Sourcevine provides APIs for public social data. This policy explains what we collect when you use the website, dashboard, API and related services, and how we use it.
Sourcevine is operated by Nguyen Van Thanh D/B/A Sourcevine, based in Vietnam, who is responsible for the personal data described in this policy.
What We Collect
- Account data: email address, name if provided, password hash, verification status, preferences and security events. If you sign in with GitHub, we also store your GitHub account id and the verified email address GitHub returns; we ask GitHub only for read access to your profile and email addresses.
- API usage data: project, API key prefix, operation, the resource URL or identifier you asked about, request id, timestamps, status, latency, credit charge, cache state and availability state.
- API response content: the public social data we return, such as post statistics, comments and transcripts. It is cached for the operation's freshness window, a short-lived copy is kept to answer retried requests, and a scrubbed copy of recent data retrieval responses is kept for troubleshooting.
- Billing data: wallet balances, credit transactions, pack purchases, payment and customer identifiers, payment-provider webhook payloads and support notes about billing. We do not receive or store card numbers or other payment details; Paddle collects those.
- Support and product communications: messages you send us, email delivery events, suppression records and opt-in preferences.
- Signup attribution: when you create an account we record how you found Sourcevine (see Cookies and Analytics below), together with your country, IP address and browser user agent at signup.
- Site and dashboard analytics: page views and interactions collected by Google Analytics, described below.
Public Social Data
Sourcevine is designed around public metrics and public content metadata from supported platforms. We do not ask for your social account password, use your private platform session, or provide APIs for private messages, private accounts, contact details, follower identity lists, phone numbers, email addresses or postal addresses.
Responses are assembled through allowlisted schemas and string scrubbing. We do not keep raw source payloads as the product database in normal production operation. Normalized responses may be cached for freshness, latency and billing consistency.
Cookies and Analytics
- Sign-in cookies: keep you signed in to the dashboard and protect forms. They are needed for the service to work.
- Attribution cookie (
sv_attr): records the referring page, the page you landed on, campaign parameters (utm_*,ref) and ad click identifiers (gclid,fbclid) from your first visit. It lasts up to 180 days, and if you create an account its contents are saved with that account. We use it to learn which channels bring customers. - Google Analytics: the website and dashboard use Google Analytics to measure usage. Google sets its own cookies and processes this data under its privacy policy. You can block it with your browser's tracking protection, a content blocker or Google's opt-out add-on; the service keeps working.
How We Use Data
- Authenticate accounts, issue API keys and protect sessions.
- Run requested API calls, return normalized responses and enforce rate limits.
- Meter credits, show usage, reconcile billing and process top-ups.
- Send transactional email such as verification, API key, billing and security notices.
- Detect abuse, investigate incidents, debug failures and improve reliability.
- Measure which channels and pages bring customers, and how the product is used.
Service Providers
We use infrastructure and operations providers to run Sourcevine. Depending on environment and configuration, these may include hosting, DNS/CDN, email, analytics, error monitoring, GitHub sign-in, data retrieval and processing services, and Paddle.com for checkout. Infrastructure providers process data on our behalf. Some providers, such as Google for analytics and any payment provider that sells to you as merchant of record, also act under their own privacy policies for the data they receive.
Retention
We keep account and billing records while your account is active and as long as needed for tax, audit, security and dispute handling. API usage records are kept so customers can reconcile credits and so we can investigate abuse or operational incidents. The signup IP address and user agent are cleared after 60 days. Scrubbed troubleshooting copies of data retrieval responses are deleted after 14 days, and copies kept for retried requests after 24 hours. Cached responses expire according to each API's cache policy.
Your Choices
You can update account preferences in the dashboard. You can also ask us to access, correct, export or delete your personal data, or object to its use for analytics, by emailing us; we answer from the same address. Depending on where you live, you may also complain to your local data protection authority. Some records, such as billing transactions, security logs and suppression entries, may need to be retained for legal, anti-abuse or deliverability reasons.
Security
API key secrets are shown once and stored only as hashes. Session cookies are httpOnly where possible, and unsafe dashboard requests use CSRF protection. No internet service can be guaranteed perfectly secure, but we design Sourcevine so secrets and raw source payloads are not casually exposed.
Contact
For privacy questions, email support@sourcevine.io.
A signed customer agreement may add to this policy for that customer. It does not remove rights that data protection law gives you.