Privacy policy

This policy explains what personal data Sigpop handles, why, and what choices you have. Sigpop is operated by [Company name], [Company address], which is the data controller for the data described here unless stated otherwise.

The short version

• We collect what we need to run your account and render your signatures, and little else.
• This website sets no cookies and runs no advertising or third-party analytics trackers.
• Signature analytics are counts. We do not store the IP addresses of people who receive your emails, set cookies on them, or use tracking pixels.
• We do not sell personal data.
• You can delete your account and data yourself at any time.

Data we collect

Account data

Your name, your email address and a hashed password. We never store your password in readable form. If you subscribe, we also keep your plan, billing status and a customer reference from our payment processor.

Signature content

Everything you put into a signature: names, job titles, company, phone numbers, email addresses, websites, postal address, pronouns, taglines, links, disclaimers and design settings. For team accounts this includes the details of the colleagues you add or import.

Uploaded images

Photos, logos and banners you upload, and the animated versions we render from them. These are hosted on our servers so that they can load inside emails. Anyone who has the address of an image can load it, which is how email images work.

Signature analytics

For Pro signatures with analytics, we record aggregate counts of image loads (impressions) and link clicks, grouped by signature, link and department. An impression is the load of an image that is already part of the signature. We use no separate tracking pixel, set no cookies on recipients, and do not store their IP addresses. We do not know who opened an email, so we cannot tell you either.

Directory connections

If you connect Microsoft Entra ID, Active Directory or Google Workspace, we store the credentials or tokens needed for that connection, encrypted at rest. We read the user details needed to build signatures (such as name, title, department, email and phone) and, where you ask us to, write signatures to Gmail mailboxes in your Google Workspace.

Verified sender

If you use the verified sender badge, we record that the email address was confirmed and when. The badge links to a public page that shows the verified address and the name on the signature.

“Describe it” generator

The sentence you type into the generator is sent to Google Gemini to produce a starting design. Only that text is sent. Your account details, signatures and images are not.

Messages you send us

If you email us or use the contact form, we keep your name, email address and message so that we can answer.

Affiliate data

If you join the affiliate programme, we keep your referral code, counts of clicks and sign-ups from your link, commission earned and the PayPal address you give us for payouts.

Data stored in your browser

We do not set cookies. We use your browser's local storage for two things: a login token that keeps you signed in, and a referral code if you arrived through an affiliate link. Details are in the cookie policy.

Why we use your data

• To provide the service (performance of our contract with you): accounts, signatures, image hosting, team rollout, directory sync, analytics and billing.
• To send service emails (contract): sign-in and password emails, address verification, install links you ask us to send to team members, and billing notices.
• To keep the service secure and working (legitimate interest): preventing abuse, fixing faults and answering support requests.
• To meet legal duties (legal obligation): for example, keeping billing records for tax purposes.

We do not use your content for advertising, and we do not sell or rent personal data to anyone.

Team members and recipients

When an organisation uses Sigpop for its staff, the organisation decides what details go into those signatures. In that case the organisation is the controller of its team members' data and we process it on the organisation's behalf. If you are a team member with a question about your details, ask your organisation first. We will help them respond.

People who receive emails containing a Sigpop signature load images from our servers and may click links that pass through them. We count these events and store nothing that identifies the recipient.

Who processes data for us

We use a small number of service providers. Each receives only what it needs.

• Oracle Cloud: hosting of the application, database and images, in the Frankfurt (Germany) region.
• Cloudflare: delivery of this website.
• Stripe: payments and subscriptions. Stripe collects your card details directly; we never see the full card number.
• Resend: sending transactional email, such as verification messages and install links.
• Google Gemini: generating a design from the text you type into the “describe it” generator. Only that text is sent.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is covered by safeguards such as the European Commission's standard contractual clauses.

How long we keep data

• Account data, signatures, images and analytics: for as long as your account exists.
• After you delete your account: removed from our live systems immediately. Backups roll off within 30 days.
• Billing records: kept for as long as tax and accounting law requires.
• Support messages: kept for as long as needed to deal with your request and any follow-up.

Security

Passwords are stored as hashes. Directory credentials are encrypted at rest. Connections to the site and the app use HTTPS. No system is perfectly secure, so if we learn of a breach affecting your data we will tell you and the relevant authority as the law requires.

Your rights

Depending on where you live, you have the right to:

• see the personal data we hold about you and receive a copy;
• correct data that is wrong, which you can mostly do yourself in the app;
• delete your data (see Delete my data);
• object to or restrict certain processing;
• complain to your local data protection authority.

To use any of these rights, write to support@sigpop.app from the email address on your account.

Children

Sigpop is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. For significant changes we will also email account holders.

Contact

[Company name], [Company address]. Email: support@sigpop.app.