Last updated: 14 October 2026
Sourso (“Sourso”, “we”) is an AI marketing assistant at trysourso.com and the app at app.trysourso.com. This policy says what we collect, what we do with it, who else sees it, and what you can do about it. It covers the website and the app.
1. What we collect
| What | When | Examples |
|---|---|---|
| Account | When you sign up or sign in | Name, email address, the sign-in provider's user id |
| What you give the app | While you use it | Messages to your AI CMO, files you upload, brand details (positioning, competitors, audience, questions), rules you set, edits you make to drafts |
| Connected accounts | Only after you connect one | Site files from GitHub or your server; posts and account metrics from Xiaohongshu or Toutiao; search and traffic numbers from Google Search Console, Google Analytics, Bing Webmaster Tools and Baidu Tongji; page submissions to Baidu and Bing |
| Collected on your behalf | When an agent runs | Answers from AI search engines and search results about your brand, gathered through third-party data providers |
| Usage and logs | Automatically | Pages opened, actions taken, agent runs, token usage, errors, IP address, browser type |
We do not collect payment card numbers; the product is free during the beta.
2. How we use it
- To run the product: understand your brand, collect signals, write drafts, build reports, publish where you ask us to.
- To show your AI CMO what it needs: your brand's data is given to the AI models that power it, for your workspace only.
- To keep the service working: debugging, abuse prevention, capacity planning.
- To talk to you about the service: onboarding, changes, problems. No marketing email without your consent.
We do not sell your data. We do not use your data, or data from your connected accounts, to train AI models.
3. Data from Google (Search Console and Google Analytics)
If you connect a Google account, Sourso asks for these permissions and uses them only as described:
- Read your Search Console data (
webmasters.readonly): once a day we read the site's search performance (clicks, impressions, position, queries, pages) to produce the search traffic report for that site's workspace. - Read your Google Analytics data (
analytics.readonly): once a day we read the property's traffic (sessions, users, channels, landing pages, source and medium) to produce the website traffic report. - Your email address and identity (
openid,email): to show which account is connected and to tell accounts apart. - Only when you click the setup button for a site or property that does not exist yet, we ask for the extra permissions to verify a site and add it to Search Console (
siteverification,webmasters) or to create a Google Analytics property (analytics.edit). We do not change anything else in your Google account.
What happens to the data:
- It is stored in your own Sourso tenant's database, separate from every other customer's, on servers in Singapore (Amazon Web Services).
- Your Google access tokens are encrypted with a key that belongs to your tenant alone. No Sourso staff member can read them.
- The numbers are used only to produce reports in the workspace you connected them to, and to let your AI CMO talk about those reports with you. Headline figures from a report may appear in that conversation and are then processed by the AI model provider like the rest of the conversation; raw rows are never sent to a model provider.
- They are not shared with anyone else, not used for advertising, not sold, and not used to train models.
- Nobody at Sourso reads your Google data except to fix a problem you asked us to look at, with your permission.
- You can disconnect at any time from Settings → Connections, or revoke Sourso at myaccount.google.com/permissions. Disconnecting deletes the stored tokens; deleting the workspace deletes the numbers; deleting your account deletes everything.
Sourso's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Other connected accounts
The same rules apply to every account you connect: Bing Webmaster Tools and Baidu's platforms (an API key or token you paste in), GitHub and your own server (a token or password you give us), Xiaohongshu and Toutiao (you sign in once in a browser that runs inside your tenant). Credentials are encrypted with your tenant's key, used only for the workspaces you grant them to, and deleted when you disconnect. Sourso publishes to an account only when you approve a specific draft; a page you tell us to submit to a search engine is submitted as it is.
5. Who else processes your data
We use these providers to run the service. Each one receives only what its job needs.
- AI model providers (Anthropic, OpenAI, Google, ByteDance Volcano Engine, DeepSeek, reached through a relay): the conversation with your AI CMO and the brand material it works from.
- DataForSEO: the search queries your agents run to see how your brand appears in search engines and AI answers.
- Amazon Web Services (Singapore): hosting and backups.
- TezSign: signing the agreement when you hire a third-party agent from the marketplace.
We may also disclose data when the law requires it, or to protect the service and its users from abuse.
6. How long we keep it
- Your workspace data stays as long as the workspace exists. Deleting a workspace deletes its brand data, signals, drafts, reports, connection grants and collected numbers.
- Deleting your account deletes your tenant and everything in it within 30 days. Backups are rotated out within a further 30 days.
- Server logs are kept for 30 days.
7. Security
Every customer runs in a separate, isolated tenant. Traffic is encrypted in transit (HTTPS). Secrets and connected-account credentials are encrypted at rest with per-tenant keys. Access to production is limited to the people who run it. No system is perfectly secure; if we learn of a breach that affects you, we will tell you.
8. Your choices and rights
- See and edit what Sourso knows about your brand and about you in the app (Brand, Know-how, Settings).
- Disconnect any account at any time.
- Delete a workspace or your whole account from the app, or ask us to.
- Ask for a copy of your data, or for correction or deletion, through the contact page. We answer within 30 days.
If you are in the European Economic Area or the United Kingdom, these are your rights under the GDPR; our legal basis is the contract with you (running the service) and our legitimate interest in keeping it working and safe. If you are in China, we handle personal information under the Personal Information Protection Law; data of users in mainland China may be stored outside mainland China, in Singapore, as described above.
9. Children
Sourso is for businesses and professionals and is not directed at anyone under 18.
10. Changes
When this policy changes in a way that matters, we will say so in the app or by email before it takes effect. The date at the top is the date of the current version.
11. Contact
Questions about privacy: use the contact page.