Privacy policy

SourceVouch is run by Sapling Creations Private Limited, Unit 2C, 2nd Floor, Sahya Building, Govt Cyberpark, KSITIL Special Economic Zone, Nellikode PO, Kozhikode, Keralam 673016. We are the data fiduciary under Indian law and the controller under EU and UK law. Write to us at hello@sourcevouch.com.

Our Grievance Officer, Anand, handles complaints about your data or about content on SourceVouch. Reach them at hello@sourcevouch.com or by post at the address above.

• We acknowledge a complaint within 24 hours and resolve it within 7 days.
• We act within 36 hours on a request to remove content that breaks the law or our rules, and within 2 hours on sexual or intimate images of a person or content impersonating them, including altered images.
• You can appeal our decision on a content complaint to the Grievance Appellate Committee (gac.gov.in) within 30 days of receiving it.

• Your account: name, email address and country (all required), company, job title, whether you buy or sell, a hashed password if you set one, and a mobile number if you confirm one. Google or Microsoft sign-in also gives us your account ID and, from Google, your profile picture link.
• What you do on SourceVouch: messages, quotations, quote requests, tenders, bids, reviews, saved suppliers and what you add to a company page. Others can add data about you too, for example a company listing you as a sales contact.
• Security records: server logs (your IP address, the pages you open, browser details) and sign-in and mobile code records.
• Analytics, only if you allow analytics cookies: the pages you open, how you arrived, and your device, browser and approximate location, collected by Google Analytics.
• Company data from companies' own websites, public registers and open data (Wikidata and OpenStreetMap): facts such as the name, description, logo, a general mailbox like info@ and one phone number. Our crawler keeps no individual's email address.
• Our emails to companies: the company address we emailed, when, and whether it asked us to stop.
• Children: you must be 18 or older to have an account. If you think a child has one, tell us and we will delete it.

We use data to run your account and the marketplace, publish reviews, keep SourceVouch secure, build and check company pages, and meet the law. If you allow it, we also use Google Analytics to count visits and see which pages are used, so we can improve the site.

We also email the general address of companies listed on SourceVouch about SourceVouch and about new tenders in their categories. Every such email says why the company gets it and has a link to stop them. We do not send them to companies in the countries we have listed as needing consent first, such as Germany and Austria.

Under Indian law, we rely on the consent you give when you sign up, except where the law lets us act without it. Under EU and UK law, we rely on our contract with you, our legitimate interests in security, in helping buyers check suppliers, and in telling listed companies about SourceVouch and about tenders in their field (you can object to these), and legal obligations. For analytics, we rely on your consent everywhere.

• Anyone: company pages without contact details, reviews with the reviewer's name, job title, company and photo, public tenders, and quote requests, which do not name the buyer.
• Signed-in users: company contact details and members-only files, such as certificate files.
• A supplier you contact: your name, job title, company, email address, photo and confirmed mobile number.
• Only the two sides: messages, quotations, quotes and bids. The supplier's side includes whoever manages its page later. In a sealed tender, the buyer sees bid amounts and documents only after the deadline.
• Our team and the tools we use to send email (below): a listed company's name, general email address, phone number, website, country, city and categories, to email it.
• People who run our server can reach all stored data, but use it only to run the service, investigate abuse or answer a lawful request. Authorities get data only when the law requires it.

Your data is stored on our OVHcloud server in the United Kingdom, wherever you live. Indian law allows this, and the EU recognises UK data protection as adequate. Our team may also open it from other countries. For transfers to the United States and elsewhere, we rely on each provider's standard contractual clauses or Data Privacy Framework certification where EU or UK law requires.

