Skip to main content

Privacy Policy

Last Updated: September 26, 2026

This Privacy Policy explains how Source Medium Inc. ("SourceMedium," "we," "us," "our") collects, uses, and shares information when you visit our website (the "Site"), submit information through our lead forms, or use SourceMedium products, services, and authorized third-party integrations.

1) Information We Collect

A. Information you provide (lead capture)

  • Name
  • Email address
  • Company name
  • Any message or details you submit in a form

B. Information collected automatically

When you visit the Site, we (and our service providers) may automatically collect:

  • IP address (and approximate location derived from it)
  • Device and browser information
  • Pages viewed, clicks, referral/source pages
  • General usage and interaction data (e.g., page views, session events)
  • Session recordings: our analytics provider records browsing sessions on this Site, including page navigation, mouse movement, clicks, scrolling, and browser console output. Text you enter into form fields, and messages you send to the on-site assistant, are masked and are not captured in these recordings. Other text displayed on the page is captured.

2) Cookies, Analytics, and Advertising

We use cookies and similar technologies (like pixels) to operate, analyze, and market the Site.

Analytics

  • PostHog (website analytics, event tracking, and session recording / replay)
  • Google Analytics 4 (GA4) (website analytics)

Advertising / Measurement

  • Advertising pixels (e.g., Meta Pixel and Google Ads tags) to measure ad performance and, where permitted, support retargeting/attribution.

Form Processing

  • HubSpot (CRM / form submission processing)

These tools may collect information about your activity on the Site over time. We do not currently present a cookie or consent banner, so these analytics and advertising technologies run on all visits. You can limit them through your browser settings, or contact us using the details below to request that we stop processing your information.

3) Third-Party Commerce Platform Integrations

When a customer authorizes a third-party commerce platform integration, including TikTok Shop, SourceMedium processes information made available through the platform's authorized APIs. This may include shop, product, order, fulfillment, and related customer information. We use this information only to provide, secure, support, and maintain the requested integration and analytics services, respond to authorized data requests, and comply with legal obligations. We share it only with the authorizing customer, the applicable platform, service providers needed to operate the service, or when legally required. Integration data is processed in the United States and retained only as long as necessary to provide the service or meet legal obligations. At the end of the contractual relationship, it is deleted from active systems and scheduled for deletion from backups under our standard retention cycle. Requests for access, correction, export, or deletion may be sent to the privacy contact listed below.

4) Google Account Integrations

This section applies to Google user data accessed by SourceMedium Integration, the app you authorize to connect your Google accounts. It is separate from the website analytics and advertising technologies described in Section 2. For Google user data, the limits in this section take precedence over the general use and sharing provisions elsewhere in this policy.

Data accessed and purposes

  • Google Analytics: When you connect a GA4 property, we read property information and reporting data, such as website activity, traffic sources, and conversion metrics, to provide your analytics and reports.
  • GA4 BigQuery export: When you ask SourceMedium to set up a native export, we use Google Analytics editing permission to create a BigQuery link for the property you select and to remove links we manage when you disconnect that export. Google sends event data to BigQuery, where SourceMedium processes it for reporting. This permission is used for export-link management, not to change your properties, data streams, audiences, or users.
  • Google Ads: When you connect an advertising account, we read account, campaign, spend, and performance data to provide marketing reports and analysis. The Google Ads permission has a broad consent-screen description, but this integration uses it for reporting.

Storage and processing

We store integration credentials in Google Secret Manager and process collected data in our analytics warehouse, including Google BigQuery. Scheduled collection and data transformation prepare the data for customer reports; connecting an account does not produce an immediate report refresh. Access to credentials and customer data is restricted to the systems and authorized people that need it to operate the service, subject to the limits below.

Use and sharing limits

SourceMedium's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. These limits also apply to aggregated, anonymized, and derived Google data. We use this data only to provide or improve the customer-facing features you authorize. We do not sell Google user data or use or transfer it to serve advertisements, including retargeting or personalized ads, or to make credit or lending decisions.

