Privacy policy

1. Who we are

Show Sources Ltd. ("Show Sources", "we", "us") is a UK-incorporated company providing PR and journalist-discovery software at showsources.com. For all data-protection questions our Data Protection Officer can be reached at dpo@showsources.example.

2. Two categories of data

We process two distinct types of personal data:

• Member data — accounts of PR professionals using Show Sources (name, email, password hash, billing address, pitch drafts, lists). Provided directly by the member.
• Directory data — publicly available information about journalists collected from bylines, public profiles, mastheads, RSS feeds, and licensed third-party data providers.

We do not collect personal phone numbers, home addresses, non-public emails, or special-category data (race, religion, health, etc.).

3. Lawful basis

Member data is processed under contract (GDPR Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) for service improvement.

Directory data is processed under legitimate interest (Art. 6(1)(f)). The European Data Protection Board has explicitly recognized facilitating press relations between PR practitioners and journalists as a valid legitimate-interest basis. We balance this against journalist privacy by:

• Only ingesting data that is already public,
• Hiding email and contact details behind authentication,
• Operating a self-service data request form that is processed within 30 days,
• Honoring opt-out requests immediately and permanently.

4. Your rights

Under GDPR / UK GDPR / CCPA you have the right to:

• Access the data we hold about you,
• Rectify inaccurate information,
• Erase your data ("right to be forgotten"),
• Restrict or object to processing,
• Receive your data in a portable format,
• Withdraw any consent you previously gave,
• Lodge a complaint with your local supervisory authority (the ICO in the UK, your DPA in the EU, your state Attorney General in the US).

Use the data request form for any of these. Members can also export and delete their account from workspace settings.

5. Sub-processors

We use a small number of trusted vendors to operate the service. The current list:

• Supabase (Delaware, US — EU data hosted in Frankfurt) — application database, auth, storage.
• Vercel (Delaware, US) — hosting and edge cache.
• Postmark (Wildbit LLC, US) — transactional and outbound email.
• Anthropic (US) — AI features in the pitch composer (no PII or pitch content is used for model training).
• Stripe (Ireland for EU customers, US for North America) — payment processing.

All sub-processors operate under DPAs with appropriate transfer mechanisms (SCCs / UK IDTA / DPF where applicable).

6. Retention

• Member accounts — for the lifetime of the account, plus 30 days after deletion.
• Pitch drafts and conversation history — same as account, with the option to bulk-delete from settings.
• Directory data — refreshed continuously; opt-out records are retained permanently to prevent re-ingestion.
• Billing records — 7 years (statutory).
• Server logs — 30 days.

7. Security

All connections use TLS 1.2 or higher. Passwords are hashed with bcrypt. Database access is governed by row-level security policies enforced at the Postgres layer. We rotate access credentials quarterly and conduct an annual third-party penetration test. See the security page for details.

8. International transfers

For EU/UK users, data is hosted in EU regions by default. Where data must be transferred to the US (e.g., AI processing via Anthropic), we rely on the EU–US Data Privacy Framework, UK Extension, and Standard Contractual Clauses.

9. Changes to this policy

We will post any material changes here with a new "last updated" date. Significant changes (new sub-processors, new data categories) will be announced via email to active members at least 30 days before they take effect.

10. Contact

Privacy questions: privacy@showsources.example
Data Protection Officer: dpo@showsources.example
Postal: Show Sources Ltd, 25 Old Street, London EC1V 9HL, United Kingdom.