Privacy Policy & GDPR
Last updated: 16 June 2026
1. Who We Are
SourcAuto is operated by EEGIX, based in Belgium as a Commanditaire Vennootschap (CommV). For GDPR purposes, we act as the Data Controller for personal data you provide when using the Service.
Contact: hello@sourcauto.com
2. Data We Collect
- Account data: name, email address, password hash (bcrypt). Collected when you register.
- Search criteria: make, model, price ranges, and other search parameters you configure.
- Usage data: last login timestamp, search run logs. Used for monitoring system health.
- Billing data: handled entirely by Paddle.com (Merchant of Record). We receive a customer ID and subscription status; we never store your card details.
- Client data: name, email, and company of clients you add (Professional/Agency plans). You are responsible for having a lawful basis to store this data.
- Analytics data: if you consent, page views and session data are collected by Google Analytics. This data is pseudonymised and governed by Google's privacy policy.
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR): processing your account data and search criteria to deliver the Service.
- Legitimate interests (Art. 6(1)(f) GDPR): system logs, security monitoring, and affiliate commission tracking.
- Legal obligation (Art. 6(1)(c) GDPR): retaining billing records as required by Belgian tax law.
- Consent (Art. 6(1)(a) GDPR): analytics cookies (Google Analytics). You may withdraw consent at any time by clicking "Manage cookies" in the footer or clearing your browser's local storage.
4. Cookies
We use the following cookies. Strictly necessary cookies are set automatically. Analytics and attribution cookies are only set after you give consent via the banner shown on your first visit.
| Cookie | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| sa_session | SourcAuto | Keeps you logged in to the application | Strictly necessary | Session (deleted on logout) |
| _ga | Google Analytics | Distinguishes unique visitors for aggregate usage statistics | Analytics (consent) | 2 years |
| _gid | Google Analytics | Distinguishes unique visitors within a 24-hour window | Analytics (consent) | 24 hours |
| _ga_* | Google Analytics | Persists session state for GA4 measurement | Analytics (consent) | 2 years |
| sref | SourcAuto | Records which affiliate partner referred you, so they receive a commission if you subscribe. Set only when you arrive via an affiliate link (/a/…). |
Attribution | 90 days |
| sref_click | SourcAuto | Links your registration to a specific affiliate click event for accurate attribution reporting | Attribution | 90 days |
Managing your preferences: You can change your analytics cookie choice at any time by clearing sa_cookie_consent from your browser's local storage (DevTools → Application → Local Storage) and reloading the page. Attribution cookies (sref, sref_click) can be deleted via your browser's cookie settings; this will not affect your existing account or subscription.
IP addresses: IP addresses used for affiliate click deduplication are immediately hashed with SHA-256 and the raw IP address is never stored.
5. Data Sharing and Sub-Processors
We do not sell, rent, or share your personal data with third parties for their own purposes. We share data only with the following processors and controllers:
- Paddle.com — payment processor and Merchant of Record, acting as a separate data controller for billing transactions. Paddle Privacy Policy.
- Google LLC (Google Analytics) — analytics processor, subject to consent. Data is collected under the EU–US Data Privacy Framework. IP addresses are anonymised before transmission. Google Privacy Policy. You may opt out globally via Google Analytics Opt-out.
- Our hosting provider — processes data as a data processor under a DPA, within the EU/EEA.
- Affiliate partners — if you were referred by an affiliate, they receive aggregated commission information (number of active subscribers attributed to them) but never your personal data or email address.
6. Data Retention
Account data is retained for as long as your account is active. If you delete your account, personal data is deleted within 30 days, except where retention is required by law (e.g., billing records for 7 years under Belgian tax legislation). Anonymised usage statistics may be retained indefinitely. Analytics data held by Google is subject to Google's data retention settings (default 14 months).
7. Your Rights
Under the GDPR you have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data ("right to be forgotten") (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent for analytics cookies at any time (Art. 7(3)), without affecting any prior processing
To exercise any of these rights, email hello@sourcauto.com. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).
8. Security
Passwords are stored as bcrypt hashes. All data is transmitted over HTTPS. Database access is restricted to application credentials. We apply principle-of-least-privilege access controls throughout. IP addresses processed for affiliate click deduplication are SHA-256 hashed and the raw address is discarded immediately.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.