Legal

Privacy Policy

What we collect, why we collect it, and how it's protected.

Last updated: October 2026

1. Who we are

Source Manifest is operated by SourceManifest. This policy explains how we handle personal data for anyone who creates an account or otherwise uses the Service. If you have questions, email founder@sourcemanifest.store.

2. What we collect

Data	Why we collect it
Full name, email, WhatsApp number	Account creation, authentication, customer support, and essential billing/account security notices.
Password (stored as a one-way salted bcrypt hash — we never see or store your plaintext password)	Securing and authenticating your account.
Google profile info (name, email, profile avatar) — only if you authenticate via Google Sign-In	Seamless account creation and single-sign-on (SSO) authentication.
Marketplace & Search Preferences (target markets: US, UK, AU, CA, DE, FR, IT; margin/price filters)	To execute customized algorithmic market scans and deliver tailored product manifests matching your criteria.
Payment records (transaction ID, payment status, timestamp, plan tier)	Maintaining billing records and active subscription entitlements. All transactions are handled by PCI-DSS compliant payment gateways (such as JazzCash); we never store card numbers or CVVs.
Hunt history, saved products, and generated manifests	To display your historical manifests in the dashboard, manage saved items, and enable Google Sheet / CSV exports.
Technical telemetry (IP address, user agent, timestamps) via server logs	Infrastructure security, DDoS prevention, rate limit enforcement, and fraud detection.

3. Cookies & Local Storage

We use a single essential session token cookie (marked httpOnly, secure, and SameSite) to authenticate your dashboard requests and protect against cross-site request forgery. We do not use third-party advertising cookies, cross-site tracking pixels, or invasive behavioral telemetry.

4. How your data is shared

We do not sell, rent, or monetize your personal data. We disclose information strictly to trusted infrastructure providers necessary to operate the Service:

Google LLC — for Google Sign-In (if enabled) and for automated generation and delivery of your private Google Sheets product manifests. Our use of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.
Payment Processors (JazzCash & Authorized Partners) — to process monthly subscriptions via secure, tokenized payment flows under strict PCI-DSS compliance standards.
Cloud Infrastructure Providers (Railway / PostgreSQL Cloud) — to securely host our encrypted database and backend application runtime.
Marketplace Intelligence Sources (eBay, Public Supplier Catalogs, Apify) — these systems are data sources for market analysis. We never transmit your personal account credentials or personal identity to third-party marketplaces.

We may also disclose data if required by enforceable legal process, court subpoena, or to protect the safety, property, and operational integrity of Source Manifest.

5. How we protect your data

Passwords are hashed with industry-standard bcrypt using adaptive salt rounds.
All web traffic between your browser and our servers is enforced over HTTPS with TLS 1.3 encryption.
Session authentication tokens are stored in strictly isolated, httpOnly cookies preventing unauthorized script access.
Database connections are secured via SSL, and third-party API credentials are encrypted as isolated environment secrets.
Strict rate-limiting and server-side SSRF guards prevent abuse and unauthorized penetration.

6. International Data Transfers

Source Manifest provides cross-border market intelligence across multiple global jurisdictions (including North America, the United Kingdom, Europe, and Australia). Consequently, your account information and preferences may be processed and stored on cloud servers located outside your home country (including servers in the United States and the European Union).

By using the Service, you acknowledge and consent to the transfer of data across international borders under rigorous security controls, encryption, and standard contractual clauses designed to safeguard your personal data regardless of jurisdiction.

7. Data retention

We retain your personal data for as long as your account remains active. If you choose to close your account, we delete or anonymize your personal account profile and hunt history within thirty (30) days, retaining only anonymized telemetry or payment transaction records strictly required by tax and financial auditing laws.

8. Your rights & Data Control

Depending on your jurisdiction (including rights under GDPR, UK-GDPR, and relevant consumer privacy frameworks), you have the right to:

Access and review the personal data associated with your account;
Correct, update, or modify your profile and WhatsApp contact details from Account Settings;
Request a portable export of your personal data;
Request permanent deletion of your account and personal data;
Cancel recurring subscription renewals at any time directly through your dashboard.

To exercise your data privacy rights, email our compliance team at founder@sourcemanifest.store.

9. Children's privacy

The Service is designed strictly for adult eCommerce entrepreneurs and professionals. We do not knowingly collect, market to, or solicit personal information from individuals under eighteen (18) years of age.

10. Changes to this policy

We may update this Privacy Policy periodically to reflect new features, infrastructure updates, or regulatory requirements. Material revisions will be reflected in the "Last updated" date above, and active subscribers will be notified via email when significant changes occur.

11. Contact & Data Protection Inquiries

If you have any questions or concerns regarding this Privacy Policy or how your personal information is handled, contact our Data Protection team at founder@sourcemanifest.store.