: names, contact details, company names

2.4 Communication Data:

Content of notes you add to deals, leads, and investors
Email templates and sequences you configure
Automation settings

3. How We Use Your Data

3.1 To provide the Service:

Creating and managing your account
Processing subscription payments via Stripe
Storing and displaying your contact and deal data
Sending automated emails on your behalf (follow-up sequences, notifications)
Legal basis: Contract performance (Article 6(1)(b) UK GDPR)

3.2 To improve the Service:

Analysing how features are used (aggregated, anonymised data only)
Diagnosing technical problems
Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR)

3.3 To communicate with you:

Sending transactional emails (trial reminders, billing notifications, product updates)
Responding to support requests
Legal basis: Contract performance and legitimate interests

3.4 To comply with legal obligations:

Fraud prevention and security monitoring
Responding to lawful requests from authorities
Legal basis: Legal obligation (Article 6(1)(c) UK GDPR)

4. Third-Party Contact Data — Your Responsibilities

When you use SourcerOS to store personal data about sellers, investors, and other third parties:

4.1 You are the data controller for this data. You are responsible for ensuring you have a lawful basis to collect, store, and process this information under UK GDPR.

4.2 For seller leads: if you send automated follow-up emails to sellers via SourcerOS, you are responsible for ensuring those individuals have either consented to receive marketing communications or that you have another lawful basis (such as legitimate interests) for contacting them.

4.3 For compliance documents (AML checks, ID documents): you are responsible for collecting and storing these documents in accordance with your legal obligations as a deal sourcer, including compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

4.4 We process this data only on your instructions to provide the Service and do not use it for any other purpose.

We share data with the following third-party service providers strictly for the purpose of providing the Service:

Stripe Inc — payment processing. Privacy policy: stripe.com/gb/privacy
Supabase Inc — data storage and authentication. Privacy policy: supabase.com/privacy
Resend Inc — transactional email delivery. Privacy policy: resend.com/legal/privacy-policy
Meta Platforms — lead capture integration (if configured). Privacy policy: facebook.com/privacy/policy

We do not sell, rent, or share your personal data with any third party for marketing purposes.

We may share data if required by law, court order, or government authority, or to protect the rights and safety of SourcerOS, our users, or the public.

6. Data Storage and Security

6.1 Your data is stored on servers operated by Supabase, located in the European Union (Frankfurt, Germany).

6.2 We implement appropriate technical and organisational security measures including:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest
Row-level security on all database tables (your data is isolated from other users)
Regular security reviews

6.3 Compliance documents and uploaded files are stored in private, access-controlled storage buckets and are never publicly accessible.

6.4 While we take security seriously, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect a breach.

7. Data Retention

7.1 Account data: retained for the duration of your subscription plus 30 days following termination, after which it is permanently deleted.

7.2 Third-party contact data (seller leads, investors, deals): deleted 30 days after account termination unless you request earlier deletion.

7.3 Billing records: retained for 7 years as required by UK financial regulations.

7.4 Usage logs: retained for 90 days.

7.5 You can request deletion of your data at any time by contacting support@sourceros.co.uk or using the "Delete account" option in Settings → Account.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access: request a copy of the personal data we hold about you.
Right to rectification: request correction of inaccurate or incomplete data.
Right to erasure: request deletion of your personal data ("right to be forgotten").
Right to restrict processing: request that we limit how we use your data.
Right to data portability: receive your data in a machine-readable format.
Right to object: object to processing based on legitimate interests.
Right to withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@sourceros.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

SourcerOS uses essential cookies only:

Session cookies to keep you logged in
Security cookies to prevent cross-site request forgery

We do not use advertising cookies, tracking cookies, or any third-party analytics cookies that track you across websites.

10. Children

The Service is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at support@sourceros.co.uk.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date above. We encourage you to review this policy periodically.

12. Contact and Complaints

For privacy-related questions or to exercise your rights:

SourcerOS Ltd
Email: support@sourceros.co.uk
Website: sourceros.io

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office:

ICO helpline: 0303 123 1113
Website: ico.org.uk