These services also handle some data:

• Resend (United States): email delivery.
• n8n (our workflow tool), Google Sheets and Gmail (Google, United States): our list of company addresses, and sending our emails to companies.
• Twilio (United States): one-time codes by SMS, or by WhatsApp through Meta, when switched on.
• Cloudflare: our DNS and, when switched on, a bot check on mobile sign-in.
• Anthropic (United States): answers the questions you type into Ask AI on a company page. It receives your question and the facts on that page, never your name, email address or IP address. Under its commercial terms, Anthropic does not train its models on this data.
• Google and Microsoft: sign-in, if you choose it, under their own privacy policies. Google profile pictures load from Google, which sees the viewer's IP address.
• Google Analytics (Google, United States), only if you allow analytics cookies: counts visits and shows us which pages are used. Google receives the pages you open, your device and browser details and your IP address, which it uses to estimate your location and says it does not store. We have turned off Google signals and ad personalisation for it. How Google uses this data: policies.google.com/technologies/partner-sites

We set the cookies needed to sign you in. The main one, sid, keeps you signed in for 30 days or until you sign out. Another, sv_consent, remembers your answer about analytics cookies for 6 months.

Analytics cookies are optional. If you allow them, Google Analytics sets _ga cookies, which expire 6 months after your last visit, to tell visits apart. We ask before setting them, and you can change your answer at any time with Cookie settings at the bottom of every page. We use no advertising cookies. The admin area for our team never loads analytics.

If the bot check is on, Cloudflare's script runs on the mobile sign-in page under its own terms.

We keep data only while we need it, or longer if the law requires.

• Your account: until you ask us to delete it. Indian law then requires us to keep your registration details for 180 days.
• Messages, quotations, tenders and bids: while your account exists. The other side relies on them too, so on deletion we tell you what we must keep.
• Reviews: until you delete them or we delete your account.
• Server logs: up to 90 days. Backups: 8 days, so deleted data can stay in them that long.
• Questions asked in Ask AI and their answers: 90 days, with a scrambled form of your IP address and, if you are signed in, your account, so we can limit how many questions one person asks and check the answers.
• Analytics: Google keeps it for the period set in our account, at most 14 months.
• Our email list of companies: while the company page is listed and its address has not unsubscribed; when either ends, the address is removed from the list at its next daily update. Addresses that unsubscribed: for as long as we send such emails, so we never email them again.
• Mobile code and expired sign-in records are not yet deleted automatically. Ask us and we will delete your mobile code records.

Wherever you live, you can do the following. To make a request, email hello@sourcevouch.com from your account's address. We reply within one month, free of charge.

• See your data and who we have shared it with, or get a machine-readable copy of what you gave us.
• Correct or delete it. You can edit your profile, delete your reviews and remove your mobile number yourself.
• Object to uses based on our legitimate interests, or ask us to pause a use while we look into a complaint.
• Withdraw your consent: turn analytics off with Cookie settings at the bottom of any page, or ask us to delete your account. This does not affect what we did before.
• Stop our emails at any time with the unsubscribe link in each email, or write to hello@sourcevouch.com.
• Nominate someone to act for you if you die or become unable to, under Indian law.
• Complain to our Grievance Officer or to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the one where you live or work; in India, the Data Protection Board of India, once its complaint procedure applies.

If your company has a page you did not create, you can:

• Claim it. Sign in and choose Claim. A confirmed email address on the company's domain gives you the page at once; otherwise our team reviews the claim. You can then correct anything on it.
• Remove it. Email hello@sourcevouch.com from an address on the company's domain. We hide or delete the page, stop checking your website and keep the domain on record so it is not added again.
• Have a person's details removed, such as a direct phone line.
• Stop our emails. Every email we send a company has an unsubscribe link. We keep the address on a do-not-email list, so it is not emailed again even if its page is built again.
• Ask a person to review an automated verification check that looks wrong.
• Block the crawler. SourceVouchBot reads your robots.txt before anything else and follows it. If it is not allowed to read your home page, it reads nothing and builds no page. To also remove a page it built earlier, ask us.

Before a change that affects how we use your data takes effect, we tell you in a notification on SourceVouch. We also remind all users of this policy at least once a year.