SourceTruth — Privacy Policy

1. Introduction

D'Linkup Pte. Ltd. ("we", "us", "our") operates the SourceTruth API ("Service"). This Privacy Policy describes how we collect, use, store, and disclose information from and about you when you use the Service.

By using the Service, you consent to the data practices described in this Policy. If you do not agree, please do not use the Service. Where an API key is issued to a business entity rather than an individual, this Policy applies to the individual(s) whose personal data (name, email address) is provided in connection with that key.

2. Information We Collect

2.1 Information you provide

Data	When collected	Purpose
Name	API key creation (POST /v1/keys)	Account identification
Email address	API key creation	Account management, billing communication, service notices
Payment information	Paid plan subscription (via Stripe)	Billing. We do not store raw card details — Stripe handles all payment processing.

2.2 Usage analytics (default — treated as non-personal data)

The following usage data is collected automatically when you make API requests. We do not link this data to your account, API key, or identity at the time of collection. Timestamps are stored rounded to the nearest hour.

We treat this data as non-personal data because it is not associated with any identified or identifiable individual in our systems. We acknowledge that some query text may incidentally contain personal information (for example, if a query references a named individual or includes personal context). Where any query constitutes personal data, it remains subject to the rights described in §7 of this Policy. You may request deletion of a specific query that contains your personal information by emailing api@sourcetruth.io with "Privacy Request — Query Deletion" in the subject line, describing the approximate date and content of the query.

Data	Retention	Purpose
Query text (full)	Indefinitely (as non-personal data; deletion of specific queries containing personal data available on request — see above)	Product improvement, corpus expansion decisions, retrieval quality improvement, internal AI model training, benchmarking
Endpoint called	Indefinitely	Usage analytics
Traditions / languages requested	Indefinitely	Usage analytics, corpus expansion decisions
Result count	Indefinitely	Coverage gap analysis, product improvement
Latency (milliseconds)	Indefinitely	Performance monitoring
Timestamp (bucketed to nearest hour)	Indefinitely	Usage trend analytics

2.3 Account-linked usage data (Customer Intelligence Programme — opt-in only)

Paid-tier customers who enrol in the Customer Intelligence Programme (via POST /v1/intelligence/enrol) have their usage analytics stored with account linkage — associated with their API key and email address. This linked data is personal data and is handled in accordance with this Privacy Policy. See Terms of Service §8.3 for full details of the Programme, the purposes for which linked data is used, and the opt-out procedure.

Data	Retention	Purpose
Query text (full, linked to account)	90 days post-opt-out, then anonymised; or deleted on request within 30 days	Usage dashboards, corpus recommendations, personalised retrieval tuning, customer success, internal product analytics, model training, benchmarking
Traditions / languages (linked)	Same as above	Personalised corpus recommendations, customer analytics
Endpoint, result count, latency (linked)	Same as above	Usage dashboards, customer success

2.4 Other data points

Data	Retention	Purpose
API key hash (SHA-256)	Indefinitely while key active; deleted within 30 days of termination on request	Authentication
Daily request count per key	Rolling 2 days (daily_quota table)	Quota enforcement
Stripe customer ID	Indefinitely while account active	Billing portal access
IP address	Not stored persistently	Rate limiting (per-request only, via Cloudflare)

2.5 What we do NOT collect

We do not store the raw API key — only its SHA-256 hash
We do not collect browser cookies, device fingerprints, or tracking pixels
We do not store the content of /v1/answer responses — generated answer text is returned to you and not retained by us
We do not link anonymous usage analytics to your account or API key

3. How We Use Your Information

Service operation: Authenticate API keys, enforce rate limits and quotas, process billing
Communication: Send transactional emails (billing receipts, account notices, service changes) to the email on your API key record
Usage analytics and product improvement: Usage data (§2.2) is used to improve the Service, expand the corpus, and improve retrieval quality
Internal AI model training: Anonymous usage data (§2.2) is used to train and evaluate our own internal retrieval and ranking models. See §3.1 for detail.
Customer Intelligence Programme: Where you have opted in (§2.3), linked usage data is used for the purposes described in Terms of Service §8.3: usage dashboards, corpus recommendations, retrieval tuning, customer success, internal product analytics, model training, and aggregated benchmarking.
Security and abuse prevention: Detect and prevent misuse, fraud, or violations of our Terms of Service
Legal compliance: Comply with applicable laws and respond to lawful requests from authorities

We do not sell your personal data to third parties.

