Privacy Policy

1. Who we are

SourcingHQ is operated by Sourcing HQ AI Pvt Ltd, a company based in Mumbai, India, trading as "SourcingHQ" ("we", "us"). We decide how and why the personal data described in this policy is used, except where section 2 says otherwise.

Contact for privacy questions and complaints addressed to our grievance officer: contact@sourcinghq.ai

2. Whose data we hold

SourcingHQ is a business tool. We hold personal data about four groups of people:

• Customers and their team members. People who create a SourcingHQ account for their business, and colleagues they invite to it.
• Suppliers. People at supplier businesses whom our customers invite to submit prices. Suppliers do not create an account. We receive their details from the customer who invites them, and we email them on that customer's behalf.
• People named in forwarded enquiries. Customers can forward an email from their own customer to SourcingHQ so we can turn it into a draft request. That email may contain the sender's name and contact details.
• Website visitors. Anyone who visits sourcinghq.ai.

3. What we collect

Customers and team members

• Account details: name, work email, company name and country. If you sign in with Google, we receive your name and email from Google. If you use a password, it is stored only in hashed form by our authentication provider.
• Content you create: quote rounds, line items, quantities, specifications, price ceilings, attachments, supplier lists, notes, reports, and messages you exchange with the in-product AI assistant.
• Forwarded enquiries: the forwarding address, sender address, subject line, and the draft request we produce. We read the body and attachments of a forwarded email only while turning it into a draft; we do not store the original email body or its attachments.
• Billing records: the plan or pack bought, the amount, currency, date, and payment and customer references from our payment provider. We never receive or store your card or bank details; Dodo Payments collects them directly.
• Usage and device data: pages visited, features used, errors, browser and device type, approximate location from IP address, and a record of important actions in your account (for security and dispute resolution).

Suppliers

• Contact details the customer gives us: name, email, company name, and any other details the customer adds.
• What you submit: your bids, and any documents you upload to a quote round.
• Email and link activity: whether our emails to you were delivered, bounced or marked as spam, whether you opened them, and when you first opened your bid page. Opens are measured with a small image loaded from our own website when the email is displayed. Mail providers often load images automatically, so an open is only a rough signal. We do not use click tracking, and we do not use our email provider's own open tracking.
• Public business information: when a customer asks the AI assistant to find suppliers, we search the public web and may show a business's name, location, website and any publicly listed contact details.

Website visitors

Pages visited, how you arrived (for example, a search engine), browser and device type, and approximate location, collected through the analytics tools in section 7.

We do not ask for, and customers must not upload, sensitive personal data such as health, financial account or government ID information.

4. How we use it

• To run the Service: create and run quote rounds, show bids to the customer who invited you, produce reports, and manage accounts and teams.
• To send emails that make the Service work: account confirmations, team invitations, supplier invitations, bid confirmations, alerts and results. We do not send marketing email to suppliers.
• For AI features: drafting requests, reading forwarded enquiries, summarising results, answering questions in the assistant, and suggesting suppliers. A person always reviews AI output before anything is sent.
• For billing: to process purchases, refunds and plan limits.
• For security: to detect abuse and fraud, protect accounts (including checking new passwords against lists of known leaked passwords), and keep a record of important actions.
• To improve the product: we study how the product is used, in aggregate, to fix problems and decide what to build.
• For legal reasons: to meet tax, accounting and other legal obligations and to handle disputes.

We do not sell personal data, we do not use it for advertising, and we do not use customer or supplier content to train AI models.

5. Services we share it with

We use the following service providers to run SourcingHQ. Each receives only what it needs for its job.

