Privacy policy

Last updated: 17 October 2026.

Scydex Ltd operates SourceKeel and controls the personal data described here. Our address is 320 City Road, London, England, EC1V 2NZ. Contact [email protected] about privacy.

This policy covers sourcekeel.com, the console, API accounts and keys, agent sign-ups, our MCP server, billing, support, and the emails we send. The cookie policy describes cookies, browser storage, and optional external resources.

What we collect

Your account

For an account, we collect your email address, account ID, plan, settings, and sign-in records. SourceKeel has no passwords. You sign in with a code we email to you, or with Google or AgentID. We keep only a hashed copy of each sign-in code. A code stops working once it is used or expires.

We store API key hashes, key names, prefixes, permissions, optional monthly caps and expiry dates, project identifiers, creation dates, and last-use records. We keep only a hash of each live key, so we cannot show a live key to you again. Every account also gets one sandbox key. It reaches sample data only and spends no credits. We keep the sandbox key encrypted so the console can show it to you again.

Agents

An agent can sign up for an account, or join yours, with an email code or AgentID. For each agent we store the name it gives itself, how it joined, and its keys. An agent account uses the same account records as a human account. An AgentMail-style inbox is an email address you choose. SourceKeel does not create or control that inbox. An inbox provider can read messages delivered to it, including sign-in codes. Use an inbox that you or your authorized operator controls.

Sign-ins, sessions, and devices

We use session identifiers to keep you signed in. We store only a hash of each session token. For each session we record whether it is a browser session or an agent's API session, how it signed in, when it started and was last used, and the user agent your browser or client sent. We also record your network: your IP address cut down to its /24 (IPv4) or /48 (IPv6) network, never the full address.

When you sign in in a browser, we set a device cookie that holds a random identifier, not your account ID. We keep a list of the devices that have signed in to your account: a hashed device identifier, a label taken from the user agent, and when each device was first and last seen. For an agent that signs in over the API, we work out the device from the client's label and its /24 network. We use this list to email you when your account is signed in to from a device it hasn't used in 90 days.

API requests and request history

For API calls, we process the requested route, query parameters, account and key identifiers, response status, request ID, time, and credit usage. We keep a record of each API request made with your key or session, so you can see your requests in the console and through GET /v1/requests. Each record holds the time, method, route, query string, response status, error code, credits used, duration, request ID, key ID, the kind of client (HTTP, MCP, or command line), and your IP address. Before we store a route or query string, we replace anything that looks like a key, token, password, or other secret with "[redacted]". We never store request headers or request bodies.

For the last 48 hours, request history keeps your full IP address in our database. In that window we keep every failed request, and successful requests up to an hourly count for each key, then a sample of the rest. Older history is kept as files with our storage provider, with the IP address cut down to its /24 or /48 network. We keep those files for 30 days on paid plans and 7 days on Sandbox.

Network and security records can include your IP address and user agent. Our security logs record events such as wrong sign-in codes with the route, your /24 or /48 network, and a request ID. They never record codes, keys, or email addresses. Website visits can create similar network records. We collect the cookie choice that your browser sends with requests.

Activity log

We keep an activity log of changes to your account. It records keys made, rotated, or revoked; changes to key caps, expiry, and permissions; agents added or removed; approvals asked for and decided; sessions ended; plan and overage changes; support tickets opened; exports and deletions asked for; and email setting changes. Each entry records who made the change (you, one of your agents, or SourceKeel), how they did it, and when. It does not record IP addresses. Entries are never edited. You can read the log in the console.

Billing

For billing, we collect payment references, Stripe customer and subscription identifiers, plan purchases, invoices, receipts, and billing status. Stripe collects the payment details required for your chosen method. Our application does not store full card numbers or card security codes. For a machine payment, your agent sends a payment token with its request. We pass the token to Stripe to take the payment, and we do not store it. We keep the purchase record: the plan, the amount, the term, the start and end times, the Stripe payment ID, and the receipt link. Do not send payment tokens through support.