3.1 AI Model Training — Scope and Limits

When we refer to "internal AI model training" as a purpose for usage data, this means:

Training and improving our own internal retrieval and ranking models to improve the quality of /v1/search results
Evaluating retrieval performance against benchmarks derived from real-world query patterns
Improving prompt design for /v1/answer generation

We do not sell, licence, or share query data with third parties for their model training purposes. Anthropic processes query text in real time as part of /v1/answer request fulfilment (inference only) — we do not send query data to Anthropic for fine-tuning. See §4 for Anthropic's role as sub-processor.

3.2 AI Training and the Right to Deletion

Where query data has been used to train or evaluate internal AI models prior to a deletion request, deleting the source data does not automatically alter trained model weights already produced. This is a technical limitation of current AI training methods. We will suppress the use of any identified personal data in future training cycles and, where technically feasible, will retrain or adjust models to remove the influence of data subject to verified deletion requests. We disclose this limitation rather than making an unqualified deletion promise.

4. Data Sharing

We share data with the following sub-processors as necessary to provide the Service:

Sub-processor	Purpose	Data shared	Location
Supabase Inc.	Database hosting (PostgreSQL)	Account data (emails, API key hashes, billing IDs), usage analytics, quota counts. Opted-in customers: linked usage data.	USA (AWS us-east-1)
Railway Corp.	API server hosting	In-flight request data (transient)	USA
Stripe, Inc.	Payment processing	Email, name, billing address, IP address (for fraud scoring), payment method. Card details are processed directly by Stripe and never transmitted to us. Stripe processes this data subject to Stripe's Privacy Policy.	USA
Anthropic, PBC	/v1/answer generation (Claude API — inference only)	Query text and retrieved passage text sent to Claude API at request time for answer generation. Not used for fine-tuning. Processed subject to Anthropic's Privacy Policy and usage policies.	USA
Cloudflare, Inc.	CDN and DNS proxy	In-flight HTTP requests (IP visible to Cloudflare for DDoS protection and rate limiting; not stored by us persistently)	Global
Transactional email provider (TBD)	Delivery of billing receipts, API key confirmations, and account notices	Email address, name	To be confirmed when provider selected

We may disclose your information to law enforcement or regulators when required by law, or to protect the rights, property, or safety of D'Linkup, our users, or the public.

Enterprise customers requiring a Data Processing Agreement (DPA) may request one at api@sourcetruth.io.

5. Data Retention

Anonymous usage analytics (api_usage table): Retained indefinitely as non-personal data. Where a specific query is identified as containing personal data, it may be deleted on request per the process in §2.2.
Customer Intelligence Programme data (linked usage, opted-in customers): Retained while the customer remains enrolled. On opt-out, retained for 90 days then anonymised. On deletion request to api@sourcetruth.io, deleted within 30 days. Anonymisation of historic data does not affect models or benchmarks already produced — see §3.2.
Daily quota counts: 2 days rolling
API key records (api_keys table): Retained while the key is active. Deleted within 30 days of account termination on request.
Email addresses: Retained while the account is active. On request to delete, we remove the email from the api_keys record within 30 days. Note that Stripe may retain email data subject to its own retention policies (typically 7 years for financial records).
Stripe billing data: Retained by Stripe per their data retention policy.

