Privacy Policy

SIGNL (“SIGNL”, “we”, “us”) is operated by Mason Bowstead, a sole trader in the United Kingdom, trading as SIGNL. For the personal data described in this policy about our account holders, website visitors and the people who contact us, Mason Bowstead trading as SIGNL is the controller. Our address is 25 Tunstall Gardens, Redcar, TS10 2TR. You can contact us about privacy at support@trysignl.app. We have not appointed a data protection officer, because the law does not require one for a business of our size and activities.

This policy explains what personal data we collect through the SIGNL platform (trysignl.app and its subdomains), our website and the SIGNL Recorder browser extension, why we collect it, and what rights you have over it.

When a business uses SIGNL to manage its own leads, clients, bookings, messages and recordings, that business is the controller of that data and SIGNL processes it on the business's instructions, under the data processing terms in section 8 of our Terms of Service. If you are a lead or client of a business that uses SIGNL, that business's own privacy notice applies, and requests about your data should go to it first. We will help it respond.

We collect data in four broad categories:

Account and workspace data. When you or your organisation sign up, we collect your name, email address, and any workspace details you provide (business name, team members, roles). If you sign in with Google, we receive your Google account's name, email address and profile photo, as permitted by the scopes you approve during sign-in. If you sign in with Whop, we receive your Whop account's name, email address, profile photo and account identifier.

Business data you input or connect. SIGNL is a CRM and operations platform. Data you or your team enter — leads, contacts, call records, notes, forms, bookings, commissions, and similar business records — is stored so the platform can function. Where you connect third-party integrations (e.g. Stripe, GoHighLevel, Google Calendar), we receive the data those integrations are configured to share.

Recordings and transcripts. When you record in SIGNL or with the SIGNL Recorder extension, we store the recording (video and/or audio), and the transcript and summary we produce from it. Section 5 explains exactly what is captured and when.

Usage and device data. We collect standard technical data (IP address, browser type, pages visited, timestamps) to operate, secure, and improve the service, and lead-tracking data (via our tracking pixel/script) on pages you publish through SIGNL, such as booking and form pages. Section 7 covers analytics on our own website, and section 8 covers the pixel on our customers' websites.

Most data comes from you. Some comes from others: (a) if you sign in with Google or Whop, that provider sends us your name, email address and profile photo, and a unique account identifier; (b) when you pay through Whop, Whop tells us your plan, subscription status and payment events, but not your full card details (see section 10); (c) when you connect another app to your workspace, that app sends the data it is set up to share; (d) a team member who invites you gives us your name and email address.

SIGNL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Google. If you sign in with Google, we receive your name, email address, profile photo and Google account identifier. We use them only to create your SIGNL account and sign you in. We do not use them for advertising.

Google Calendar (optional, per team member). If you connect your Google Calendar, you allow SIGNL to (a) create, update and remove the calendar events for calls booked with you through SIGNL, including the video link and the person who booked, and (b) if you turn on two-way sync, read the busy and free times on your calendar so SIGNL does not offer slots when you are busy. SIGNL reads only those busy and free times and the events SIGNL itself created. It does not read, store or use the titles, descriptions, attendees or other content of your other events. We store the busy times and the identifiers of the events we created, and nothing else from your calendar. You can disconnect your calendar at any time from your Team settings in SIGNL, or from your Google Account permissions page.

Google Ads (optional, per workspace). If you connect a Google Ads account, you allow SIGNL to read that account's campaign names and spend, so SIGNL can show your return on ad spend. If you turn these features on, SIGNL also uploads conversions for leads who became customers, and keeps a Customer Match audience you set up. For both, SIGNL sends your leads' email addresses and phone numbers to Google only after converting them into a one-way code (a SHA-256 hash), as Google requires. SIGNL acts only on the Google Ads account you connect, and only for your own workspace. You are responsible for having your leads' permission for this, under Google's Customer Match policies and the law that applies to you. You can disconnect Google Ads at any time from Integrations in SIGNL, or from your Google Account permissions page.

What is captured, and when. Nothing is recorded until you start a recording. Depending on what you choose, a recording contains: the video and sound of one browser tab; your entire screen, a window or a tab you pick in your browser's own sharing dialog; or, in meeting mode, the audio of the tab your call is in. If you switch them on, your microphone and your camera are included. Recording stops when you stop it, when you close the recording, or at the time limit shown while you record.

