Legal
Privacy Policy
Draft pending legal review. This document has not yet been reviewed by counsel for The Schoeller Group LLC and may change before it takes effect. Questions: legal@sourcefinch.com.
This policy explains how The Schoeller Group LLC (“we”) handles personal information when you visit sourcefinch.com or use SourceFinch. For content collected from Sources you configure, you decide what is collected and why; we process it on your behalf under the Terms of Service.
What we collect
- Account data: your email address, a password hash (if you use one), and basic profile details from Google if you sign in with Google (name, email, and Google account identifier).
- Workspace data: organization and project names, members and roles, Source configurations, API key metadata (keys themselves are stored only as hashes), alerts and preferences.
- Collected content: the pages, records and Evidence acquired from the Sources you configure. Avoid configuring Sources that contain personal data unless you have a lawful basis to collect it.
- Billing data: plan, subscription status and Stripe customer identifiers. Card details are handled by Stripe and never reach our servers.
- Usage and technical data: runs, request counts, timestamps, IP address and user agent in security and access logs, and anonymous page-view analytics (see below).
- Messages: what you send us by email or through forms, such as access or sales requests.
How we use it
To provide and secure the Service, authenticate you, run your Sources, send the alerts and transactional emails you configure, process payments, provide support, prevent abuse, comply with law, and understand in aggregate how the site is used so we can improve it. We do not sell personal information, and we do not use your content to train machine-learning models.
Analytics and cookies
We use essential cookies to keep you signed in and to remember your selected workspace. If enabled, our analytics records page views without cookies, using a random identifier that lasts only for your browser session, and sends only the page path, never query strings. It is skipped when your browser sends Do Not Track or Global Privacy Control.
Service providers
We share data only with providers that help us run the Service, under contracts that limit their use of it:
- Vercel (web hosting), Supabase (database, authentication, file storage), Fly.io (acquisition workers)
- Stripe (payments and billing portal)
- Resend (transactional email)
- PostHog (privacy-preserving product analytics)
- Google (optional sign-in)
Data is stored and processed in the United States.
Retention
Raw Evidence is deleted after your plan’s retention window. Account and workspace data are kept while your account is active and deleted within a reasonable period after you close it, except records we must keep for legal, tax, security or billing reasons.
Your choices and rights
You can access, correct, export or delete your account data, and object to or restrict certain processing, subject to applicable law. Email privacy@sourcefinch.com; we may need to verify your identity. If you are in the EEA, UK or a US state with privacy rights, you may also complain to your local regulator. The Service is not directed to children under 16.
Security
We use encryption in transit, row-level access controls between workspaces, hashed API keys and private object storage. No system is perfectly secure; report concerns to security@sourcefinch.com.
Changes and contact
We will post updates here with a new effective date and notify account owners of material changes. Contact: The Schoeller Group LLC, privacy@sourcefinch.com.