Privacy Notice for www.sourcenet.io

Last updated: [date of publication]

This notice applies to our website www.sourcenet.io. Our application Capture at sourcenet.app has its own privacy notice, which you will find there.

In short: Our website sets no cookies. Fonts and images come from our own server. We count visits with Plausible, an EU-based statistics service without cookies or profiles. We only receive your e-mail address if you join our waitlist, order Capture or write to us.

1. Who is responsible

sourcenet.io UG (haftungsbeschränkt)
Paul-Klee-Str. 14, 40822 Mettmann, Germany
Managing director: Alexander Klähn
E-mail: hello@sourcenet.io

We are not required to appoint a data protection officer (Section 38 of the German Federal Data Protection Act, BDSG). For questions about data protection, write to us at the address above.

2. When you visit our website

Hosting with Cloudflare. Our website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, Cloudflare processes your IP address and technical information from your browser (such as browser type, language, the page requested and the time) to deliver the page to you and protect it against attacks. If you open the home page without a language, we send you to the German or English version based on your browser’s language setting; nothing is stored. We keep no access logs of our own.

• Legal basis: our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR).
• Processing on our behalf: Cloudflare processes the data on our behalf, under a data processing agreement.
• Transfer to the USA: Cloudflare is certified under the EU-US Data Privacy Framework; the European Commission’s standard contractual clauses apply in addition.

No cookies, no third-party fonts. Our website sets no cookies and stores nothing in your browser. We load fonts from our own server, not from Google or other providers.

Visitor statistics with Plausible. To understand how visitors find us and which pages help them, we use Plausible Analytics, a service of Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, with servers in the EU, mainly in Germany. Plausible sets no cookies, stores nothing in your browser and builds no profile of you.

• What is recorded: the page you open, the page you came from, campaign details in the link (such as utm_source), browser, operating system, device type and country. To count visits, Plausible creates an encrypted identifier from your IP address and browser details that changes every day; the IP address itself is not stored. We only see aggregated figures, never individual visitors.
• Legal basis: our legitimate interest in improving our website and our offer (Art. 6(1)(f) GDPR). You may object to this (Section 6).
• Processing on our behalf: Plausible processes the data on our behalf, under a data processing agreement. The data does not leave the EU.

3. When you join the waitlist

Waitlist and news by e-mail. Until Capture can be ordered, you can join our waitlist on our website with your business e-mail address. We will then write to you when Capture launches, and now and then with news about sourcenet.io. We are responsible for this (Section 1).

Only once you confirm. After you sign up, we send you an e-mail with a confirmation link (double opt-in). Only when you click it are you on the list; this way nobody can sign you up without your knowledge. The link is valid for 30 days. If you don’t confirm, we won’t write to you again.

How your data travels. The form sends your details to a function on our hosting at Cloudflare (Section 2); only this function passes them on to our e-mail service, Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. The page itself loads nothing from Brevo, and we do not pass your IP address on to Brevo. The links in our e-mails lead through Brevo; if you click one of them, Brevo processes your IP address.

• What is processed: your e-mail address, the language of the page and the place where you signed up (such as the home page or the pricing page). As proof of your consent, Brevo records when you signed up and when you confirmed.
• Opens and clicks: Brevo puts an invisible image into our e-mails and routes their links through its servers. It counts opens and clicks only anonymously, in total, without linking them to your address.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which Section 7(2) no. 2 of the German Act against Unfair Competition (UWG) also requires for advertising by e-mail, and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) for counting opens. We keep the proof of your consent because we must be able to demonstrate it (Art. 7(1) GDPR); for this we rely on our legitimate interest (Art. 6(1)(f) GDPR).
• Unsubscribing: You can withdraw your consent at any time, with effect for the future: through the unsubscribe link in every one of our e-mails or with a short message to hello@sourcenet.io. We then take you off the list and stop writing to you.
• Retention: as long as you are on the list. After you unsubscribe, we keep your e-mail address and the proof of your consent for three more years, only to be able to show that you had consented and so that we don’t write to you again by mistake; then we delete them. If you don’t confirm, Brevo keeps only the record of the confirmation e-mail, which is deleted after twelve months.
• Processing on our behalf: Brevo processes the data on our behalf, under its data processing agreement, on servers in the EU.

4. When you order Capture

Your e-mail address before ordering. On the pricing page, we first ask for your e-mail address. We pass it to our server at Google Cloud in Frankfurt and to Paddle to prepare your order: we check whether the introductory offer applies to you, and fill in the address in the order form for you.

• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: If you abandon the order, we don’t store the address. Our server’s technical logs are deleted after 30 days.
• Google Cloud (Google Cloud EMEA Limited, Dublin, Ireland) processes the data on our behalf in Frankfurt.

Paying through Paddle. Our order process is conducted by our online reseller Paddle.com (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom); Paddle is the Merchant of Record for all our orders. You enter your name, address, e-mail address, VAT ID and payment details directly with Paddle. Paddle processes them as an independent controller to handle the purchase, issue invoices, account for taxes and prevent fraud. For this, our pricing page loads Paddle’s software (Paddle.js); Paddle may use cookies or similar technologies needed for the payment. How Paddle handles your data is described in Paddle’s privacy notice.

• What we receive from Paddle: that you bought and what, your e-mail address, your company’s name and the status of your subscription. We use this to set up your workspace.
• Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for Paddle.js also Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary for the payment you asked for.
• After the purchase, Capture’s privacy notice applies to your account and your workspace.

5. When you write to us

If you send us an e-mail, we process your address, your name and your message to reply to you. Our e-mail runs on Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland), which processes it on our behalf.

• Legal basis: your enquiry and, where applicable, a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
• Retention: until your request has been dealt with; longer where commercial or tax law requires it (six years for business letters, ten years for accounting records).
• Transfer to the USA: Google may also process data in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the standard contractual clauses apply in addition.

6. Your rights

You have the right

• to access your data (Art. 15 GDPR),
• to have incorrect data rectified (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to have processing restricted (Art. 18 GDPR),
• to receive your data in a common format (Art. 20 GDPR),
• to object to processing based on our legitimate interest (Art. 21 GDPR),
• to withdraw your consent at any time, with effect for the future (Art. 7(3) GDPR).

To exercise them, write to us at hello@sourcenet.io.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

7. Changes

If our website or the law changes, we update this notice. The version published here applies.

This English version is provided for your information; the German version is binding.