Privacy Policy

This policy covers this website and the Sourcelines application. In it, we and us mean Sourcelines, the controller of the personal data described in section 3. You means the person that data is about.

Questions, requests and complaints reach us through the contact form, or through whoever you already speak to here. We answer them ourselves.

We handle personal data in two capacities and they carry different duties.

• As a controller: for this website, for demo requests and for the accounts of the people who use Sourcelines. We decide what is collected and why and this policy governs it.
• As a processor: for everything a customer loads into or generates inside the product, including their shippers, contacts, facilities, lines, loads and correspondence. That data belongs to the customer. We act on their instructions under our agreement with them. If you are a contact in a customer's records, look to that customer's privacy notice rather than this one for why they hold you.

When you ask for a demo. Your name, work email, company, optional phone number and whatever you write in the message box. You give it to us deliberately and we use it to arrange and hold that conversation.

When you use the product. Your name and email address, a hashed password and a session cookie. Server logs record request times, paths, status codes and IP addresses so we can keep the service up and investigate abuse.

When a customer connects a mailbox. With that user's explicit Google consent: the address and profile name of the connected account, OAuth tokens and the mail in the threads the product is asked to show, meaning headers, recipients, body text and timestamps. Section 5 covers this in full.

Customer freight records. Business contact details for shipper personnel, such as name, role, phone and email, alongside facilities, lines and load history, all of it supplied by the customer.

There is no advertising network here, no third-party analytics, no tracking pixel and no profiling. The only cookie this site and the product set is the one that keeps you signed in and it is strictly necessary.

• Contract: to give a customer the service they have signed up for and to run the accounts of the people who use it.
• Legitimate interests: to answer a demo request you sent us, to secure the service and to keep the records a business must keep. We have weighed those interests against your rights and they do not override them.
• Consent: for a mailbox connection, granted through Google and withdrawable at any time.
• Legal obligation: where tax, accounting or law enforcement duties require it.

Connecting a mailbox is optional and begins with the user. When it happens we request the gmail.modify scope, plus the basic email and profile scopes that tell us which address was connected.

We use that access for exactly three things:

• reading the threads with a shipper, so the record of a relationship is complete;
• sending and replying to mail the user has written and approved;
• applying labels to the messages the product has handled.

Sourcelines' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data. We do not transfer it except to provide or improve user-facing features, to comply with law or to a service provider bound by this policy. We do not use it for advertising. We do not allow humans to read it, except with the user's explicit permission, for security or legal reasons or where it has been aggregated and anonymised.

Access ends the moment it is withdrawn. Disconnect the mailbox in the product, or revoke it at myaccount.google.com/permissions. We delete the stored tokens on disconnection and any message content we had cached within 30 days.

We do not sell personal data. We share it only with the providers that make the service work, each under a contract that binds them to use it for nothing else:

• Google: mailbox access, where a user has connected one.
• Resend: delivery of the transactional mail we send, including demo requests.
• Our hosting and database providers: the servers the application and its Postgres database run on.

Beyond those, we disclose data only where the law compels us, or where it is necessary to establish or defend a legal claim. If the business is ever acquired, the data moves with it and you will be told before anything about this policy changes for you.

Data is stored on servers run by the hosting providers named in section 6. Where a transfer leaves the EEA or the UK, it is made under the European Commission's Standard Contractual Clauses or another approved mechanism.

• Demo requests: 24 months, or until you ask us to delete them.
• Account records: as long as the account exists, then 90 days.
• Customer freight data: the life of the agreement, then deleted or returned within 30 days of its end, unless the customer asks otherwise.
• Mailbox content and tokens: until disconnection, then deleted within 30 days.
• Server logs: 30 days.

Traffic runs over TLS. Passwords are stored hashed, never in a form we can read. OAuth tokens are encrypted at rest. Access to production is limited to the people who need it to run the service and each customer's data is separated by tenant, so one can never read another's. No system is perfect: if a breach affects your personal data we will notify the relevant supervisory authority within 72 hours and tell you directly where the risk to you is high.

Depending on where you live, you may have the right to see the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, to receive it in a portable form and to withdraw consent at any time without affecting what was done beforehand.

Send the request through the contact form and we will answer within 30 days. If your data sits in a customer's records, we will pass the request to that customer and help them answer it. You may also complain to your local data protection authority, though we would rather you came to us first.

We do not sell or share personal information as those terms are defined under California law and we do not use it for cross-context behavioural advertising.

We will update this policy when the product changes. The date at the top is always the current version and we will give notice of a material change before it takes effect, by email to account holders or in the product.