Privacy Policy

This policy explains how Sourcream.ai Pty Ltd of Chatswood NSW, Australia ("we", "us", "our") handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

We handle two kinds of information. The first is about our customers: the people who sign up for and use Sourcream. The second is about our customers' website visitors, which we process on our customers' behalf.

1. Information about our customers

• Account details: your name, email address, company name and password (stored only as a secure hash).
• Billing details: handled by Stripe. We receive your billing contact, plan and payment status, but never your full card number.
• Login sessions: the time of each sign in and your browser's user agent, to keep your account secure.
• Messages: anything you send us by email.

We use this to run your account, bill you, send service emails (verification, password resets, invitations, usage and payment notices), answer support requests and meet our legal obligations. We don't sell it, and we don't use it for advertising.

Analytics on this website

This website (sourcream.ai) uses Google Analytics, loaded through Google Tag Manager, to see how visitors use it: which pages they view, how they arrived, and whether they click to sign up or contact us. Google Analytics sets its own cookies and receives your IP address, which Google uses to estimate your general location and does not log or store. Visitors in the European Economic Area, the United Kingdom and Switzerland are measured without analytics cookies. You can opt out of Google Analytics on any website with Google's opt out browser add on.

The Sourcream dashboard at app.sourcream.ai does not use Google Analytics.

2. Information about our customers' website visitors

When a customer installs the Sourcream script, it records how visitors reached their website: the landing page, the referring site, campaign tags, ad click IDs and visit times, linked to a random visitor ID stored in first party cookies. When a visitor submits a form and the customer has email matching turned on, we also receive the contact details from that form so we can deliver the lead to the customer's CRM.

We process this information only to provide the service to that customer. The customer decides what is collected and where it is sent, and is responsible for telling their visitors and obtaining any consent required. If you are a visitor to one of our customers' websites, please contact that business first; we will help them respond to you.

Visitor IP addresses are used briefly to apply rate limits and are not stored.

3. Storage and security

Sourcream runs on Cloudflare. Our database is located in Cloudflare's Oceania region, and requests are handled at the Cloudflare location nearest the visitor. All connections use HTTPS. Credentials for connected CRMs are encrypted before they are stored, and passwords are hashed. More detail is on our security and privacy page.

4. Who we share information with

• Cloudflare hosts the service, stores our database and sends our emails.
• Stripe processes subscriptions and payments.
• Anthropic categorises referring website host names for customers on Business plans and above. It receives host names only, never personal information.
• Google provides Google Analytics and Google Tag Manager for this website, not for the Sourcream service.
• The CRMs and webhooks a customer connects receive that customer's leads, at the customer's direction.

We may also disclose information where the law requires it.

5. Overseas disclosure

Cloudflare operates a global network and Stripe, Anthropic and Google are based in the United States, so information may be processed outside Australia. We use providers with recognised security practices and contractual protections for the information they handle for us.

6. How long we keep information

• Account and billing records: while your account is open, then as long as tax and accounting law requires.
• Visitor records and journeys: deleted 180 days after the visitor's last visit.
• Contact details on leads: removed after the customer's retention period, 30 days by default.
• Lead attribution (source, medium, campaign, channel): kept while the customer's account is open.
• When an account is deleted, its data is deleted with it, and copies in database backups expire within 30 days.

7. Your rights

You can ask to access the personal information we hold about you, ask us to correct it, or ask us to delete it. Email [email protected]. We will respond within 30 days.

8. Complaints

If you have a concern about how we handled your information, email us first and we will look into it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

9. Changes

We may update this policy. The date at the top shows when it last changed, and we will email account owners about material changes.

10. Contact

Privacy questions: [email protected].