Privacy Policy

1. Introduction

SourceStream ("we," "us," or "our") operates the marketing attribution platform at sourcestream.io. This Privacy Policy explains how we collect, use, store, and protect personal information when you interact with our platform or when your data is processed through our service.

2. Who This Policy Applies To

This policy covers two groups of people:

A. SourceStream Account Holders ("Customers")

If you create an account on sourcestream.io, subscribe to a plan, or use our dashboard, you are a Customer. We collect your information directly when you sign up and use our platform.

B. Website Visitors ("Tracked Visitors")

If you visit a website that uses SourceStream's tracking script, certain browsing data (such as the page you visited, referring source, and UTM parameters) may be collected and associated with a first-party cookie on that website. This data is collected on behalf of the website owner (our Customer), not by SourceStream for our own purposes.

If you are a Tracked Visitor and have questions about how a specific website uses SourceStream, please contact that website's owner directly. Their privacy policy governs their use of your data.

3. Information We Collect

3.1 Information from Customers

When you create an account or use our platform, we collect:

• Account information: name, email address, and password (hashed).
• Billing information: payment card details are processed by our payment provider (Stripe). We do not store full card numbers. We retain your billing name, billing email, and subscription status.
• Usage data: pages you visit within our dashboard, features you use, and actions you take.
• Technical data: IP address, browser type, operating system, and device information.
• Communication data: any emails, support requests, or messages you send us.

3.2 Information from Tracked Visitors

When a website uses SourceStream's tracking script, the following data may be collected from visitors to that website:

• Attribution data: referring URL, UTM parameters (source, medium, campaign, term, content), landing page URL, and click identifiers (gclid, fbclid, msclkid, etc.).
• Session data: pages visited on the customer's website, session duration, and timestamps.
• Technical data: browser type, operating system, screen resolution, and device type.
• Cookie identifier: a randomly generated unique ID stored in a first-party cookie (_ss_uid) on the customer's domain.

We do not collect from Tracked Visitors:

• Names, email addresses, or other personally identifiable information (unless submitted via a form on the customer's website, in which case the customer controls that data).
• Cross-site browsing history. Our cookie is first-party only and does not track visitors across different websites.
• Financial information or sensitive personal data.

3.3 Information Collected Automatically

Our servers automatically log certain information when you access sourcestream.io, including your IP address, request timestamps, referring URLs, and browser user-agent strings. These logs are used for security monitoring and are retained for a limited period.

4. How We Use Your Information

4.1 For Customers

We use your information to:

• Provide, operate, and maintain your SourceStream account and services.
• Process subscription payments and manage your billing.
• Send essential service communications (account verification, billing receipts, security alerts, service updates).
• Provide customer support and respond to your inquiries.
• Improve our platform based on usage patterns and feedback.
• Detect, prevent, and address security threats, fraud, and abuse.
• Comply with legal obligations.

4.2 For Tracked Visitor Data

We process Tracked Visitor data solely on behalf of our Customers. We use this data to:

• Provide marketing attribution analytics to the Customer who installed the tracking script.
• Populate hidden form fields with attribution data when a visitor submits a form on the Customer's website.
• Generate aggregate reports and insights for the Customer.

We do not use Tracked Visitor data for our own marketing or advertising purposes. We do not sell this data. We do not build profiles of Tracked Visitors for any purpose beyond serving our Customer.

5. Data Processing on Behalf of Customers

When handling Tracked Visitor data, SourceStream acts as a data processor. Our Customers are the data controllers who determine the purposes and means of processing.

Our obligations as a processor are detailed in our Data Processing Agreement (DPA), which governs how we handle personal data on behalf of Customers. Key commitments include:

• We process personal data only according to our Customer's instructions.
• We implement appropriate technical and organisational security measures.
• We assist Customers in fulfilling data subject access requests.
• We delete or return all personal data upon termination of the service agreement.
• We notify Customers promptly of any data breach affecting their data.

