Privacy Policy & Terms of Service

Privacy Policy

SinoSource Ltd ("SinoSource", "we", "us", "our") is committed to protecting your personal data in accordance with the UK GDPR and the EU General Data Protection Regulation (Regulation (EU) 2016/679). This policy explains what personal data we collect, why we collect it, how we use it, and your rights as a data subject.

Data controller: SinoSource Ltd, a limited company registered in England & Wales under Company No. 17216773. Registered office: Unit A 82 James Carter Road, Mildenhall, IP28 7DE. Contact: info@getsinosource.com.

1. Data We Collect

Information you provide directly

• Contact & enquiry forms: first name, email address, company name, country, plan interest.
• Lead magnet / free guide: email address and optionally company name.
• With each form submission: sign-up and request forms (the newsletter, regulation alerts and other notifications, the Safety Gate digest, waitlists, guides and sample reports, requests made from our free tools, plan guidance, and founding or managed-service enquiries) store your IP address, your browser's user-agent string, the page that referred you, and any partner referral code you arrived with. Contact messages (the contact form, the chat widget and portal support requests) store your IP address only. We use these to detect abuse and, for a referral code, to credit the partner who referred you if you later subscribe.
• Onboarding form (post-purchase): name, company, email, language preference, niche, import volume, sales channel, compliance concerns, existing suppliers, and any freetext notes you choose to provide.
• Sourcing requests (client portal): request description and any supporting details you submit.
• Sourcing partner applications: company and contact identity, registration and location details, product or service capabilities, commercial ranges such as MOQ and lead time, EU-market experience, declarations, and any later information or documents you choose to provide. We also keep private reviewer notes, evidence status, possible conflict disclosures, and a dated decision history. Information submitted by an applicant starts as an unverified claim.

Information collected automatically

• Server logs: IP address, browser type, pages visited, referrer, and timestamps, retained by our hosting provider in standard server logs.
• Aggregate page counts: a cookieless counter records the page path, the referring site, a mobile or desktop bucket, the page language and, when our hosting provider's network supplies it, your country. It keeps only daily totals for each combination of these. It sets no cookie, stores nothing on your device, keeps no per-visit record of its own, and honours your browser's Do Not Track setting. Its requests also count towards the abuse protection described next.
• Abuse protection: to stop automated abuse, requests to our server's interfaces (the page counter, forms, sign-in and similar) count towards an hourly limit. For this our server keeps a record of your IP address, which interface you used and how many requests it received in the current hour. A few limits count requests per account, access code or email address, as well as or instead of per IP address; those records hold a one-way code made from it, not the account, code or address itself. A daily clean-up deletes the record within 8 days of your last request to that interface.
• Optional analytics on public pages: if you accept optional cookies, Google Analytics receives usage events, device/browser information, approximate location, and shortened or otherwise processed network identifiers. Our first-party product-interest analytics also records which public tools were used, referral/UTM context, and an email only when you submit one through a form. It stores your IP address with your interest profile and your browser's user-agent string with each recorded visit, which we use to recognise automated traffic and abuse. Neither analytics system runs in the authenticated portal or admin panel.
• Cookie choices: when you choose “Accept optional” or “Essential only”, our server keeps a record of the choice: a random identifier for it, the choice itself, the time, your IP address, and your browser's user-agent string. The record lets us show which choice was made and when.
• Optional live chat on public pages: if you accept optional cookies, Crisp processes chat messages, contact details you provide, and technical connection data. It is not loaded in the authenticated portal or admin panel.
• Remote fonts: public pages request font files from Bunny Fonts, which receives your IP address and browser request data in order to deliver them. See Bunny Fonts information.
• Booking a call: the booking calendar on our Book a Call page is provided by Calendly. It loads only when you choose to open it; Calendly then receives the details you enter and may set its own cookies.

Payment data

All payment processing is handled by Stripe, Inc. We never see or store your full card number, CVC, or bank details. Stripe is a PCI-DSS Level 1 certified processor. See Stripe's Privacy Policy.

2. How We Use Your Data

• To fulfil and manage your service (deliver decision reports and monitoring, process payments, send account messages and, when needed, one-time activation codes).
• To respond to contact and support enquiries.
• To send the free EU Compliance Guide you requested.
• To send transactional emails related to your account (e.g. new report available, request update).
• To receive and assess sourcing partner applications, request clarifications, maintain a private candidate network, and consider a company against a particular client brief after human review. Applying never guarantees a recommendation or a client introduction.
• To improve the website and service based on aggregate, anonymised usage patterns.
• To comply with our legal obligations (e.g. invoice retention for tax purposes).