• Supabase (database, sign-in and file storage): all account data, content, bids and attachments.
• Vercel (website hosting): requests to our website, including IP address and browser details.
• Resend (email sending and receiving): the name, email address and content of emails we send, and forwarded enquiries we receive.
• OpenRouter, and the AI model providers it routes to (AI features): quote-round titles, line items, quantities, units, price ceilings, bid amounts, currency and dates. In automated summaries, supplier names are replaced with labels such as "Supplier A" before anything is sent. In the AI assistant chat, real supplier names are sent, because the customer is asking about specific suppliers.
• Tavily (web search for supplier suggestions): the search terms, such as a product and location. We do not send customer or supplier names in search terms.
• Dodo Payments (payments, as merchant of record): collects your billing details, card or bank information and tax details directly, under its own privacy policy.
• Google: Google sign-in (if you choose it) and Google Analytics (see section 7).
• PostHog (product analytics and error tracking; see section 7).
• Have I Been Pwned (leaked-password check): only a short fragment of a hashed password is sent, never the password or your email.

We may also share personal data if the law requires it, to protect the rights and safety of our users or others, or with a successor if SourcingHQ is transferred to a company or sold. We will tell you before your data becomes subject to a different privacy policy.

Between customers and suppliers: a supplier's bids and documents are visible to the customer who invited them. Suppliers in a quote round cannot see who else is bidding; depending on how the customer sets up the round, they may see the current lowest price without knowing whose it is. A customer's data is never visible to other customers.

6. Where it is stored

Our main systems (database, hosting and analytics) are located in the United States. Our other providers may process data in the United States and other countries. By using SourcingHQ, your personal data will be transferred outside India and outside your own country. We only use providers that commit to protecting it, and we do not transfer personal data to any country the Government of India has restricted.

7. Cookies and analytics

• Essential cookies keep you signed in and secure. The Service cannot work without them.
• Google Analytics measures visits to our website, with advertising features and Google signals turned off. It is not loaded on supplier bid pages or other pages whose web address contains a private link, and private link codes are removed before anything is sent to Google.
• PostHog helps us understand how the product is used and catch errors. It may record sessions to show how pages are used, with prices, names, email addresses and anything typed into forms masked out. Signed-in customers are linked to their account; suppliers are never identified.

We do not currently show a cookie banner. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on. Blocking essential cookies will stop you signing in.

8. How long we keep it

• Account data and content: for as long as the account is open. After an account is closed, we delete or anonymise it within 90 days.
• Supplier data: kept as part of the inviting customer's records, for as long as that customer's account is open, then deleted or anonymised within 90 days of closure.
• Forwarded enquiry emails: the original body and attachments are not stored. The draft request made from them is kept like other content.
• Billing records: kept for as long as tax and accounting law requires.
• Security and activity records: some records of important actions are kept for security and dispute resolution; when an account closes, personal details in them are anonymised rather than deleted.
• Backups: deleted data may remain in encrypted backups for a limited period before being overwritten.

9. Your rights and how to use them

Depending on where you live, you have the right to:

• get a summary of the personal data we hold about you and who we have shared it with;
• have inaccurate or incomplete data corrected or updated;
• have your data erased, where we no longer need it or you withdraw consent;
• withdraw consent at any time, as easily as you gave it (this does not affect processing already done);
• nominate someone to exercise your rights if you die or become unable to (India);
• object to or restrict certain processing, and receive your data in a portable format (EU and UK).

To use any of these rights, email contact@sourcinghq.ai from the address we hold for you, or tell us how else we can confirm who you are. We will respond within 30 days.

If you are a supplier: you can ask us to stop sending you invitations, or to remove your details, by emailing contact@sourcinghq.ai. Your bids form part of the inviting customer's business records, so we may need to pass your request to that customer, and we may keep an anonymised record of the bid.

Complaints. If you are not satisfied with our response, you can complain to the Data Protection Board of India, or, in the EU or UK, to your local data protection authority.

10. Children

SourcingHQ is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We may update this policy. We will post the new version on this page with a new date, and for significant changes we will email account holders before the change takes effect.

12. Contact

Questions, requests and complaints: contact@sourcinghq.ai