Privacy Policy

This Privacy Policy describes how SignalGate("we," "us") handles personal data we collect directly when you visit signalgate.ai, sign up for the dashboard, contact us, or otherwise interact with our marketing and customer-facing surfaces.

It does not cover how we process personal data on behalf of our customers (that is governed by the Data Processing Addendum). If you reached this page after encountering the SignalGate SDK on a third-party site, contact that site directly — they are the data controller in that relationship.

Account data

When you sign up: name, email address, and password (stored as a salted hash). If you set a workspace name, company name, title, or timezone in your profile, we store those too.

Browser fingerprint signals (dashboard users)

When you sign in or sign up via the dashboard, the SignalGate SDK runs in your browser and collects non-PII device signals — GPU renderer string, screen resolution, user-agent, timezone, and similar attributes — to generate a fraud-risk assessment for the login event itself (the same service we provide to our customers). These signals are encrypted in-browser before transmission and processed solely for fraud prevention.

Contact and newsletter data

Name, email address, and the message body you submit via the contact page. Email address only if you subscribe to our newsletter.

Technical data

IP address, user-agent, referrer URL, and pages visited, recorded in server access logs. Authentication tokens are stored in your browser's localStorage — see our Cookie Policy for details.

Analytics and advertising measurement

We load three third-party tags:

• Google Ads conversion tag (Google LLC), across the whole site — measures whether visits that arrive from our ads lead to sign-ups. It sets _gcl_* cookies and reads the gclid URL parameter that Google appends to ad clicks. It does not record sessions.
• Yandex Metrica (Yandex), on our public pages only — never inside the signed-in dashboard — product analytics, including clickmaps and Webvisor session replay (recordings of page interactions such as scrolling, clicks, and mouse movement). It sets _ym_uid, _ym_d, and related _ym_* cookies.
• X conversion tracking pixel (X Corp.; for the EU, UK and EFTA, Twitter International Unlimited Company), on our public pages only (it is not loaded when you open the signed-in dashboard; a pixel already loaded on a public page stays active in that browser tab until you reload or close it) — measures whether visits that arrive from our ads on X lead to sign-ups. It sets the _twclid, _twpid and _twsid cookies and reads the twclidURL parameter that X appends to ad clicks. When you create an account, it reports the sign-up to X with an internal reference number — never your name or email address. We have switched off the pixel's automatic features, so it does not read form fields, report button clicks or time on page, or read other tags' data. It does not make session-replay recordings.

See the Cookie Policy for the full list of what each tag stores.

Playground

If you run the SignalGate Playground, we receive:

• your API key, to authenticate you;
• a record of the session: when it started, which chapter you reached, and the version of the consent you accepted;
• unless you run it with --no-telemetry: the identifiers of the tutorial checks that failed, and the before and after conversion figures of your run.

We never receive your source code, file paths or environment values. The traffic the playground sends is synthetic. Its user identifiers and IP addresses are made up, and it contains no personal data.

What we do not collect

• No advertising or tracking pixels beyond the Google Ads conversion tag, Yandex Metrica and the X conversion tracking pixel described above — in particular, no Facebook pixel.
• No data purchased from data brokers.
• No payment card numbers — billing is handled by a third-party payment processor, which is subject to its own privacy policy.

• Providing the service — creating accounts, authenticating logins, sending transactional emails (verification, password reset), billing, and customer support.
• Fraud prevention on our own platform — using the fingerprint signals collected at login to detect credential stuffing and account takeover attempts on signalgate.ai itself.
• Communication — responding to contact-form submissions and, with your consent, sending the newsletter. You can unsubscribe at any time via the link in any marketing email.
• Analytics and advertising measurement — understanding how visitors use the site (Yandex Metrica, including session replay) and measuring which ad campaigns lead to sign-ups (Google Ads conversion tag and the X conversion tracking pixel).
• Legal and compliance obligations — retaining records required by law (e.g. invoices).

We do not sell your personal data. We measure ad-campaign conversions via a Google Ads tag and an X pixel, and analyse product usage via Yandex Metrica, as described in section 2.

We share personal data only with the service providers needed to operate SignalGate. The current list is published at /legal/subprocessors. Each provider is bound by a contract with data-protection obligations at least as strong as this policy.

Three providers receive data through tags on the site itself: Google LLC (Google Ads conversion tag — ad-conversion measurement), Yandex (Yandex Metrica — product analytics and session replay, including Webvisor recordings of page interactions) and X (the X conversion tracking pixel — ad-conversion measurement; X Corp., or Twitter International Unlimited Company for the EU, UK and EFTA). Each processes that data under its own privacy policy. If you sign up after clicking one of our ads on X, our server also sends X that click identifier and a SHA-256 hash of your email address, so the sign-up is counted once even if the browser tag was blocked; our server sends X nothing for sign-ups that did not come from an X ad.

We may disclose data where required by law (court order, regulator request) or in connection with a corporate transaction such as a merger or acquisition. We will not sell personal data.

SignalGate is hosted in AWS Frankfurt (eu-central-1). Where subprocessors process data outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses and any required supplementary measures.

• Account data — kept while your account is active and for a reasonable period after deletion for legal and accounting purposes, then purged.
• Access logs — retained for a short rolling window for security purposes.
• Contact messages — kept until the inquiry is resolved and for a reasonable period afterwards.
• Newsletter list — retained until you unsubscribe.
• Playground — tutorial events are kept in your workspace like any other traffic until you ask us to delete them; we can delete them by the playground. name and a time range. Session records are kept for up to 90 days.

As a general guide: account and billing records are kept for up to 12 months after your account closes; access and event logs for up to 12 months; and contact messages for up to 24 months. We may keep limited records longer where the law requires it.

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, or to restrict or object to certain processing. To exercise any of these rights, email [email protected]. We will respond within the timeframe required by applicable law.

You may also lodge a complaint with your local data-protection authority. EU residents can find their authority at edpb.europa.eu.

We use TLS in transit, encryption at rest, hashed passwords, and least-privilege access controls. See our Security Overview for details. No system is perfectly secure; in the event of a personal-data breach we will notify affected users and relevant authorities without undue delay as required by law.

SignalGate is a B2B service not directed at children under 16 (or the lower age set by local law). We do not knowingly collect personal data from children. If you believe a child has submitted data, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the current edition. Material changes will be communicated to active customers by email before they take effect.

Privacy questions or rights requests: [email protected].

For written correspondence, email us first at the address above and we will provide a postal address on request.

If a local law requires SignalGate to designate an EU or UK representative, their details will be published here.