Where it goes. Recordings are uploaded directly from your browser to private storage for your workspace. They are not public: a recording can be seen by members of your workspace, and by anyone you send a share link to. You can revoke a share link or delete a recording in SIGNL at any time.

Transcripts and summaries. After a recording is uploaded, its audio is sent to our speech-to-text provider (Deepgram) to produce a transcript with speaker labels, and the transcript is sent to our AI provider (Anthropic) to produce a summary. Both are stored with the recording in your workspace. Neither provider may use this data to train its models: we send every transcription request to Deepgram with its model-improvement programme switched off, and Anthropic does not train on data sent through its commercial API. Each processes the data only to produce the transcript and summary.

The browser extension. The SIGNL Recorder extension stores, on your device only, the address of your SIGNL workspace, your sign-in (or the recorder key you pasted), and your camera and microphone settings. A finished recording is kept on your device until SIGNL confirms it has been uploaded, then removed. The extension does not read the content of the pages you visit, does not collect your browsing history, and makes no requests to any site other than your SIGNL workspace. While you record, it shows its recording controls and camera bubble on the page you are recording, and nowhere else.

Recording other people. Recordings of calls and meetings contain other people's voices and words. Where you record other people, your business is the controller of that recording and SIGNL processes it on your behalf. You are responsible for having a lawful basis to record, and for telling the people on the call that they are being recorded, as the law where you and they are located requires; in some places everyone on a call must agree first. Before a meeting recording starts, the extension asks you to confirm that everyone on the call has been told, and records when you confirmed. Someone who was recorded and wants to exercise their rights over a recording should contact the business that recorded them; we will help that business respond.

We use the data described above to:

• Provide, operate, and maintain the SIGNL platform for your workspace
• Authenticate you and secure your account
• Power features you use, including scheduling, CRM, reporting, and AI-assisted features
• Store your recordings and produce their transcripts and summaries
• Communicate with you about your account or changes to the service
• Monitor, debug, and improve the reliability and security of the platform
• Comply with our legal obligations

Where we rely on legitimate interests, we have balanced them against your rights and you can ask us for the details. Where we rely on consent, you can withdraw it at any time, as easily as you gave it, without affecting what happened before. Providing account details is needed to use SIGNL; without them we cannot create an account. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Where SIGNL uses AI features (e.g. Insights, Ask AI, Training, recording summaries), business data you've already stored in your workspace is sent to our AI provider (Anthropic) to generate the requested output. This data is not used by us or our AI provider to train models, and is processed only to fulfil your request.

Analytics on trysignl.app. On our own website we use the SIGNL pixel, our own first-party analytics tool. It loads only after you choose “Accept” in the banner. If you decline, or do nothing, it does not load, and nothing is stored in your browser except a record of your choice. If your browser sends Global Privacy Control, we treat that as a decline and do not ask.

When you accept, the pixel stores a random identifier (signl_fid) in your browser's local storage, and a session identifier that is cleared when you close the tab. It records the pages you view, the links and buttons you click, how far you scroll, how long a page is open, video progress, the page that referred you and any campaign tags in the link. Our server also receives your IP address, from which we take your approximate location (country and city), and your browser and device type. If you send an application, we link it to this identifier, so we can see which pages and links led to it.

We use this to understand which content and campaigns bring applications, and to improve the site. We do not sell it, and we do not share it with advertising platforms. Mason Bowstead, trading as SIGNL, is the controller, and our legal basis is your consent.

We keep your choice for 12 months, then ask again. You can change it at any time with “Cookie settings” at the foot of every page, or with the settings below.

Withdrawing stops the pixel and removes its identifiers from your browser. It does not delete data already collected, which is kept as set out in section 12; to have that deleted, email support@trysignl.app.

Error reports and session recording. When something breaks, an error report is sent to our monitoring provider, Sentry, which processes it in the EU. It contains the error, the page address, and your account id if you are signed in, so the error can be traced. Before a report leaves SIGNL, we remove cookies and mask email addresses, phone numbers, access tokens and other credentials that we can recognise by their pattern. We rely on our legitimate interest in keeping SIGNL working and secure. Separately, and only if you choose “Accept” in the banner, Sentry Session Replay records what happens on the page when an error occurs, and for a small sample of other sessions. Every word of text and all images and video are masked in the recording, so it shows layout and clicks, not content. It is off unless you accept.

