SourceGeek Privacy Policy

Last updated: 19 October 2026

This notice describes how SourceGeek VoF, Mozartlaan 33, 3603 BD Maarssen, the Netherlands ("SourceGeek", "we") processes personal data through the sourcegeek.com website and the SourceGeek platform at chat.sourcegeek.com (the "Platform"). You can reach us at support@sourcegeek.com.

Two roles. This notice covers the processing for which we are the controller: your account, billing, support, and our website and marketing. For the content our customers process through the Platform — chats, documents, and data from the systems they connect, such as an applicant tracking system — we act as a processor on the customer's behalf. That processing is governed by our Data Processing Agreement; the third parties involved are listed on our sub-processors page. If you are a candidate whose data is processed by one of our customers, that customer is the controller — please direct requests to them; we forward any request we receive to the customer concerned.

Data we collect and why

Account. When you register we process your name, e-mail address, and either a password or the identifier from the sign-in provider you choose (Google or LinkedIn). We use this to create and secure your account and to communicate about the service (performance of contract, GDPR Art. 6.1.b).

Workspace and billing. For paid subscriptions we process company details, billing address, VAT number and payment confirmations (performance of contract, Art. 6.1.b; legal obligations, Art. 6.1.c). Payments are handled by our payment processor, which processes your card or bank details as an independent controller; we do not receive full payment details.

Platform usage. We process log and device data (IP address, browser information, timestamps) to keep the Platform secure and working (legitimate interest, Art. 6.1.f), and product analytics — explicitly recorded events about how the Platform is used — to improve the product (legitimate interest, Art. 6.1.f). Analytics events do not contain the contents of the chat interface. To find and fix usability problems we record session replays of the Platform (legitimate interest, Art. 6.1.f): what the pages showed, including the contents of the chat interface and your workspace, and your clicks, typing, scrolling and navigation. Passwords are never recorded. We store replays ourselves on Cloudflare, in Western Europe, and delete them after 30 days, or earlier when you delete your account.

Support. When you contact us via e-mail or the website chat widget, we process your contact details and the content of the conversation to help you (performance of contract, Art. 6.1.b; legitimate interest, Art. 6.1.f).

Website and marketing. On the marketing website we process visitor data via cookies and similar technologies — see the Cookie Policy — and, with your consent, we send newsletters you can unsubscribe from at any time (consent, Art. 6.1.a).

AI processing

The Platform uses large language models to answer questions and draft content. Model requests are routed through an AI gateway exclusively to providers operating under zero-data-retention terms: prompts and outputs are processed to produce the response, are not stored by the model provider, and are never used to train models. The Platform does not make automated decisions about individuals that produce legal or similarly significant effects; actions in connected systems follow the workspace's approval settings, and automation runs can act without pausing for approval.

Google account connections

Google sign-in uses your basic profile and e-mail address to identify your account. Connecting Gmail, Google Drive or Google Calendar is optional and requires a separate authorization. Before you connect, the Platform explains the access and processing and asks for your agreement.

Access and use. Gmail access lets you search and read messages, create and send drafts, send e-mails, list labels, and apply or remove message labels. Drive access lets you search existing and shared files, read their contents, and create or update files you can access. Calendar access lets you list your subscribed calendars and read, create, update or delete events on calendars where you have permission. We request one scope for Gmail (gmail.modify), one for Drive (drive), and two for Calendar (calendar.events and calendar.calendarlist.readonly). We use this data to provide the features you request, such as summarizing correspondence, drafting outreach, working with recruiting documents and scheduling interviews. Writes follow the workspace's approval settings; automation runs can act without pausing for approval.
Storage and protection. Connection credentials are encrypted at rest and data is encrypted in transit. Data retrieved for your requests can become part of the chat history, generated documents or other workspace content and is retained under the workspace retention rules below. Personal chats are accessible to their owner; shared chat content is accessible to members of that workspace. Connecting an account does not give other members its credentials or independent access to that Google account.
Sharing and AI. Data needed for your requested feature is processed by our hosting and AI providers, listed on our sub-processors page. AI processing follows the terms described above. We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. Human access is limited to circumstances permitted by Google's Limited Use requirements, such as your specific agreement to support access, security investigations or legal requirements.
Your control and deletion. Disconnect a service in the Platform's connector settings to remove its stored credentials and stop future access. You can also revoke access in your Google Account connections. Disconnecting does not delete information already saved in chats or workspace content. Workspace deletion permanently removes that content; contact support@sourcegeek.com for help with access or deletion requests.

SourceGeek's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

Using SourceGeek from AI assistants

You can connect SourceGeek to AI assistants: Anthropic's Claude (claude.ai, the Claude apps and Claude Code, through the SourceGeek connector and plugin), OpenAI's ChatGPT and Codex (through the SourceGeek plugin), and other assistants that support MCP. When you connect, you sign in with your SourceGeek account and choose one workspace; the assistant can then use SourceGeek's tools in that workspace on your behalf.

What we receive. Only the tool calls the assistant makes and their inputs, such as a search query, a LinkedIn profile URL or a job description, plus the results we send back. We do not receive your conversations with the assistant or anything else you share with it.
What we keep. Sheets, shortlists and memory that the assistant creates are saved in your workspace like any other workspace content, under "From Claude", "From ChatGPT" or the assistant's own name. For each tool call we keep an audit record with the tool name, the outcome and the timing, but not its inputs or results, for 90 days. Sign-in tokens are stored only as one-way hashes; access tokens expire after one hour and refresh tokens after 30 days.
Third parties. Searches and lookups run through the same providers as in the Platform (for example Coresignal, RapidAPI and Parallel), listed on our sub-processors page. What the assistant does with the results is governed by your agreement with its provider (for example Anthropic or OpenAI), not by this notice.
Legal basis. Performance of contract (Art. 6.1.b) for connecting your account; for candidate data we act as processor for the workspace, as described above.
Your control. You can see and disconnect every connection under Settings → Connected apps; disconnecting revokes the assistant's access immediately. Workspace admins can see and disconnect the connections of all members.

We share personal data only with: the service providers listed on our sub-processors page (hosting, AI gateway, e-mail delivery, analytics, support and monitoring tools), acting on our instructions; our payment processor; and authorities where the law requires it. We never sell personal data. The Platform is hosted on Cloudflare, with its primary database and file storage in Western Europe (EU). Where providers process data outside the EEA, transfers are safeguarded with Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework.

Retention

We keep account data for as long as your account exists. You can delete your account at any time in the Platform's settings; deletion removes your sessions and identifying details. Workspace content is deleted when a workspace is deleted, permanently. Billing records are retained as long as tax and accounting law requires. Support and marketing data is kept no longer than necessary for the purpose it was collected for.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interest, including direct marketing. Where processing is based on consent, you can withdraw it at any time without affecting prior processing. To exercise your rights, contact support@sourcegeek.com. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit, encryption of stored credentials, strict workspace isolation and access on a need-to-know basis. A summary of our measures is included in the Data Processing Agreement.

Changes to this notice

We may update this notice from time to time by posting a new version on this page. We will announce significant changes to account holders.