We do not sell your personal data or share it with advertisers.

Interest scoring: only if you accept optional cookies, our product-interest analytics adds points for the public tools you use and, if you give us your email, links that score to it so we can follow up with people who are actively evaluating SinoSource. This is a form of profiling. It never produces a decision with legal or similarly significant effects on you, and you can refuse it by choosing “Essential only” or withdraw at any time through cookie settings.

3. Legal Basis Under GDPR

• Contract performance (Art. 6(1)(b)): processing necessary to deliver a subscription you have purchased.
• Legitimate interests (Art. 6(1)(f)): operating the website, preventing fraud and automated abuse (including the abuse-protection records in section 1), improving the service.
• Partner assessment (Art. 6(1)(f)): reviewing business applications, checking company claims, keeping an accountable review history, and identifying potentially relevant partners for client-specific research. We consider the interests and rights of named business contacts; optional marketing messages require a separate opt-in.
• Consent (Art. 6(1)(a)): optional cookies (beyond strictly necessary) and the analytics they enable, including the IP address and user-agent data described in section 1, and sending marketing or newsletter emails where you have opted in. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): retaining financial records as required by applicable tax law.
• Records of cookie choices (Art. 6(1)(c) and (f)): data protection law requires us to be able to show that consent was given, and we have a legitimate interest in being able to show that a refusal or withdrawal was respected.

4. Who We Share Data With

We share personal data only with the following processors and only to the extent necessary:

• Stripe (Stripe, Inc.): payment processing and subscription management. Stripe Privacy Policy.
• Hostinger: website, application, email, and database hosting.
• Brevo: transactional and opted-in marketing email delivery.
• Google (Alphabet Inc.): optional public-site analytics and Google account sign-in. Google Privacy Policy.
• Bunny.net: font delivery on public pages.
• Crisp: optional live-chat support, loaded only after optional-cookie consent.
• Cloudflare: secure delivery of the site, bot screening on anonymous enquiry forms, and delivery of AI-assisted supplier research requests.
• Anthropic: processing of AI-assisted supplier research requests. We minimise personal data included in research prompts.
• Attio: customer relationship management. We record enquiry and client contact details (name, email address, and phone number where given) to manage sales conversations and client relationships.
• Calendly: call scheduling on our Book a Call page, loaded only when you choose to open the booking calendar.

All processors are bound by data processing agreements.

International transfers: some of these providers process personal data outside the UK, including in the European Economic Area and the United States. Where personal data leaves the UK, we rely on a safeguard recognised by UK data protection law: UK adequacy regulations (which cover the EEA), the UK Extension to the EU–US Data Privacy Framework for certified US recipients, or the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. You can ask us which safeguard applies to any provider.

We may disclose personal data if required to do so by law, or in response to a valid legal request by public authorities.

Partner records: applications, private reviewer notes, and submitted documents are not a public supplier directory. Authorised SinoSource staff review them. A client may receive a limited, human-reviewed company assessment relevant to its brief; private documents and contact details are not included by default. Partner application materials are not sent to external AI services by default.

5. Cookies & Tracking

We use the following cookies and similar technologies:

• Strictly necessary (no consent needed): sino_portal_session, sino_account_session, and sino_admin_session keep you signed in, for up to 30 days or until you sign out; sino_google_oauth_state protects Google sign-in for 10 minutes. On the checkout page, Stripe sets __stripe_mid (1 year) and __stripe_sid (30 minutes) to prevent payment fraud.
• Preferences: sino_lang keeps pages in the language you are reading for 12 months. It is written whenever you load a page in English and holds the language you last chose, or English if you have not chosen one. The others are set only when you make a choice: sino_consent records your cookie choice for 12 months; sino_theme and sino_currency remember interface settings for 12 months; sino_promo_dismissed remembers that you closed a notice for 7 days. sino_consent_id (12 months) holds a random identifier for your current choice, which our server uses to match the choice to its record. Until our server confirms a new choice, sino_consent_sync (up to 30 days) makes your browser send it again on your next page view; it is deleted once the server confirms. Some short-lived interface flags use session storage, which your browser clears when you close the tab.
• Optional, only after you choose “Accept optional”: Google Analytics (_ga and _ga_*, up to 2 years); sino_analytics_consent (12 months), a signed cookie your browser cannot read with scripts (HttpOnly), which records your acceptance together with the identifier of that choice, and without which our server records no product-interest events (it also requires your current choice to still be “Accept optional” and to carry that same identifier); our product-interest analytics links your visits through that identifier and sets no cookie of its own. Earlier versions of the site set a product-interest visitor cookie, sino_vid (12 months); it is no longer set, and if your browser still has one, our product-interest analytics keeps using it until it expires or you choose “Essential only”; and Crisp live chat, which sets its own session cookies (up to 6 months). Choosing “Essential only” prevents all of these from running. Your browser does not let scripts remove sino_analytics_consent or sino_vid, so our server deletes them when it records that choice and again each time you open one of our public pages with a Cookie settings link while the choice stands. None is loaded in the authenticated portal or admin panel.
• Calendly: the booking calendar on our Book a Call page loads only when you choose to open it. Calendly may then set its own cookies, described in its privacy notice.

