Privacy notice

Who we are

SourceQuanta is the controller for the personal data described on this page. SourceQuanta runs this website.

Questions about your data go through the contact page or info@sourcequanta.com. We reply by email, usually within two working days.

What we collect

On the public site we record an anonymous page view. A view includes the page address, including words in a search, the site that linked here (the referrer), and the browser and device type. PostHog also derives an approximate location, the country and the city, from the IP address when it receives the view. We use the country in our metrics. The IP address itself is not stored.

In cookieless mode PostHog also uses the IP address briefly on its servers to calculate a hash that changes each day. That hash is how visits are counted without a tracking identifier in the browser. The hash is not stored in this browser. We do not record the session. Preview builds, and pages opened on localhost, do not send these views.

If you send a message, we store what you typed so we can reply. The contact form stores your name, email, and message. A question from a listing also stores your organisation, if you gave one, and which listing you asked about. The early partner form stores the supplier’s name, website, a short description, the category, the contact email, and what you say about products or plans. The market analytics access form stores your name, email, organisation, role, what you want to use it for, and your agreement that we may store the request and contact you about access. A successful analytics request also sends that role, and nothing else, with the page views.

Why we use it, and the legal basis

Page views show which pages on the public site are used, and the approximate country those visits come from. We do not use them for advertising, and we do not build a profile you can be singled out from in the browser. Under the GDPR we rely on legitimate interests (Article 6(1)(f)): understanding how the site is used without a tracking cookie. Under the revFADP the same purpose is an overriding private interest.

Messages are used to reply to you, and for nothing else. Under the GDPR that relies on legitimate interests in answering a request you sent (Article 6(1)(f)). Where you ask us to reply, that reply is also a step you requested (Article 6(1)(b)). Under the revFADP, answering a request you sent is an overriding private interest.

The market analytics form is different. It asks you to agree that SourceQuanta may store the request and contact you about access. That agreement is consent under the GDPR (Article 6(1)(a)) and consent under the revFADP. You can withdraw it later by using the contact page. Withdrawal does not undo a reply we have already sent.

Cookies

Analytics does not use a cookie. PostHog does not set a cookie on this site, and it does not store a tracking identifier in this browser’s local storage or session storage. If your browser sends a Do Not Track signal, the analytics library is set to respect it. This site does not show a consent banner for analytics.

One strictly necessary cookie can be set, and only on purpose. It is named sq_internal. It is not set on an ordinary visit. It is set only when someone opens the site with ?sq_internal=1 in the address bar. The value is 1. It tells this browser not to send page views. It lasts up to one year, is limited to this site (Path=/), and uses SameSite=Lax. On an encrypted page it is also marked Secure. Opening the site with ?sq_internal=0 deletes it. It is not used to recognise anyone else.

No other cookie is set by this website’s code.

Processors and where data is stored

PostHog processes those page views. They are sent to PostHog’s EU cloud at eu.i.posthog.com. PostHog is the processor for those page views and for the role sent with an analytics request.

Form submissions are stored in Supabase, which is the processor for those messages. The server that receives the form also tries to keep a file copy of the same submission, so a reply is still possible. On the live site that server is Vercel. Vercel hosts and delivers the website. Vercel is a United States company.

The Supabase region is chosen in the Supabase account. It is not set in this website’s configuration, so this notice does not name the country where those rows are kept. This website’s configuration also does not set a Vercel region. The default PostHog host above is the location we can state from the configuration.

International transfers

Page views are sent to PostHog’s EU cloud at eu.i.posthog.com. Switzerland and the European Union each treat the other’s data-protection law as adequate, so a transfer of those page views between Switzerland and that host rests on that decision. This notice does not claim that a transfer contract is on file. None is recorded in this website’s configuration.

Form messages are stored in Supabase. Because the region is not in this configuration, this notice does not claim that those messages stay in Switzerland or the European Union. If the Supabase project is in another country, the transfer is to that country.

Vercel delivers the pages. A connection to the site can be handled by Vercel in the United States. That is separate from where a form message is stored.

How long we keep data

This website does not set an automatic deletion date for page views or for form messages. PostHog keeps page views under the project’s own settings, which are not in this code. The IP address used for the approximate location, and for the daily hash, is not stored with the page view.

Form submissions are kept until we no longer need them to respond. You can ask us to delete a message. The sq_internal cookie, when it has been set, lasts up to one year and is removed sooner if the browser is told to delete it.

Your rights

You can ask us for access to the personal data we hold about you, for a correction, and for deletion. Where we rely on legitimate interests or an overriding private interest, you can object. You can withdraw the consent on the market analytics form, as described above.

Send the request through the contact form or write to info@sourcequanta.com. Under the GDPR and the revFADP we answer an access request within one month. The contact page says we usually reply by email within two working days.

You can also complain to a supervisory authority. In Switzerland that is the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch. If you are in the European Union, you can complain to the authority in the country where you live, or where you believe the issue happened. We do not name a lead authority here, because this configuration does not record where the operator is established.

Changes

If this notice changes, the new version replaces this page. The date in the next section is the date of the latest version.

Last updated

Last updated: 11 October 2026.