Privacy policy

1. Who we are

Tail Sourcing is a brand operated by Alsea Trading Group LLC, a Florida limited liability company ("Tail Sourcing", "we", "us"), which operates tailsourcing.com and esourcing.tailsourcing.com. Postal address: Alsea Trading Group LLC, 19505 Biscayne Blvd, Suite 2350, Aventura, FL 33180, USA. Privacy contact: sales@tailsourcing.com.

For questions about this policy or to exercise any of the rights described below, contact sales@tailsourcing.com.

We are the controller for personal data about website visitors, prospects and account administrators, and a processor for Customer Data your organisation uploads into the Services. If you are located in the European Economic Area, the United Kingdom or Switzerland, this allocation applies unless a written agreement states otherwise.

2. Personal data we collect

Account and identity data: name, work email, company, job title and password credentials.

Billing data: billing contact, tax identifiers and payment metadata processed by our payment provider (Stripe). We do not store full card numbers on our servers.

Platform usage data: pages visited, features used, event and error logs, device and browser information, IP address, and approximate location.

Communications: content of emails, support tickets, webinar registrations and marketing preferences.

Customer content: purchase requests, RFx, supplier records and related documents that your organisation uploads into the Services and for which your organisation is the controller.

Website forms: name, work email, company and message.

Newsletter: email, language, optional segment and the consent record (date, text, form and language).

Conversations with the AI assistant on this website.

Website analytics only with consent: PostHog collects page views and events. Session recording is enabled only if the visitor turns it on, with text and fields masked.

Website payment data processed by Stripe. Calendly and OpenStreetMap load only if the visitor chooses to load them.

3. Legal bases for processing

Where GDPR or UK GDPR applies, we rely on the following legal bases: (i) performance of a contract, to provide and administer the Services; (ii) legitimate interests, to secure the platform, prevent fraud, and improve our products; (iii) consent, for optional marketing communications, non-essential cookies, and any special-category data you voluntarily submit; and (iv) compliance with legal obligations.

4. How we use personal data

To deliver, operate and maintain the Services, authenticate users and provision workspaces.

To process subscriptions, invoices, renewals and cancellations.

To provide customer support and respond to inquiries.

To monitor, secure and improve the platform, including analytics, error diagnostics and product research.

To send transactional emails (activation, password reset, billing notices) and, where permitted, service and marketing updates you can unsubscribe from at any time.

To comply with legal, tax, accounting and regulatory obligations.

5. Sharing and subprocessors

We share personal data only with service providers that support the Services under written contracts requiring appropriate confidentiality and security. Our current subprocessors and categories are: cloud hosting and the application database (Base44 and its underlying cloud infrastructure); payments (Stripe); transactional email delivery (Resend); supplier identity verification (Didit); accounting integrations when the Customer connects them (QuickBooks Online); maps after authentication (Mapbox); and large-language-model providers (Google Gemini and OpenAI) acting as processors for the AI features a user invokes.

Website (tailsourcing.com): Lovable (website hosting, basic traffic statistics and AI Gateway); Supabase (database for website forms, newsletter and chat); Cloudflare (delivery network and security); Google Gemini through Lovable AI Gateway (website AI assistant); PostHog (analytics, only with consent); Resend (emails); Stripe (payments); Calendly (only if you load it); and OpenStreetMap (only if you load the map).

We do not sell Customer procurement data, and we do not use it to train public models for unrelated third parties.

We may disclose personal data if required by law, to enforce our terms, or to protect the rights, property or safety of Tail Sourcing, our customers or others. In the event of a merger, acquisition or asset sale, personal data may be transferred subject to the protections of this policy.

6. International data transfers

Personal data may be processed in countries outside your own, including the United States. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and equivalent safeguards to ensure an adequate level of protection.

Website data is processed primarily in the United States.

7. Data retention

We retain personal data only for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes and enforce our agreements. Account data is generally retained for the life of the account plus a reasonable archival period. Billing records are retained for the period required by applicable tax law. You may request deletion of your data at any time, subject to those legal retention requirements.

PostHog analytics data: 30 days. Assistant conversations: 12 months. Newsletter subscriber data is retained until they unsubscribe, and consent records for as long as necessary to demonstrate consent.

8. Security

We apply industry-standard administrative, technical and organisational safeguards, including encryption in transit (TLS) and at rest, role-based access control, audit logging, least-privilege principles and regular security reviews. No system is perfectly secure; if we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

Details on HTTPS, multi-tenant isolation and our incident and breach notification plan are published on our security page at /legal/security.

9. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict or object to the processing of your personal data, receive a portable copy, and withdraw consent at any time without affecting the lawfulness of prior processing.

You may also lodge a complaint with your local data protection authority. To exercise any of these rights, email sales@tailsourcing.com. We may need to verify your identity before responding.

Residents of California and other US states: subject to applicable law, you have the right to know/access, delete, correct and opt out of the sale or "sharing" of data. We do not sell personal information or share it for cross-context behavioral advertising. We treat the Global Privacy Control signal as an opt-out request. We do not discriminate for exercising rights and accept authorized agents.

Colombia (Law 1581 of 2012 and Decree 1377 of 2013): rights to know, update, rectify and delete data and revoke authorization. We respond to inquiries within a maximum of 10 business days and complaints within a maximum of 15 business days. You may contact the Superintendencia de Industria y Comercio.

Mexico (LFPDPPP): ARCO rights (access, rectification, cancellation and opposition) and withdrawal of consent.

Exercise all these rights by emailing sales@tailsourcing.com.

10. Cookies and similar technologies

Our banner distinguishes four categories: Necessary, always active to operate the site; Analytics; Session recording, off by default; and Third-party content, including Calendly and OpenStreetMap.

Your choice is stored for 12 months in your browser, in localStorage under "ts_consent_v1". We respect Global Privacy Control as a rejection of analytics. You can change your choice at any time using "Cookie preferences" in the footer.

11. AI assistant on this website

The assistant is an AI, not a person. We store messages and a technical session cookie (ts_advisor_sid) to maintain the conversation. Lovable AI Gateway and Google Gemini process messages to respond and improve the service. Messages are retained for 12 months. Responses may contain errors and are not advice. Do not share confidential information or sensitive personal data.

12. Children

The Services are intended for business use and are not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the Services or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

14. Contact

For questions, requests or complaints about this policy or our data practices, contact sales@tailsourcing.com. Postal address: Alsea Trading Group LLC, 19505 Biscayne Blvd, Suite 2350, Aventura, FL 33180, USA.