6. Data Security

API keys are stored only as SHA-256 hashes — the raw key is never stored and cannot be recovered
All API traffic is encrypted in transit via TLS (Cloudflare-managed SSL)
Database connections use TLS in transit
We use Supabase Row Level Security (RLS) policies to restrict data access
Access to production databases is restricted to authorised personnel and service accounts

No system is perfectly secure. In the event of a data breach affecting your personal data, we will comply with our mandatory notification obligations: under Singapore's PDPA (as amended 2021) we will notify the Personal Data Protection Commission (PDPC) and affected individuals within 3 calendar days of becoming aware of a notifiable breach; under the GDPR we will notify the relevant supervisory authority within 72 hours of becoming aware. We will contact you at the email address on your API key record.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request that inaccurate data be corrected
Deletion: Request deletion of your personal data (subject to legal retention requirements and the limitation described in §3.2)
Portability: Request your personal data in a machine-readable format (CSV or JSON). We will fulfil verified portability requests within 30 days. Portability applies to data you actively provided (name, email address); it does not apply to anonymous usage analytics.
Objection / restriction: Object to certain processing activities
Withdraw consent: Withdraw consent to non-essential processing at any time

To exercise these rights, email us at api@sourcetruth.io with "Privacy Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing the request.

7.1 Singapore PDPA

We are subject to the Personal Data Protection Act 2012 (Singapore) ("PDPA"), as amended in 2021. You have the right to access and correct your personal data held by us, and to request data portability under Part IVA of the PDPA. To make a request, email us at api@sourcetruth.io with "Privacy Request" in the subject line. If you believe we have not handled your personal data in accordance with the PDPA, you may lodge a complaint with the Personal Data Protection Commission (PDPC) at www.pdpc.gov.sg.

7.2 GDPR (EEA/UK)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) / UK GDPR. Our legal basis for processing your data is:

Contract performance (Article 6(1)(b)): Name and email address collected and used to provide the Service and process billing
Legitimate interests (Article 6(1)(f)): Quota enforcement, security, and abuse prevention. Our legitimate interests assessment considers that these activities are necessary for the integrity of the Service and that the data processed (daily request counts, API key hashes) is minimal and technical in nature, and does not override the fundamental interests or rights of data subjects.
Consent (Article 6(1)(a)): Customer Intelligence Programme data (§2.3) — enrolment constitutes explicit, informed, freely given consent to the processing described in Terms of Service §8.3
Not applicable: Anonymous usage analytics (§2.2) that do not constitute personal data are not subject to GDPR. Where any query text constitutes personal data, we rely on legitimate interests for its processing given the minimal nature of the data and the non-identifiable way it is stored.

Data transfers to the United States are made only to sub-processors that have committed to appropriate data protection safeguards: for EEA transfers, under GDPR Chapter V including the EU-US Data Privacy Framework (where the sub-processor is certified) and Standard Contractual Clauses (2021 EC SCCs); for UK transfers, under UK GDPR Article 46 including the UK-US Data Bridge (where certified) and UK International Data Transfer Agreements (IDTAs) or UK Addendum SCCs. The applicable transfer mechanism for each sub-processor is available on request at api@sourcetruth.io.

If you are located in the EEA and believe we have not handled your personal data in accordance with the GDPR, you may lodge a complaint with the supervisory authority in your EU member state. If you are located in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

EU/EEA Representative (GDPR Article 27): D'Linkup Pte. Ltd. currently has no establishment in the European Economic Area. We will designate a formal EU representative and publish their contact details in this section before the first paying EEA customer joins the Service, or before proactively marketing to EEA individuals — whichever comes first. Until that point, EEA individuals may direct GDPR enquiries to api@sourcetruth.io.

8. Children's Privacy

The Service is not directed at children. The minimum age for using the Service is 16 years globally. In jurisdictions where applicable law sets a lower minimum age for digital consent, we apply the higher threshold of 16 as a uniform standard. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, contact us and we will delete it.

9. Cookies and Tracking

The SourceTruth API does not use cookies or tracking technologies. Our developer documentation pages (this site) do not use analytics scripts, tracking pixels, or third-party cookies. If this changes, this section will be updated and you will be notified in accordance with §10.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

11. Contact

D'Linkup Pte. Ltd.
1 Tampines North Drive 1, #06-08, T-Space
Singapore 528559
UEN: 201721418Z
Privacy enquiries: api@sourcetruth.io