Website privacy notice

This notice explains how SourceSignal handles personal information when you browse this website, submit an enquiry or contact us by email. How we handle the public reviewer material our research is built on is described in a separate research privacy notice.

Who is responsible

SourceSignal is an independent project operated by Hugo W, who is responsible for the personal information covered by this notice.

For privacy questions or requests, email contact@sourcesignal.io.

Enquiries and email

When you submit an enquiry, we receive your email address and the information you provide, such as your product, competitors, research interests and message. If you email us directly, we receive your email address, message and any attachments.

We use this information to respond, assess your request and discuss the scope of a potential report. Providing information is voluntary, but we need a contact address and sufficient details to respond.

Legal basis: our legitimate interests in responding to business enquiries and discussing the services you ask about.

Submitting an enquiry does not subscribe you to a marketing mailing list. We do not sell or rent your enquiry contact details.

Please avoid including sensitive personal information or confidential material in website forms.

Website operation and security

When you visit the website, the services delivering its pages and resources receive technical information, including your IP address. Our API logs include the client IP address, requested address and time. Temporary rate-limit records help prevent excessive requests.

We use this information to deliver the website, troubleshoot problems and protect it against misuse.

Legal basis: our legitimate interests in operating the website reliably and keeping it secure. We keep only what that needs, for the short periods set out below.

Cookies and browser storage

The website uses local storage to remember your light or dark appearance preference (ss-theme) and your analytics choice (ss-consent). These stay in your browser and are not sent to us.

You can remove these settings through your browser. Removing them may reset your preferences. The only cookies the website sets are the Google Analytics cookies described below, and only if you allow analytics.

Optional analytics

With your consent, we use Google Analytics to understand how visitors use the website. Analytics is not required to browse or submit an enquiry.

Analytics may process page addresses, referrers, browser and device information, and technical information associated with your requests. It uses cookies, including _ga cookies. We do not send enquiry-field contents to analytics.

We do not load Google Analytics before you consent. You can withdraw consent through Cookie settings in the footer. This stops future analytics collection and removes analytics cookies accessible to this website. It does not automatically delete information already collected.

Legal basis: your consent.

Analytics retention: Google Analytics keeps event-level data for two months under our property settings. Its cookies (_ga and _ga_<ID>) last up to two years unless you delete them or withdraw consent.

Service providers and international transfers

We use service providers to host the website, deliver resources, process enquiries and handle email:

• Vercel: hosts and delivers the website.
• Cloudflare: domain name services, and delivery of research files.
• Server hosting in an EU data centre: our API and the database that stores enquiries.
• Email hosting in an EU data centre: our mailbox.
• Google: Google Analytics, only if you allow it.

Our API, enquiry database and email are hosted in the EU. Vercel, Cloudflare and Google are US-based companies, and information they process may be handled outside the EEA. Where it is, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Contact contact@sourcesignal.io for more information about these safeguards.

How long we keep information

We retain information for the purposes described in this notice, using the following periods or criteria:

• Enquiries and email: until your enquiry is resolved, and no longer than six months after we last corresponded about it. If you become a client, what that work needs is kept under the terms we agree.
• Technical and security logs: 30 days.
• Temporary rate-limit records: records idle for more than ten minutes are removed during periodic cleanup.
• Browser preferences: they stay in your browser until you clear them; they have no expiry.
• Analytics: as described above, if enabled.

Deleted information can remain in database backups until those backups are replaced. We do not restore it from a backup except to recover from a failure.

Your rights

Depending on the circumstances, you may request access to, correction or deletion of your personal information, restriction of processing, or a portable copy. You may also object to processing based on legitimate interests.

Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

Send requests to contact@sourcesignal.io. We may ask for information reasonably necessary to verify your identity.

You may complain to a competent data protection authority.

Changes to this notice

We update the date above when this notice changes.