PRIVACY POLICY
Last updated: 28 September 2026
This policy explains what personal data SourcePilot Ltd collects when you visit sourcepilot.ai (the "Site") or contact us through it, why we collect it, and your rights in relation to it. It applies to the Site only. The SourcePilot platform, and the customer and engineering data processed in it, are governed by the agreement between SourcePilot and each customer organisation, including its data processing terms; this policy does not cover them.
1. Who is responsible for your data
SourcePilot Ltd, company number 15839438, registered at Second Floor, Windsor House, 40/41 Great Castle Street, London W1W 8LU, United Kingdom, is the controller of personal data collected through the Site. For any question about this policy or your data, write to hello@sourcepilot.ai.
2. The data we collect
When you browse the Site. The Site uses Framer's built-in analytics to understand how many people visit and which pages are read. This service does not use cookies and does not create persistent identifiers: your IP address and browser details are hashed with a secret that changes every day, so individual visitors cannot be identified or tracked over time. We see aggregated figures only — page views, approximate country, device type, referring site. Our hosting provider also keeps standard server logs (IP address, time, pages requested) for security and to keep the Site running.
When you contact us or request a demo. If you complete a form on the Site we collect the information you enter: typically your name, email address, company, job title, the size of your engineering team and the details of your enquiry. If you email us directly, we hold your email and its contents.
Cookies. The Site itself does not set cookies and does not use advertising or social-media tracking. The embedded Calendly scheduler on our Book a demo page is provided by Calendly and may set cookies needed to run the booking calendar; Calendly shows its own cookie notice inside the calendar, where you can accept or decline non-essential cookies. We do not profile visitors, and we do not knowingly collect data from anyone under 16.
3. Why we use it and on what legal basis
We use analytics and server-log data to operate, secure and improve the Site. Our legal basis is our legitimate interest in running a reliable, secure website and understanding how it is used; the data is aggregated or hashed so that this interest does not override your privacy.
We use the information you send through a form or by email to reply to you, to arrange a demo or meeting, and to follow up on your enquiry about SourcePilot. Our legal basis is our legitimate interest in responding to business enquiries and, where you have asked us to contact you, the steps you request before entering into a contract. We will not add you to any marketing list without your consent, and any marketing email we send includes an unsubscribe link.
4. Who processes it on our behalf
We use a small number of service providers to run the Site and handle enquiries. They process data only on our instructions and under contracts that require them to protect it:
• Framer B.V. (Netherlands) — hosts the Site, provides the cookieless analytics described above and stores form submissions.
• Google LLC (Google Workspace) — our email and calendar provider, through which we receive and answer enquiries and hold booked meetings.
• Calendly LLC (United States) — the scheduling tool on our Book a demo page, which collects the name, email address and meeting time you enter to book a call with us. Calendly's own privacy notice applies to its service, and the embedded calendar shows its own cookie notice.
We do not sell personal data, and we do not share it with anyone else except where the law requires it, to protect our rights, or with your consent.
5. How long we keep it
Analytics data is held in aggregated form only. Server logs are kept for a short period for security purposes and then deleted. Enquiry and demo-request details are kept for as long as we are in contact with you about SourcePilot and for up to 24 months after our last exchange, unless you ask us to delete them sooner or a contract with your organisation requires us to keep them longer.
6. Where it is processed
SourcePilot operates from the United Kingdom and Spain. Our service providers may process data in the European Economic Area and, in some cases, in other countries, including the United States. Where personal data leaves the UK or EEA, we rely on the safeguards recognised under UK and EU data-protection law, such as adequacy decisions and standard contractual clauses, and on the contractual commitments of our providers.
7. Your rights
Under UK and EU data-protection law you can ask us to confirm what personal data we hold about you, to give you a copy, to correct it, to delete it, to restrict or object to how we use it, and, where applicable, to provide it in a portable format. You can withdraw any consent you have given at any time. To exercise any of these rights, email hello@sourcepilot.ai; we will respond within one month. If you are not satisfied with our response you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the supervisory authority in the country where you live or work.
8. Security
We take reasonable technical and organisational measures to protect the data we hold, including access controls, encryption in transit and the security measures of the providers named above. No transmission over the internet is completely secure, and we cannot guarantee the security of data sent to the Site.
9. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If a change materially affects how we use your data, we will say so on this page.
10. Contact
SourcePilot Ltd · Second Floor, Windsor House, 40/41 Great Castle Street, London W1W 8LU, United Kingdom · hello@sourcepilot.ai