We share Google user data only with your consent as needed to provide or improve those features, including with service providers that operate them and reporting or analysis tools you authorize; for security purposes; to comply with applicable law; or as part of a merger, acquisition, or sale of assets with your explicit prior consent. Human access is limited to your affirmative agreement to view specific data, security needs such as investigating abuse, legal obligations, or aggregated data used for internal operations as permitted by Google's Limited Use requirements.

Disconnecting, retention, and deletion

You can disconnect a data source in SourceMedium to stop its collection and remove its stored connection credentials. Disconnecting a managed GA4 export removes its Google Analytics BigQuery link. If you recorded an export created outside SourceMedium, disconnecting stops SourceMedium from reading it; remove that link in Google Analytics to stop Google's export. Disconnecting an export does not delete data already collected in BigQuery or disconnect a separate GA4 reporting connection. We preserve the shared Google authorization so that your other connections can continue working. You can revoke SourceMedium's Google access from your Google Account connections; this may affect all connections using that authorization.

Collected Google data is retained as needed to provide the authorized service or meet legal obligations. Disconnecting is not a request to erase historical reports or warehouse data. To request access, correction, export, or deletion of Google data held by SourceMedium, contact legal@sourcemedium.com. Data held in a customer-controlled project or an independently connected tool must also be managed with that project's owner or tool provider.

5) How We Use Information

We use information to:

  • Respond to your inquiries and follow up on your request
  • Operate and improve the Site
  • Understand Site performance and user behavior (analytics)
  • Measure marketing performance and attribution (ad pixels)
  • Prevent fraud, abuse, and security incidents
  • Comply with legal obligations and enforce our terms

6) How We Share Information

We may share information with:

  • Service providers that help us run the Site and communications (analytics providers, advertising platforms, CRM providers, hosting, security tools)
  • Advertising partners for measurement and campaign performance (and retargeting where permitted)
  • Legal/compliance if required by law or to protect rights, safety, and security
  • Business transfers if we're involved in a merger, acquisition, financing, or sale of assets

We don't "sell" personal information for money. Some privacy laws define "sell" or "share" broadly to include certain ad/measurement disclosures. If that applies to you, you may have the right to opt out (see "Your Choices & Rights").

7) Your Choices & Rights

Cookie controls

  • You can control cookies through your browser settings (block/delete cookies).
  • We do not currently offer an on-site cookie banner or "cookie preferences" control, so browser settings are the way to manage analytics and advertising cookies today. You can also contact us using the details below.

Do Not Track

  • We do not currently respond to "Do Not Track" browser signals, as there is no uniform standard for doing so.

Marketing emails

  • You can opt out of marketing emails by using the unsubscribe link in the email or contacting us.

Targeted advertising opt-out

  • Depending on your location, you may have the right to opt out of certain targeted advertising/"sharing" for cross-context behavioral advertising. Contact us using the details below.

Access / deletion / correction

  • Depending on your location, you may have rights to request access to, correction of, or deletion of your personal information.

California residents

  • If you are a California resident, the California Consumer Privacy Act (CCPA/CPRA) may provide you with additional rights, including the right to know what personal information we collect, the right to delete it, and the right to opt out of the "sale" or "sharing" of personal information (as those terms are defined under the CCPA). To exercise these rights, contact us at the email below.

8) Data Retention

We keep personal information as long as reasonably necessary for the purposes described above, including responding to you, maintaining business records, complying with legal obligations, and resolving disputes.

9) Security

We use reasonable administrative, technical, and organizational measures designed to protect your information. No method of transmission or storage is completely secure.

10) International Transfers

If you access the Site from outside the United States, your information may be processed in the United States and other locations where we or our service providers operate.

11) Children's Privacy

The Site is not intended for children. We do not knowingly collect personal information from children.

12) Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date indicates when it was last revised.

13) Contact Us

For questions or requests related to this Privacy Policy, contact: legal@sourcemedium.com