Privacy Policy

Sourcepull (“we,” “us,” or “our”) operates sourcepull.ca and provides AI visibility audit services for small businesses. We are based in Burlington, Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and protect your personal information.

AI Transparency Disclosure

Sourcepull uses AI extensively. Our CEO agent, Frank, is an AI agent — not a human. Reports and communications generated through our platform are produced by AI language models (including OpenAI, Anthropic Claude, Google Gemini, and Perplexity). No human analyst reviews individual reports unless specifically stated.

PIPEDA Fair Information Principles

As a Canadian business, we adhere to the ten fair information principles set out in the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Accountability

Jason Steltman is responsible for Sourcepull’s compliance with PIPEDA. Questions or complaints may be directed to hello@sourcepull.ca.

2. Identifying Purposes

We collect personal information for the following purposes:

• To deliver AI visibility audit reports (Score Check, Full Signal, Clarity)
• To communicate with you about your order or inquiry
• To send marketing emails (only with your explicit consent under CASL)
• To improve our services and website
• To prevent abuse and enforce rate limits

3. Consent

We obtain your consent before collecting, using, or disclosing your personal information. By submitting a Score Check form or providing your email address, you consent to the collection and use described in this policy. You may withdraw consent at any time by contacting us at hello@sourcepull.ca.

4. Limiting Collection

We only collect information that is necessary for the purposes identified. We do not collect sensitive personal information (e.g., health, financial, or government ID data).

5. Limiting Use, Disclosure, and Retention

Personal information is used only for the purposes for which it was collected. We do not sell your personal information. See the “Data Retention” section below for retention periods.

6. Accuracy

We take reasonable steps to ensure your information is accurate and up to date. You may request corrections by emailing us.

7. Safeguards

We protect personal information with security measures appropriate to the sensitivity of the data, including encrypted connections (HTTPS/TLS), access controls, and secure third-party processors.

8. Openness

This Privacy Policy is publicly available on our website at all times. We will notify users of material changes by updating this page and revising the “Last updated” date.

9. Individual Access

You have the right to request access to the personal information we hold about you. Contact hello@sourcepull.ca to make an access request. We will respond within 30 days.

10. Challenging Compliance

If you believe we are not complying with PIPEDA, you may file a complaint with us at hello@sourcepull.ca. If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner of Canada.

Information We Collect

Information You Provide

• Email address — submitted through our contact or waitlist forms (processed by Basin)
• Business domain, city, and category — submitted through the Score Check form to generate your audit

Information Collected Automatically

• IP address — used for rate limiting on the Score Check API (not stored long-term)
• Browsing data — page views, referrers, device type, and similar analytics data collected by Vercel Analytics and Ahrefs Analytics

Third-Party Processors

We share data with the following third-party service providers, solely for the purposes of operating our services:

When your business information is sent to AI providers for analysis, only publicly available business data (domain, city, category) is transmitted — never your email address or IP.

Cookies and Analytics

Sourcepull uses the following cookies and tracking technologies:

• Vercel Analytics — collects anonymous page view and performance data. No personally identifiable cookies are set. Privacy-focused by design.
• Ahrefs Analytics — collects anonymous browsing data (pages visited, referrers, device info) for SEO analysis.
• Functional cookies — we may set minimal cookies required for site functionality (e.g., rate-limit tracking). These do not track you across other websites.

We do not use advertising cookies or share browsing data with advertisers.

Data Retention

• Score Check cache: 7 days, then automatically deleted
• Full reports (Full Signal, Clarity): stored until you request deletion
• Email addresses: retained until you unsubscribe or request deletion
• IP addresses (rate limiting): stored temporarily in memory and not persisted to disk
• Analytics data: retained per Vercel and Ahrefs default retention policies

Your Rights Under GDPR (EU/EEA Residents)

If you are located in the European Economic Area, the following applies:

Lawful Basis

• Consent — for marketing emails and optional form submissions
• Contractual necessity — for processing data needed to deliver purchased audit reports
• Legitimate interest — for analytics, security (rate limiting), and service improvement

Your Data Subject Rights

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing based on legitimate interest
• Withdraw consent at any time (without affecting the lawfulness of prior processing)

Data Protection Contact

Sourcepull does not currently have a formal Data Protection Officer (DPO). For GDPR-related requests, contact:

Jason Steltman
hello@sourcepull.ca
Burlington, Ontario, Canada

If you are unsatisfied with our response, you may lodge a complaint with your local supervisory authority.

Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights.

Categories of Information Collected

• Identifiers: email address, IP address, business domain
• Internet activity: browsing data, pages visited, referral source
• Commercial information: services purchased, order history

Your Rights

• Right to know — what personal information we collect and how we use it
• Right to delete — request deletion of your personal information
• Right to opt out of sale — we do not sell your personal information. There is nothing to opt out of.
• Right to non-discrimination — we will not treat you differently for exercising your privacy rights

To exercise any CCPA right, email hello@sourcepull.ca with the subject line “CCPA Request.” We will respond within 45 days.

Canadian Anti-Spam Legislation (CASL)

We comply with Canada’s Anti-Spam Legislation. We will only send you marketing or promotional emails if:

• You have given express consent (e.g., opting in via our waitlist or contact form)
• We have an existing business relationship with you (implied consent), limited to the timeframes permitted under CASL

Every marketing email includes an unsubscribe mechanism. You can unsubscribe at any time by clicking the unsubscribe link in any email or emailing hello@sourcepull.ca. We will process unsubscribe requests within 10 business days as required by CASL.

Transactional emails (e.g., report delivery, order confirmations) are not subject to CASL consent requirements and will be sent as needed to fulfill your order.

Accessibility (AODA)

We are committed to making our website and services accessible in accordance with the Accessibility for Ontarians with Disabilities Act, 2005 (AODA). If you experience accessibility barriers on our website, please contact us at hello@sourcepull.ca and we will work to address the issue.

International Data Transfers

Some of our third-party processors are located outside of Canada (primarily in the United States and EU). By using our services, you consent to your information being transferred to and processed in these jurisdictions. We ensure all processors maintain appropriate data protection standards.

How to Request Deletion

To request deletion of your personal information, email hello@sourcepull.ca with the subject line “Deletion Request.” Include the email address or business domain associated with your account. We will:

• Confirm your identity
• Delete your data within 30 days
• Notify you when deletion is complete

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date. If changes are material, we will make reasonable efforts to notify you (e.g., via email or a notice on our website).

Contact Us

For any privacy-related questions, requests, or complaints:

Sourcepull
Jason Steltman
Burlington, Ontario, Canada
hello@sourcepull.ca