SignalOS
Placeholder — pending legal review. This page is not a binding Privacy Policy. It is a factual summary of what SignalOS actually stores and shares, written for a lawyer to turn into a real policy — not something to rely on as a legal document.

Privacy Policy

Last updated: not yet published.

Data stored by SignalOS

  • Account data: name, email, hashed password (or SSO identity), organization membership and role.
  • Organization and client business data you enter: company descriptions, competitors, strategy, personas, customer-voice text you paste in, recorded facts, and any file you upload.
  • Crawled page content and metadata from websites you designate for analysis, and AI-provider responses collected when you run a measurement.
  • Every record-changing action is written to an append-only audit log (who, what, when) — this exists for your own organization’s accountability, not shared externally.
  • Encrypted third-party API credentials you supply (AES-256-GCM at rest), never stored in plain text.

Where data can go, and only when you configure it

  • An AI provider (see the real, versioned list at /legal/subprocessors) — only the specific query text you’ve approved, only once a real API key is added. Provider training-data policies are described at /legal/ai-disclosures.
  • A connected data source (Google Search Console, GA4, Salesforce, HubSpot, a CMS, a backlink provider) — only after you complete that provider’s own OAuth/API-key connection.
  • Stripe, for billing, once payment is enabled for your organization.
  • Your own configured outbound integrations (Slack, Microsoft Teams, a webhook, a data warehouse) — only if you set one up.

Nothing above is shared with any other SignalOS organization — every tenant’s data is isolated by organization.

Retention, deletion, and subprocessors — now real

A real, deployment-configured retention window and a self-service permanent-deletion path exist — a signed-in organization owner finds both at Setup → Export Data → Data retention & deletion. A real, versioned subprocessor list is published at /legal/subprocessors.

What still needs real legal drafting

The legal basis for processing under applicable law (e.g. GDPR/CCPA), cookie/tracking disclosures, a real contact method for privacy requests, and a signable Data Processing Agreement (see /legal/data-processing for the real, current data-residency posture) are not present here and should not be assumed. Those require a licensed attorney — this page is not a substitute for that.