Privacy policy
Last updated: 2 November 2026
This policy explains how SourceKB ("we") handles personal data. It applies to our own website, to our dealings with clients and prospects, and to the accounts our clients' staff use. It also explains our role when you chat with an assistant on a hotel's or business's website that runs on SourceKB.
1. Who we are
SourceKB
Switzerland
Not entered in the commercial register
Email: info@sourcekb.com
2. If you used a chat assistant on another business's website
SourceKB provides chat assistants that businesses (for example hotels) put on their own websites. When you use one of those assistants, the business is responsible for your data (it is the "controller"). We process it only on its behalf and on its instructions (we are its "processor").
In short, for those assistants:
- What we store. We store the messages you type, the replies, the language you chose, the time, and any "helpful / not helpful" feedback you give. We do not ask for your name, email or phone number.
- No cookies. We do not set cookies or use your browser's storage. We do not store your IP address in our database. We use it briefly in memory to protect the service from abuse.
- No AI-generated answers. The answers come from information the business has approved. They are not written by an AI model, and your messages are not used to train AI models.
- Deletion. Conversations are deleted automatically after the period the business sets (90 days by default). Backups roll off within a further 14 days.
- Location. The data is hosted in Finland (EU).
To exercise your rights over a conversation, please contact the business whose website you were on. Its privacy notice explains how. If you contact us directly, we will pass your request to that business. To help it find your conversation, say roughly when you chatted, on which page, and what you asked.
3. What we process as controller, and why
| When | Data | Purpose | Legal basis (where the GDPR applies) |
|---|---|---|---|
| You visit sourcekb.com | Your IP address and the page you ask for, used only to deliver the page. Our web servers keep no access logs. If you send the contact form, your IP address is also held briefly in memory to limit abuse. | Delivering and securing the website | Legitimate interests (Art. 6(1)(f) GDPR) |
| You send our website contact form | Name, email, your website (optional), your message | Answering your enquiry. The form is emailed to us through Scaleway and is not stored in our website or chat database. | Legitimate interests / steps before a contract (Art. 6(1)(f) and (b)) |
| You book a demo call | Name, email, organisation and website (both optional), the time you pick, and the Google Meet link for the call | Arranging and holding the call. Bookings are handled by Google Calendar and confirmed by email. | Steps before a contract / legitimate interests (Art. 6(1)(b) and (f)) |
| You contact us or become a client | Name, business, email, phone, correspondence, contract and billing details | Answering you, entering into and performing a contract, invoicing | Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
| You have a staff account (as a client's employee or representative) | Email, role, which client(s) you can access, hashed password, sign-in times, review notes and decisions you record | Providing secure access to the review tools; keeping a record of who approved which content | Contract with your employer / legitimate interests (Art. 6(1)(b) and (f)) |
We do not sell personal data, and we do not use it for advertising.
4. Cookies and tracking
Our website does not set cookies or use your browser's storage, and it uses no analytics or advertising. Its fonts load from Google Fonts, so your browser sends your IP address to Google when you open most pages. The SourceKB assistant on our own website is the same product we provide to clients: it sets no cookies and uses no browser storage.
The chat assistant we provide to clients sets no cookies and uses no browser storage.
5. Who receives data
We use the following service providers, who process data on our behalf under contract:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting and encrypted backups | Finland (EU) |
| Google LLC (USA) | Google Fonts, for the website's fonts. Your browser sends Google your IP address. | USA |
| Scaleway SAS (France) | Sending sign-in emails, and forwarding website contact-form messages to our mailbox | France |
| GitHub, Inc. (USA) | Source code and deployment pipeline. Not intended to receive personal data of chat users. | USA |
| Google LLC (USA) | Google Calendar and Google Meet for booking and holding demo calls, and Gmail, the mailbox our contact form and info@ address forward to | USA |
| Porkbun LLC (USA) | Domain and email forwarding | USA |
We may disclose data to authorities where the law requires it, or to advisers (for example lawyers and auditors) bound by confidentiality.
6. Transfers abroad
Our main hosting is in the European Economic Area, which Switzerland recognises as providing adequate protection. Google LLC and GitHub, Inc. are certified under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, and we rely on that certification for transfers to them.
7. How long we keep data
- Chat conversations on clients' websites: as set by each client (90 days by default), plus up to 14 days in backups.
- Staff accounts: expired sign-in sessions and unused invitations are deleted automatically.
- Contract and billing records: 10 years, as required by Swiss law (Art. 958f of the Code of Obligations).
8. Security
- In transit. Data is encrypted using TLS.
- Database. The database is not reachable from the internet.
- Backups. Backups are encrypted before they leave the server.
- Staff access. Staff use individual accounts with hashed credentials, limited to the clients they work for.
No system is perfectly secure. If a breach affects your data, we will act as required by law.
9. Your rights
Under the Swiss Federal Act on Data Protection (FADP), and the GDPR where it applies, you have the right to:
- access your data and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- object to processing or have it restricted;
- receive data you provided in a portable format;
- withdraw any consent you gave, at any time.
To exercise these rights, write to info@sourcekb.com. We may ask you to confirm your identity. We will answer within 30 days.
You may also complain to a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). In the EU, it is the authority of your country of residence.
10. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The chat assistants select answers from approved content and say clearly that their replies are automated.
11. Changes
We may update this policy. The date at the top shows when it last changed. Significant changes will be announced on this page.