Privacy Policy

This Privacy Policy explains how the operator of Signalify processes personal data when you visit signalify.io, create or use a Signalify account, start a trial, purchase a subscription, submit a review, interact with a public review page or widget, or contact us.

For account, billing, security, product-usage, and website data, Signalify generally acts as the data controller. For review and testimonial content processed on behalf of a Signalify customer, the customer generally acts as the controller and Signalify acts as its processor. More detail is available in our Data Processing Agreement.

The legal identity and contact details of the operator are available in Signalify’s Legal Notice. Privacy questions may be sent to hello@signalify.io.

Where the GDPR applies, we rely on one or more lawful bases depending on the activity.

Signalify customers decide which reviews and testimonials they collect, import, approve, publish, tag, or display. For this content, the customer is generally responsible for providing privacy notices, establishing a lawful basis, obtaining any required permissions, and responding to reviewer requests.

If your personal data appears in a widget or public review page operated by a Signalify customer, contact that customer first. Signalify will reasonably assist the customer with valid data-subject requests where technically possible.

Reviews marked visible may be publicly accessible through widgets, public pages, or customer websites. Public content may be copied, indexed, or cached by third parties outside Signalify’s control.

Customers may import reviews from ecommerce tools, testimonial platforms, Google, social platforms, CSV files, or other sources. The customer is responsible for having the right to export, import, store, and republish that content.

Imported image URLs may remain hosted by the original provider. When a visitor loads a widget containing such an image, the third-party host may receive ordinary request information under its own privacy practices.

Source names and icons identify the source selected or supplied during import. They do not mean Signalify independently verified the review, reviewer, or original platform record.

We do not sell personal data. We share information only where reasonably necessary to provide, secure, support, and administer Signalify, or where required by law.

Signalify uses essential cookies or similar storage where needed for authentication, security, account sessions, preferences, and core functionality.

We use Vercel Web Analytics and may use Vercel Speed Insights to understand website traffic and performance. Vercel describes Web Analytics as cookieless and based on anonymised data. Signalify also records limited first-party widget events such as views, form opens, and submissions.

We do not use advertising cookies or behavioural advertising tools unless this Policy and any required consent interface are updated first.

Account and customer content is generally retained while the account or relevant project remains active and until it is deleted by the customer or through an account-deletion request.

Subscription, invoice, transaction, and tax records may be retained for the periods required by law. Minimal trial-usage records may be retained as reasonably necessary to enforce the one-trial-per-user rule and prevent abuse.

Security logs, analytics, support records, backups, and deleted-content remnants may be retained for limited periods based on operational, security, fraud-prevention, and legal needs.

When retention is no longer required, information is deleted, anonymised, or securely isolated from ordinary use. External images and content hosted by third parties must be removed from the original source separately.

Signalify and its providers may process data in countries outside your own, including outside the European Economic Area. Where required, we rely on an adequacy decision, approved Standard Contractual Clauses, the EU–US Data Privacy Framework where applicable, or another recognised transfer safeguard.

Information about transfer mechanisms used by our providers is available in their legal and privacy documentation.

We use reasonable technical and organisational measures designed to protect personal data, including managed infrastructure, transport encryption, authentication, access controls, project-level permissions, restricted administrative access, database security policies, and monitoring.

No system can guarantee absolute security. You are responsible for securing your credentials, limiting account access, and configuring public visibility appropriately.

Depending on applicable law, you may have rights to access, correct, erase, restrict, or receive a copy of your personal data; object to certain processing; and withdraw consent. You may also have the right to complain to a supervisory authority.

Send requests concerning Signalify-controlled account or operational data to hello@signalify.io. We may need to verify your identity. For review content controlled by a Signalify customer, we may direct the request to that customer.

In Slovenia, complaints may be submitted to the Information Commissioner of the Republic of Slovenia. You may also contact the supervisory authority in the country where you live or work.

Signalify is a business service and is not directed to children. Do not use the Service to knowingly collect children’s personal data unless you have a valid legal basis and all protections required by applicable law.

We may update this Policy to reflect product, legal, security, or operational changes. We will revise the “Last updated” date and provide additional notice where a change is material and applicable law requires it.

For privacy, deletion, or data-protection questions, contact hello@signalify.io. The operator’s legal identity and business contact details are available in Signalify’s Legal Notice.