Support, corrections, and feature requests

For support, we collect the contact email, the subject, the messages in each ticket, the account ID, the key ID when an agent opened the ticket, any request IDs you attach, and other information you supply. A ticket is a thread of messages. Each message records whether you, one of your agents, or SourceKeel wrote it. Before we store a message, we replace anything that looks like a key, token, or password with "[removed]". We also keep correction reports about data values and feature requests for new data, with our answers. Do not send passwords, API keys, verification codes, or unrelated personal data.

Emails

We keep a record of each notice we queue for your account, and your email settings.

Integrations

When you connect an MCP client or Zapier, that service processes the requests and results you send through it. Its operator has its own privacy policy. Connecting an integration does not give SourceKeel access to all your conversations or your whole mailbox.

If you sign in with Google, or link Google to your account, Google gives us an identifier for your Google account, your email address, and whether Google has verified it. We store the identifier, the email address at the time you linked it, and the date. We do not store your name or photo.

If an agent or a person signs in with AgentID, AgentID gives us an identifier, an email address, whether the email is verified, whether the user is an agent or a person, the identifier of its owner, and a display name. We store these. The display name becomes the agent's name in your console.

A linked sign-in method stays connected until you delete your account. You can always sign in with an email code. To remove a linked sign-in method without deleting your account, email [email protected].

Public source information

SourceKeel collects SEC EDGAR public filings and information from permitted public sources. These records can name directors, officers, beneficial owners, and other people in their business roles. The record identifies its source through provenance. We process this information to make public filings searchable and traceable. We do not contact the people named in a filing one by one. This policy is our notice to them.

If our copy of a record does not match the filing, report it as a correction and we fix our copy. We cannot change a filing itself, because the filer and the SEC hold the original, and we do not remove a person's name from a filing because they ask. You can ask us to delete or restrict our copy of personal details about you. Email the privacy address and identify the record. We weigh each request against the purpose of keeping the public record, tell you the outcome and the reason, and act where the law requires it.

Why we use information

We use account information to provide the service, verify access, manage keys, answer support requests, and administer billing. For individual customers, our legal basis is performance of the contract and steps you request before it starts. For business contacts, our legal basis is our legitimate interest in administering the customer's service.

We use security and usage records to protect accounts, enforce limits, investigate misuse, and improve reliability. We use session, device, and activity records to show you where you are signed in, let you sign out everywhere, email you about new devices, and show you who changed what on your account. Before a checkout, a billing portal visit, an overage change, a key limit change, an approval, or a data export or deletion, we ask for a fresh code from your email. We use request history to show you your own requests and to help answer your support questions. Billing does not use request history. Credits come from separate counters. Our legal basis for these uses is our legitimate interest in a secure, reliable service. We use public source information under our legitimate interest in providing traceable public information. We use records required for tax, accounting, or legal duties under the applicable legal obligation.

We use consent for optional browser resources. You can withdraw consent without affecting earlier lawful processing.

Service emails include sign-in and confirmation codes, security notices, billing notices, usage alerts, approval requests, support replies, data export notices, and one final email when an account is deleted. Security notices include a notice to our staff when a staff sign-in fails or is locked. Billing notices include a notice that one of your agents asked for a plan change. Security and billing emails always go out, because they tell you about access to your account or about money. The failed-payment notice comes from SourceKeel. You can turn off emails about usage, caps, and expiring keys on the console's Account page, and emails about agent requests on its Activity page. Support replies and data export notices answer something you asked for, so they have no switch. We do not send marketing emails or digests. Our emails never include words an agent wrote, such as its reasons or ticket messages. You see those only in the console, marked as the agent's. Emails come from "SourceKeel Team" at [email protected]. Replies to most of our emails go to our support team at [email protected]. Sign-in and confirmation codes, wrong-code warnings, and staff emails have no reply address.

