Privacy Policy

© House of Deep GmbH

Effective Date: 15 July 2026

SOURCE ("we", "us", or "our") is operated by House of Deep GmbH. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the SOURCE app. By using SOURCE, you agree to the terms of this Privacy Policy.

1. Information We Collect

When you create an account or interact with SOURCE, we may collect the following:

• —Identity information: name and email address provided at sign-up
• —Profile data: optional profile details you choose to share within the community
• —Event participation data: events you register for, sign up to, or express interest in
• —Event attendance data: physical attendance at SOURCE events is recorded via QR scan at the door, for capacity management and community safety
• —Administrative notes: staff may maintain internal notes about members for community safety and event coordination purposes; these are not visible in the app but are available to you on request (see Section 6)
• —Contribution and payment data: subscription status and billing history (processed securely via third-party providers — we do not store full card details)
• —Usage data: app interactions, session duration, and feature usage patterns
• —Device data: device type, operating system, and push notification tokens used to deliver app notifications

2. How We Use Your Information

We use your information to:

• —Create and manage your SOURCE membership and account
• —Provide access to curated events and community experiences
• —Process your monthly contribution and manage billing
• —Communicate with you about upcoming events, updates, and community news
• —Improve the SOURCE app and personalise your experience
• —Maintain the safety and integrity of the SOURCE community
• —Comply with legal obligations

3. Free and Paid Membership

SOURCE offers both a free membership tier and a paid membership. Free members may access selected posts and events. Most content in the SOURCE feed is reserved for paid members and will be visible but marked as members-only for free accounts. We collect and process personal data for both membership tiers in the same manner as described in this policy.

4. Data Sharing

We do not sell your personal data. We may share data with:

• —Payrexx — our payment processor, used to handle your contribution securely. Payrexx is a Swiss company subject to Swiss data protection law.
• —Supabase — our database and infrastructure provider. Your data is stored on Supabase servers located in Sweden (EU). The EU is recognised by Switzerland as providing adequate data protection under the nDSG.
• —Vercel — our admin platform infrastructure provider. Vercel is a US-based company. Data processed via the admin platform is covered by a Data Processing Agreement (DPA) and Standard Contractual Clauses (SCCs) in accordance with the nDSG requirements for transfers to countries without an adequacy decision.
• —Event partners — where necessary for attendance coordination; only the minimum required data is shared.
• —Legal authorities — if required by law or to protect the rights of SOURCE and its members.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services.

If you delete your account:

• —Your profile, personal data, push notification tokens, event records, and administrative notes are deleted within 30 days.
• —Payment transaction records (amount, currency, transaction reference, and provider details returned by Payrexx) are retained as required by Swiss law (Code of Obligations, 10-year retention obligation for financial records). These records are anonymised upon account deletion — your user identity is de-linked from payment records and they can no longer be attributed to you directly.

6. Your Rights

Under the Swiss Federal Act on Data Protection (nDSG), you have the right to:

• —Access the personal data we hold about you, including any internal administrative notes
• —Request correction of inaccurate data
• —Request deletion of your data
• —Object to or restrict certain processing
• —Data portability

To exercise any of these rights, contact us at: privacy@source-app.xyz

7. Security and Data Hosting

We take the security of your data seriously. SOURCE uses industry-standard encryption and access controls to protect your information.

Your data is stored on servers located in Sweden (EU), operated by Supabase. The EU is recognised by Switzerland as providing adequate data protection standards equivalent to those required under the nDSG. Our admin platform is operated on Vercel infrastructure and covered by appropriate contractual safeguards.

No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

SOURCE is not intended for individuals under the age of 18. We do not knowingly collect data from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via the app and require your explicit re-acceptance before continued use. Minor updates may be communicated by email or in-app notice.

10. Contact

House of Deep GmbH
Hohlstrasse 440, 8048 Zürich, Switzerland
Email: privacy@source-app.xyz