Our customers (coaches, agencies and other businesses) can put the SIGNL pixel on their own websites, booking pages and forms. If you visit one of those sites, this section applies to you.

Who is responsible. The business whose website you visited is the controller of your data. SIGNL processes it on that business's behalf and only on its instructions, under the data processing terms in section 8 of our Terms of Service. For US privacy laws, SIGNL acts as that business's service provider. The business's own privacy notice should explain what it does with your data and its legal basis.

What the pixel stores in your browser. A random visitor identifier (signl_fid) and, if the site uses pop-up forms, a record of which forms you have seen or sent, in local storage; and a session identifier in session storage, cleared when you close the tab. Where the business asks for consent first, nothing is stored until you accept.

What it sends to SIGNL. The pages you view and the page that referred you; campaign tags in links; clicks on links; scroll depth, time on page and video progress; your IP address, approximate location, and browser and device type; and, if you arrived from an ad, the click identifier the advertising platform added to the link and the identifiers that platform has already stored in your browser through its own pixel (SIGNL reads these and does not set them). When you submit a form on the site, it sends your answers, including your name, email address and phone number if you give them. It never reads password, hidden or file fields, and it skips fields asking for card, bank, government ID or similar numbers. If the business links two of its websites, your identifier can be passed between them in the link so you are recognised on both. When you follow a link to a booking, form or checkout page the business uses (such as Calendly, Typeform or a Stripe payment link), the pixel adds your identifier to that link, so the booking, answers or payment can be joined to your visit.

Sharing. Your data goes to advertising platforms (such as Meta, Google or TikTok) only if the business connects its own advertising account to SIGNL, and then only as that business instructs: when you buy, book or submit a form, SIGNL tells that platform about it with your IP address, browser user agent and ad click identifiers, and your contact details in hashed form, so the platform can match it to the ad you saw. We do not sell it.

Global Privacy Control. If your browser sends Global Privacy Control, the pixel does not pass your data to any advertising platform, and by default it does not store an identifier or record your visit.

How long it is kept. See the retention table in section 12. The business can delete your data sooner.

Your rights. Contact the business whose website you visited to access, correct or delete your data, to object, or to opt out under US state privacy laws. If you contact us instead, we will pass your request to that business and help it respond. To stop the pixel on a site, decline its consent banner, use the business's opt-out, or clear your browser's site data.

Businesses that use SIGNL can send text messages and WhatsApp messages to their leads and clients. For those messages the business is the controller, and SIGNL processes the phone numbers, consent records and message history on its behalf (see section 1). Our SMS Terms explain how people agree to messages from a business and how to stop them.

When someone agrees to messages on a SIGNL booking page or form, we keep a record of when and where they agreed and a protected (hashed) copy of their IP address, so the business can show it to a carrier or to that person.

If someone opts out, we keep a record of the opt-out so that it continues to be honoured.

We do not sell your personal data.

Service providers who process data for us. These providers process personal data only on our instructions, to run SIGNL, under data processing terms that bind them. This list was last updated on 3 October 2026.

Independent organisations. These organisations decide for themselves how they use the data they receive, under their own privacy policies:

Whop. We use Whop, Inc. to sell SIGNL subscriptions. When you pay, Whop processes your payment as the merchant of record for card network purposes, under its own terms and privacy policy, and you will see Whop on your card statement. Whop tells us your plan, your subscription status and payment events such as renewals, cancellations, failed payments and disputes. We do not receive your full card details. We give Whop an identifier for your SIGNL organisation, so it can link the payment to the right account. If you choose to sign in with Whop, Whop sends us your Whop account identifier, name, email address and profile photo, which we use only to create your account and sign you in. Whop's privacy policy is at whop.com/privacy.

Google. If you choose to sign in with Google, or to connect Google Calendar, Sheets or Ads, Google LLC handles that under its own privacy policy.

Apps you connect. Services you connect to your workspace (for example Stripe, GoHighLevel or your own Twilio account) send and receive data under your own agreement with them.