We apply automated checks to request rates, credit balances, payment verification, and sign-in attempts. These checks can reject a request or restrict access. Contact support if you believe a restriction is wrong. You can request human review.

Who receives information

Stripe processes payments, checkout, and the billing portal, and keeps billing records. Its role depends on the payment service and its legal duties.
ZeptoMail delivers our emails. It receives recipient addresses and message contents, including sign-in codes and the address for the final deletion email.
Hetzner hosts our servers, including our database, in its data centres in the European Union.
Cloudflare carries traffic to our sites and stores files for us in its R2 storage, including older request history.
Google and AgentID process the sign-ins you start with them, as described above.
Google Fonts and unpkg receive browser request information when you enable external resources. See the cookie policy.
Your chosen inbox, MCP client, or Zapier receives information you direct through that service.
Professional advisers receive information needed for legal, accounting, or business advice.

We can disclose information when the law requires it or to protect accounts, people, and our legal rights. If the business changes ownership, necessary information can pass to the new operator under appropriate protections.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not use account credentials for advertising or to infer sensitive characteristics.

Who at SourceKeel can see it

A small number of people who work for Scydex Ltd ("staff") can read support tickets, correction reports, feature requests, the status of export and deletion requests, and each account's email address, account ID, and plan. Staff sign in with an email address, an access key, and a code from an authenticator app, and only from approved networks. Every page a staff member opens and every change they make is recorded before anything is shown. Staff pages never show API key secrets, session tokens, or sign-in codes. Staff cannot sign in as you or act as you. We keep the record of staff access after an account is deleted, because it shows who looked at what. It holds the staff member, the time, the page or change, the account ID, and the staff member's network, and nothing else about you.

International transfers

Scydex Ltd is based in the United Kingdom. Our servers are in the European Union. Stripe, Cloudflare, Google, AgentID, and our email provider can process information in the United States and other countries. For a restricted transfer, we rely on an adequacy decision where one applies, including the UK and EU decisions for companies certified under the EU-US Data Privacy Framework. Otherwise we rely on the provider's standard contractual clauses with the UK addendum. Contact the privacy address for information about the safeguards that apply to your data.

Retention

We keep account records while needed to provide your account and resolve account closure. We keep usage and security records while needed to verify billing, investigate incidents, and resolve disputes. We keep support records while needed to resolve the request and related disputes. We keep invoices and payment records for applicable accounting, tax, and legal retention periods.

Some records have fixed lifetimes:

A browser session ends after 7 days without use, or 30 days after you signed in. An agent's API session ends after 1 hour.
We delete a session when you sign out or end it, and remove expired sessions within about an hour.
Request history keeps your full IP address for 48 hours. Older history files, with the network only, are kept for 30 days on paid plans and 7 days on Sandbox.
An account data export can be downloaded for 24 hours after you ask for it.
The activity log, your device list, your keys, your linked sign-in methods, your support tickets, correction reports, and feature requests are kept while your account exists, and deleted when you delete it.
Sign-in codes are kept, as a hash, only until they are used or expire after 15 minutes.
Server and security logs are rotated by size, and older entries are overwritten.

We consider the record's purpose, sensitivity, legal requirements, and unresolved disputes when deciding how long to keep it. We delete or anonymize records when those purposes end, subject to legal holds. Backups are kept for 30 days. A backup taken before you delete your account still holds your data, including your email address, until it is replaced, which is within 30 days of the deletion. Expired sign-in sessions do not grant access, even if a record remains for security purposes. The cookie policy gives the browser lifetimes we know.

When you delete your account, we delete it straight away. We keep only the billing records we must keep, for at least six years after the end of the financial year they relate to, as UK tax and accounting rules require:

Month-end overage invoices: amounts and Stripe invoice IDs.
The monthly credit counts and overage amounts those invoices were worked out from.
Machine payment receipts: Stripe payment IDs.
Stripe billing events: event and subscription IDs, and what we did with them.
The account ID with its Stripe customer and subscription IDs. We clear the email address, name, and sign-in data from it.
A record that the deletion was done, with counts of what was removed and no personal data.