6. Cookies and Tracking Technologies

For detailed information about all cookies used by SourceStream, please see our Cookie Policy.

6.1 On the SourceStream Platform (sourcestream.io)

We use the following cookies on our own website:

• Session cookies: to maintain your login session and authenticate requests.
• CSRF cookies: to protect against cross-site request forgery attacks.
• Authentication tokens: secure tokens to authenticate API requests from your browser.

All cookies on sourcestream.io are strictly necessary for the platform to function. We do not use advertising or analytics cookies on our own site.

6.2 On Customer Websites

When a Customer installs our tracking script, it sets a single first-party cookie:

Cookie Name	Type	Duration	Purpose
_ss_uid	First-party	365 days	Assigns a random visitor ID to attribute marketing touchpoints across sessions on the same website.

This cookie is set on the Customer's domain, not on sourcestream.io. It cannot be used to track visitors across different websites.

7. Data Sharing and Disclosure

We do not sell personal data.

We may share data in the following limited circumstances:

• Service providers: We use third-party providers who assist in operating our platform (e.g., cloud hosting, payment processing, email delivery). These providers are contractually bound to protect your data and use it only for the services they provide to us.
• Legal requirements: We may disclose information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: If SourceStream is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.
• With your consent: We may share information when you explicitly direct us to do so.

Third-Party Processors

Our current list of third-party processors includes:

• Stripe — payment processing
• Amazon Web Services (AWS) — infrastructure hosting
• Postmark / SendGrid — transactional email delivery

We review our sub-processors regularly and will update this list as it changes.

8. Data Retention

Customer Data

We retain your account information for as long as your account is active. If you cancel your subscription, we retain your data for up to 30 days to allow for reactivation. After that, your data is deleted from our active systems. Backups may persist for up to 90 additional days before being overwritten.

Tracked Visitor Data

Attribution and session data collected by the tracking script is retained for the duration of the Customer's active subscription. When a Customer's account is terminated, all associated Tracked Visitor data is deleted within 30 days.

Server Logs

Automated server logs (IP addresses, request data) are retained for up to 90 days for security and debugging purposes, then deleted.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of data at rest for sensitive fields.
• Secure password hashing using bcrypt.
• Role-based access controls for our internal systems.
• Regular security reviews and dependency updates.
• Automated monitoring and alerting for suspicious activity.

No system is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. If you discover a security vulnerability, please report it to [email protected].

10. International Data Transfers

SourceStream is based in South Australia, Australia. If you access our platform from outside Australia, your information may be transferred to and processed in Australia or other countries where our service providers operate.

We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs) regarding cross-border disclosure of personal information. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient complies with the APPs or is subject to a substantially similar privacy regime.

11. Your Rights

Under the Australian Privacy Act

SourceStream is based in South Australia and complies with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). You have the following rights:

• Right of access: You may request access to the personal information we hold about you (APP 12).
• Right to correction: You may request that we correct any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading (APP 13).
• Right to complain: If you believe we have breached the APPs, you may lodge a complaint with us. If you are not satisfied with our response, you may escalate the complaint to the Office of the Australian Information Commissioner (OAIC).

General Rights

Regardless of your location, you can:

• Access your data: Request a copy of the personal information we hold about you.
• Correct your data: Request correction of inaccurate or incomplete information.
• Delete your data: Request deletion of your personal information. For Customers, you can delete your account from the Settings page or contact us.
• Export your data: Request your data in a commonly used, machine-readable format.

For Customers: Contact us at [email protected] to exercise any of these rights. We will respond within 30 days.

For Tracked Visitors: Because we act as a data processor on behalf of our Customers, please direct your request to the website that uses SourceStream's tracking script. If you contact us directly, we will help identify the relevant Customer and assist in fulfilling your request.

12. Children's Privacy

SourceStream is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify Customers via email for significant changes.

Your continued use of SourceStream after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy, your data, or your rights, contact us at:

• Email: [email protected]
• Website: sourcestream.io

For Australian privacy inquiries, you may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.