Privacy Policy

Effective Date: April 14, 2026 · Last Updated: April 14, 2026

TrueSource Metals ("we", "us", "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains what data we collect, why we collect it, and how we handle it — in accordance with Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO").

1. Who We Are

TrueSource Metals is a commodities-focused AI, Fintech, and Web3 platform based in Hong Kong. We operate the following websites:

• truesourcemetals.com — our main corporate website

For any privacy-related inquiries, please contact us at: info@truesourcemetals.com

2. What Data We Collect

We collect only what is necessary for the purposes described below. We do not sell or trade your personal data.

2.1 Contact Form Submissions

When you submit our contact form, we collect:

• Your name
• Your email address
• Your message content
• Organization name (if provided)

This data is submitted via Formspree, a third-party form processing service based in the United States. Formspree is SOC 2 Type II certified and GDPR-compliant. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

2.2 Website Analytics

We use Google Analytics 4 to understand how visitors interact with our sites. Google Analytics collects:

• Pages visited and time spent
• Approximate geographic region (country/city level)
• Device type, browser, and operating system
• Referral source (how you arrived at our site)

2.3 Data We Do Not Collect

We do not collect or process:

• Payment or financial information
• Identity card (HKID) or passport numbers
• Biometric data
• Health or medical information
• Data from minors (under 18)

3. How We Use Your Data

We use the data we collect solely for the following purposes:

• Contact form data: To respond to your inquiry, provide requested information, and follow up on potential business discussions.
• Analytics data: To understand site usage patterns, improve content, and monitor site performance. This data is aggregated and not used to identify individuals.

We do not use your data for direct marketing, automated decision-making, or profiling.

4. Data Sharing and Transfers

We share personal data only with the following third-party services, which are necessary for the operation of our websites:

• Formspree, Inc. (United States) — processes contact form submissions. Formspree acts as a data processor on our behalf. Their privacy policy and security practices are publicly available.
• Google LLC (United States) — provides website analytics via Google Analytics 4. Google's privacy policy applies to this service.
• Cloudflare, Inc. (United States) — hosts our websites and provides CDN/security services. Cloudflare's privacy policy applies.

These services may process data outside Hong Kong. We have reviewed their privacy and security practices to ensure they provide adequate protection in accordance with PDPO principles.

We do not share your data with any other third parties, advertisers, or data brokers.

5. Data Retention

• Contact form submissions: Retained for as long as necessary to address your inquiry and for reasonable follow-up, after which they are deleted. We do not retain contact data indefinitely.
• Analytics data: Google Analytics data retention is set to 14 months, after which it is automatically deleted by Google.

6. Cookies

Our websites use a limited number of cookies:

• Google Analytics cookies (_ga, _ga_*) — used to distinguish unique visitors and sessions. These are first-party cookies set by our domain.
• Cloudflare cookies (__cf_bm) — used for bot detection and security. These are strictly necessary for site operation.

We do not use advertising cookies, tracking pixels, or social media cookies. You may disable cookies through your browser settings, though this may affect site functionality.

7. Your Rights Under the PDPO

Under Hong Kong's Personal Data (Privacy) Ordinance, you have the right to:

• Access any personal data we hold about you (Data Access Request)
• Request correction of any inaccurate personal data
• Request deletion of your personal data from our systems

To exercise any of these rights, please email us at info@truesourcemetals.com with the subject line "Privacy Request". We will respond within 40 days, as required by the PDPO.

8. Data Security

We take practicable steps to protect your data:

• All our websites are served exclusively over HTTPS (TLS 1.2+)
• Cloudflare provides DDoS protection, WAF, and SSL/TLS encryption
• Form submissions are encrypted in transit and at rest
• We do not store personal data on local servers — all data is processed by vetted third-party services with documented security certifications

9. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated "Last Updated" date. We encourage you to review this page periodically.

11. Contact

If you have any questions about this Privacy Policy or our data practices, please contact:

If you believe we have not adequately addressed your privacy concerns, you may also contact the Office of the Privacy Commissioner for Personal Data, Hong Kong.