As the last step of a deletion, we send one confirmation email to your account's address. Until it is sent, the job that sends it holds the address only in sealed form. We delete the job once the email is sent, and after that SourceKeel keeps no copy of the address. Deleting your account cancels your Stripe subscription. Stripe keeps its own records of your customer account and payments under its own legal duties.

Your rights in the UK and EEA

Under applicable data protection law, you can request:

Access to your personal data and a copy.
Correction of inaccurate data.
Deletion where the right applies.
Restriction of processing where the right applies.
A portable copy where processing uses consent or a contract and is automated.

You can object to processing based on legitimate interests, including our processing of public source information. You can object to direct marketing at any time. You can withdraw consent through cookie settings or by contacting us. Some rights have exceptions. We explain any refusal and the available complaint route.

You can complain to the UK Information Commissioner's Office. In the EEA, you can complain to the authority where you live, work, or believe an infringement occurred.

Your rights under US state laws

Where a state privacy law applies, you can request access, correction, deletion, and a portable copy, subject to that law's exceptions. California residents can request the categories and specific pieces collected, sources, purposes, and recipient categories for the applicable reporting period. The collection and recipient sections above describe those categories and purposes. Account sign-in information can qualify as sensitive personal information. We use it to provide and protect your account.

Applicable laws can give rights to opt out of sale, sharing, targeted advertising, or certain profiling. Our practices described above do not include sale, advertising sharing, or targeted advertising. We do not require an advertising opt-out to use the service. We honor applicable universal opt-out signals for any processing to which those signals apply. We do not discriminate against you for exercising your rights.

To appeal a refusal where state law provides an appeal, email the privacy address with the subject "Privacy appeal". We explain the outcome and any route to contact your state regulator. An authorized representative can submit a request with proof of authority. We can also ask you to verify your identity or confirm that authority. An AI agent account does not automatically authorize the agent to exercise another person's privacy rights.

Requests and account closure

You can download a copy of your data, or delete your account, yourself in the console under Account settings. Both need you to be signed in in a browser and to confirm a fresh code from your email. An agent's API session cannot do either. The export is one JSON file. It holds your account details, keys (by prefix, never the secret), agents, projects, sessions, usage, billing records, sign-in methods, support messages, correction reports, feature requests, activity log, approvals, email settings, and the last 48 hours of request history. Older request history files are not in the export. You can download the export for 24 hours. Deleting your account cancels your subscription, revokes every key, ends every session, and removes your data, including request history and the activity log. It cannot be undone.

You can also email [email protected] from your account address where possible. State the request and identify the account or public record concerned. We ask only for information reasonably needed to verify and fulfill your request. We reply within one month. If a request is complex, we tell you within that month and reply within two more months. For a request under a US state privacy law, we reply within 45 days, or tell you within that time if we need 45 more. If we cannot fulfill part of the request, we explain why under the applicable law.

For account deletion by email, use the subject "SourceKeel account deletion". Ask us to close the account and stop future billing. We can retain records required for legal obligations, security, or disputes.

An email address and access verification are required for an account. Without them, we cannot provide authenticated service. Optional information and optional browser resources are not required to browse public pages.

Children

SourceKeel is for people aged 18 or over and for businesses. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact [email protected] and we will delete it.

Security

We use reasonable technical and organizational measures to protect personal information. These include encrypting traffic to our sites, storing API keys, session tokens, and sign-in codes only as one-way hashes, keeping the sandbox key and staff authenticator secrets encrypted, cutting IP addresses down to a network in long-lived records, and limiting staff access. The security page describes these measures in more detail. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes

We update the date when this policy changes. For material changes, we provide an additional notice where required. Contact Scydex Ltd at the address or privacy email above for questions.

Your cookie choices