Changing your choice: use the Cookie settings link, which every page of our public site carries (except the self-contained portal preview, which loads no optional services), to reopen the cookie banner and change or withdraw your consent at any time. Withdrawing stops optional services from loading from that point on.

6. Data Retention

• Sign-up forms and contact messages: what you send through the sign-up and request forms and as a contact message (both listed in section 1) is stored in our own database, and each stored submission is deleted 24 months after it was stored, together with any referral record made with it. We normally store a repeat of the same sign-up form from the same email address only once, so its 24 months run from the first submission; a repeated plan-guidance request replaces the stored request and starts its 24 months again. The IP address and user-agent string stored with a submission are removed after 90 days. Onboarding details, portal sourcing requests and partner applications are kept as the other entries in this section describe.
• Product-interest analytics: IP addresses and user-agent strings are removed 90 days after the visit they came from. An interest profile and its recorded visits are deleted 12 months after your last recorded visit, or 24 months after it if you gave us your email through a form. Choosing “Essential only” stops new records at once.
• Cookie choice records: the IP address and user-agent string are removed after 90 days, and the rest of the record is deleted after 24 months.
• Abuse-protection records: deleted by the daily clean-up within 8 days of the last request they count.
• Backups: the deletions for sign-up forms and contact messages, product-interest analytics, cookie choice records and abuse-protection records run automatically every day. Encrypted database backups made before a deletion can still hold the removed data until those backups are deleted.
• Partner applications: declined applications and applications with no further engagement are scheduled for deletion or anonymisation after 24 months without activity, subject to any specific legal hold or unresolved dispute. Active profiles are reviewed at least annually for continued relevance and evidence freshness. Applicants may request correction or deletion at info@getsinosource.com; we assess the request against any applicable retention obligation. An administrator must run the documented retention review; this is not an automatic purge claim.
• Sign-in identity: retained while your portal account exists. Self-service account deletion immediately removes the login identity, linked sign-in methods, device links, verification/reset records, and links between that identity and client workspaces.
• Client workspace and service records: reports, supplier evidence, documents, messages, sourcing activity, and other engagement records are normally retained while the service is active and reviewed for deletion or anonymisation within 12 months after cancellation. These records can belong to a client organisation or be shared with other authorised users, so deleting one login identity does not erase the workspace. We may retain a record longer where the client instructs us to, another lawful basis applies, or a legal claim requires it.
• Payment records: retained for the period required by applicable UK accounting and tax law.
• Server logs: typically 30–90 days depending on hosting provider configuration.

7. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): ask us to delete your personal data where there is no compelling reason for continued processing.
• Restriction: ask us to stop actively processing your data (while retaining it) in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, you may withdraw at any time without affecting prior processing.

Delete your sign-in identity yourself: if you have a portal account, open the client portal, expand "Delete my account", and confirm. This action is immediate and irreversible for the login identity and the identity-owned records listed in section 6. It disconnects that identity from client workspaces; it does not delete shared or organisation-owned workspace records, reports, uploaded evidence, sourcing activity, or records we must retain.

To request erasure, restriction, or a copy of personal data held inside a client workspace, or to ask us to delete an eligible workspace, contact info@getsinosource.com. We will verify authority over the workspace and respond within 30 days.

8. Contact & Complaints

For all privacy matters, contact us at: info@getsinosource.com.

If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, or with the supervisory authority in the EU/EEA country where you live or work.

9. Children

SinoSource is a business service and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact info@getsinosource.com and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will email active subscribers about material changes at least 14 days before they take effect, and the date at the top of this page always shows when it last changed.

Terms of Service: the contract governing your use of SinoSource, including subscriptions, liability, and governing law, is set out in our Terms of Service.

Questions? Email us at info@getsinosource.com