How we handle your data and your visitors' data
Sourcream processes information about your website visitors on your behalf. This page sets out what we collect, where it is stored, who else handles it, how long we keep it and how we protect it.
Only what attribution needs
The script records how a visitor arrived. It doesn't record what they read, where they click, or anything typed into a form until the form is submitted.
| Data | Why | How long |
|---|---|---|
| Landing page, referring site, UTM values, ad click IDs, visit times | To work out the source of each visit | 180 days after the visitor's last visit |
| A random visitor ID in first party cookies | To recognise a returning visitor on your site | 180 days |
| Contact details from a submitted form (only when email matching is on) | To create or update the right record in your CRM | 30 days by default, and you can change it |
| The lead's attribution: source, medium, campaign and channel | Your reports and CRM | While your account is open |
What we never collect
No third party cookies, no device fingerprinting, no tracking across other websites, and no keystrokes, scrolls or session recordings. Visitor IP addresses are used for a moment to apply rate limits and are not stored.
Matching without contact details
If you'd rather no names or email addresses reach us at all, switch a site to visitor ID matching. Your form tool creates the CRM record and Sourcream adds the source to it using the visitor ID.
Hosted on Cloudflare, stored in Oceania
The tracking script, the dashboard and our API run on Cloudflare's network, so requests are handled at the Cloudflare location closest to each visitor. Our database is located in Cloudflare's Oceania region.
Database backups are kept for 30 days for disaster recovery and then expire.
Protection in place today
- HTTPS for every request, on every domain we run.
- CRM credentials encrypted with AES 256 GCM before they are stored.
- Passwords hashed with PBKDF2 at 100,000 iterations.
- Login, verification and invite links stored only as hashes.
- Each account's data separated, with owner, admin, member and viewer roles.
- Webhooks signed so your endpoint can verify them.
- Rate limits and hourly caps on every public endpoint.
Who else handles the data
We use a small number of providers to run Sourcream. Your CRM and any webhook you add receive lead data because you connect them.
| Provider | What for | What they receive |
|---|---|---|
| Cloudflare | Hosting, database and sending our emails | Everything stored in Sourcream, and the emails we send you |
| Stripe | Subscriptions and payments | Your billing contact and payment details. We never see full card numbers |
| Anthropic | AI categorisation on Business plans and above | Referring host names such as news.ycombinator.com. Never page addresses, UTM values or personal information |
| Your CRM and webhooks | Delivering leads, at your request | The lead and its attribution |
Consent
Each site can run without a banner, wait for consent, or follow Google Consent Mode. Before consent the script stores nothing and sends nothing. Use a consent mode for EU and UK visitors.
Consent guideAustralian Privacy Principles
We handle personal information under the Privacy Act 1988. Our privacy policy covers your rights and how to make a complaint.
Reporting a security issue
If you think you've found a vulnerability, email [email protected] with the details. Please give us a chance to fix it before telling anyone else.