What We Collect
Information you give us
- Contact details: name, business email, WhatsApp/WeChat handle, company or store name
- Project information: product requirements, specifications, reference links and images, target prices, quantities, deadlines and certifications
- Commercial documents: quotations, invoices, payment confirmations, shipping documents produced during your project
Information generated during the project
Supplier quotations we obtain on your behalf, sample verification reports, QC reports and photos/videos, and the message history between you and your project owner — all of which live in your project file.
Technical information
When you subscribe to the Starter Checklist we collect your name and email. Our site itself does not run advertising trackers. If we later add analytics, this policy will be updated before that happens.
What we do not collect
We do not ask for and do not want your payment card details, your customers' personal data, or any information unrelated to sourcing. If you send us such data by mistake, we delete it and tell you.
How We Use It
We use your information only to run your sourcing projects and communicate with you:
- Reply to your request and clarify requirements
- Obtain quotations from suppliers — we share only the product information needed to quote, never your customer lists, margins or business internals
- Manage sampling, production, inspection and shipping on your behalf
- Issue itemised invoices and receipts
- Send the checklist you requested, and occasional service updates you can unsubscribe from at any time
Where the GDPR applies, our legal bases are: performance of a contract (running your project), legitimate interests (replying to business enquiries, service security) and consent (the checklist subscription, withdrawn anytime with one click).
We do not sell your data. We do not use your project information to train any model or to build profiles for advertising. Supplier ideas, designs and pricing research you share stay confidential during and after the engagement — the same obligation sits in both directions in our Sourcing Agreement.
Your Rights
Whatever your country, you can ask us to:
- Send you a copy of the personal data we hold about you
- Correct anything inaccurate
- Delete your data ("right to be forgotten") — except records we must keep for tax or legal defence, which we will list for you
- Stop using your data for marketing, at any time, with one click or one message
If you are in the EU/EEA or UK you additionally have rights to data portability and to object to processing based on legitimate interests, and you may lodge a complaint with your local data protection authority. If you are a California resident, you may request disclosure of the categories of data we hold and request deletion, without discrimination in service.
To exercise any right, email hello@tinysourcing.com from the address you used with us. We respond within 30 days.
Cookies
This site is a static website. We use no advertising cookies and no cross-site tracking. At the time of writing, the only storage the site relies on is standard browser functionality needed to display the pages. Third-party content (Google Fonts) may receive your IP address as part of loading the font files; you can block this with any content blocker without breaking the site.
Retention & Security
How long we keep data
- Enquiries that don't become projects: up to 12 months, then deleted
- Active and completed projects: project files are kept for 5 years after the last order — long enough for warranty, tax and re-order needs — then deleted on request or automatically
- Checklist subscribers: until you unsubscribe
How we protect it
Access to project files is limited to the team members working on your order. Devices are encrypted and passcode-protected, and we share documents through access-controlled links rather than public attachments. No system is perfect, so we also keep the amount of sensitive data we hold deliberately small.
International transfer
TinySourcing operates from Yiwu, Zhejiang, China, so your data is stored and processed in China. Where the GDPR applies and data is transferred to us, we rely on the contract-with-you framework plus standard contractual clauses with our EU-facing providers where applicable.
Changes to this policy
If we change anything material, we update the date at the top and, for active clients, notify you by email. The full legal framework around your orders is in our Terms of Service and Sourcing Agreement.
Just Ask
Data requests, corrections, deletions — one email, answered within 30 days.