Advisers and authorities. We may share data with our professional advisers (such as accountants and lawyers), who are bound by confidentiality, and we may disclose data where the law requires it, or to protect the rights and safety of SIGNL, our users or the public.

Our main database is hosted in the European Union (Stockholm, Sweden) and error reports are processed in Germany. Some of our providers process data in the United States. When personal data leaves the UK, we rely on UK adequacy regulations (including the UK-US Data Bridge for providers certified to it) or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, built into each provider's data processing terms. Section 10 lists each provider and where it processes data. You can ask us for a copy of the safeguards that apply.

We keep personal data only as long as we need it. For data we process for our customers, the periods below are our defaults; the customer can delete data sooner.

Your account (we are the controller). We keep your account details (name, email, sign-in method, team role) while you have an account. When every workspace in your account has been deleted, you can ask us to delete your account details and we will do so within 30 days, unless you are still a member of another organisation on SIGNL. We keep billing records (organisation name, billing contact, invoices, payments, refunds, credit purchases and refunds, the Terms you accepted, and cancellation details) for 6 years from the end of the UK tax year they relate to, to meet UK tax record-keeping rules and in case of legal claims.

Your business data (you are the controller). Leads, contacts, calls, recordings, forms and other business records in your workspace are kept while your workspace is active, until you delete them. Removing a lead hides it from your workspace; permanent erasure of a single lead will be available in a later release. Where the law requires us to keep data for longer, we keep only what it covers, tell you, and delete it when the requirement ends.

Recordings. Recordings are not deleted on a timer. While you are a customer, your recordings, and their transcripts and summaries, are kept until you delete them. When a subscription ends, a workspace that is closed becomes read-only and is scheduled for deletion, with all its recordings, 90 days later, unless you resubscribe first; a pause or a legal hold stops that clock. You can export your data before then. A recording whose upload never finished is removed after 24 hours. A recording you delete is hidden at once and its file is removed for good 30 days later.

Visitor and website data.

Backups. Our database backups keep data for up to 7 days. Data that is deleted stays in them until they expire. We do not use backups for anything except recovering from a failure.

People in our customers' workspaces. If you are a lead or contact of a business that uses SIGNL, that business decides how long your data is kept. Please contact them to ask about it or to have it erased. If you write to us at support@trysignl.app and tell us the business's name, and that business uses SIGNL, we will pass your request on.

We use industry-standard measures to protect your data, including encryption in transit, row-level access controls scoped to your organisation, private storage for recordings reached only through short-lived signed links, and restricted internal access. Our Security page (trysignl.app/security) describes the controls in place and the code behind each one. No system is perfectly secure, and we can't guarantee absolute security, but we work to keep your data safe and will notify you as required by law if a breach affects you.

You have the right to ask for a copy of your personal data, to have it corrected or deleted, to have it given to you or another provider in a portable format, to restrict or object to our use of it (including at any time to direct marketing), and to withdraw consent where we rely on consent. To use any of these rights, email support@trysignl.app. We reply within one month, and tell you if we need longer. If you are unhappy with how we have handled your data, please complain to us first at the same address: we will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or, if you are in the EU, to your local data protection authority.

If you are in the United States: we do not sell your personal information, and we do not share it for cross-context behavioural advertising. We treat a Global Privacy Control signal as an opt-out on our website. You can ask to know, correct or delete the personal information we hold about you by emailing support@trysignl.app, whatever state you live in, and we will not treat you differently for asking. If a business that uses SIGNL holds your information, it is responsible for answering your request and we will help it.

SIGNL is a business tool for people aged 18 and over. We do not knowingly collect data from children through our own website or accounts. If you think a child has given us personal data, contact us and we will delete it. Businesses using SIGNL are responsible for any data about children in their own workspaces.

We may update this policy. The date at the top shows when it last changed, and earlier versions are available on request. If a change materially affects how we use your personal data, we will tell account holders by email or in the app before it takes effect. If a change needs your consent, we will ask for it.

Questions about this policy or your data? Email support@trysignl.app.

SIGNL is a trading name of Mason Bowstead, a sole trader in the United Kingdom.Address: 25 Tunstall Gardens, Redcar, TS10 2TR, United Kingdom.Email: support@trysignl.app.Not VAT registered.