SourceMach Privacy Policy

Version 1.0 | Effective Date: July 7, 2026

SourceMach (sourcemach.com) is a B2B marketplace connecting Chinese pharmaceutical-equipment manufacturers with overseas ASEAN buyers, operated from server infrastructure in Hong Kong ("we", "us"). This policy explains how we collect, use, and protect your personal information.

1. What We Collect

Account information: Your email address, optional name, role (buyer or supplier), and language preference. We use passwordless email magic-link sign-in (with Google sign-in planned) and do not store passwords.
Inquiry information: When a buyer sends an inquiry to a supplier, we store the inquiry text, quantity, destination country, and subsequent message threads.
Company claim information: When a supplier claims a company profile, we store the claim evidence, including the company name and the claimant's email, name, and position.
Export-readiness assessment: When Chinese suppliers use our export-readiness assessment tool, we collect company name, contact name, phone number, and email address.
Supplier directory data: Directory listings derive from publicly exhibited trade-fair catalog information. Listed companies may claim and manage their profiles, and may request corrections or removal.

2. How We Use It

To create and manage your account and send sign-in magic links;
To deliver inquiries and messages between buyers and suppliers;
To verify supplier company-claim requests;
To follow up with suppliers on export-readiness assessment results;
To send necessary transactional emails (sign-in links, inquiry notifications). We do not currently send marketing emails.

3. Legal Bases

Contract necessity: account management, authentication, inquiry delivery, and processing company claims;
Legitimate interest: maintaining a supplier directory based on publicly available information, securing the platform, and preventing abuse.

4. Sharing

Suppliers receive buyer inquiry details: When you send an inquiry as a buyer, your name, inquiry text, quantity, and destination country are shared with the relevant supplier so they can respond to you.
Resend (email processor): We send transactional email through Resend, a US-based service provider. Your email address is transmitted to Resend for delivery purposes.
We do not sell or rent your personal information to third parties. We may disclose information where required by law.

5. Cookies

We use only two cookies:

NEXT_LOCALE: stores your language preference;
Session token (JWT): keeps signed-in users authenticated.

We use no advertising trackers and no analytics cookies.

6. Data Retention

Account data: retained until you request deletion;
Inquiries and message threads: retained as business records.

7. International Transfers

Your data is hosted on servers in Hong Kong. Transactional email is processed by Resend in the United States, which means your email address is transferred to the US for delivery. We require our processors to apply appropriate safeguards.

8. Your Rights

You may request access to, correction of, or deletion of your personal information by emailing privacy@sourcemach.com. We will respond within a reasonable period. Companies listed in the directory may use the same channel to request corrections or removal of their listing.

9. Children

This platform is intended for business users (B2B) and is not directed at minors. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on the website or by email. The updated policy applies from its stated effective date.

11. Contact

Privacy matters: privacy@sourcemach.com
Legal matters: legal@sourcemach.com

Operated from Hong Kong; disputes are governed by the laws of the Hong Kong SAR unless mandatory local law applies.