Privacy Policy

1. Who we are and what this notice covers

1.1 Signet Technologies Limited, a company registered in England and Wales under company number 17452808, with its registered office at Linley House, Dickinson Street, Manchester, M1 4LF, United Kingdom (Signet, we, us), provides the Signet business software platform and signetapp.ai. This notice also applies to official Signet application domains and subdomains where it is displayed or linked. Our privacy contact is tom@signetapp.ai. It does not describe a separate company’s services merely because those services use a related domain.

1.2 This notice explains how we handle personal data about website visitors, prospective customers, customer representatives and authorised users. It also explains how we handle information that business customers connect to Signet, including information about their prospects, customers, workers and call participants. Personal data includes information that identifies someone directly or indirectly, and the equivalent personal information under applicable US privacy laws.

1.3 We are a controller for our own account administration, billing, business communications, security and legal-compliance activities. Where we process a customer's connected data to provide its requested services, that customer normally determines the purposes and we act as its processor or, under relevant US laws, its service provider or contractor. Where a customer is itself a processor, we act as its subprocessor. Actual activities determine these roles; labels do not override the law.

1.4 Customer-directed processing is governed by our Terms of Service — Business Services Agreement and its Data Processing Schedule. A customer's own privacy notice explains its collection and use of its customers' and workers' information. This notice does not give a customer authority to record calls, track people or share data without a lawful basis, required notice or consent.

1.5 Your choices and other notices. This notice is information about our practices; reading it or accepting commercial terms is not, by itself, consent to optional tracking, marketing or a new use of personal data. Sections 12 and 13 explain individual rights, including applicable US-state rights. Recruitment and employment processing require a relevant notice when those activities occur; this service notice is not a claim that Signet operates a careers portal or uses the recruitment practices of another company.

2. Information we receive

The categories depend on your relationship with us and the integrations and features enabled for the workspace. We do not collect every category from every person.

We receive information directly, from customer-authorised integrations, from a customer’s permitted tracking installation, from technical operation of the service and from business contacts. We may link related records within the authorised workspace to provide attribution, reporting and other contracted functions. Derived scores, classifications and inferences can themselves be personal data; they are not exempt merely because Signet generated them. Workspace administrators can ordinarily see information and activity within their permitted scope.

Information about other people. When a customer or user supplies an invitation, referral, contact record or access instruction about someone else, we process the necessary identity, contact and role details for that stated purpose. The sender must have authority and provide required information to the individual; an invitation is not consent to unrelated marketing. Recipients can contact tom@signetapp.ai about an unwanted invitation or their information.

Free-form content and necessary details. Prompts, uploaded files, briefs, feedback and support correspondence may contain personal or confidential information. Do not include more than is needed, passwords, access tokens or inappropriate sensitive content. Customer workspace submissions are not made public or non-confidential merely because they are AI inputs. Where information is required to create an account, perform an Order or satisfy law, we identify that need; without it, the requested service may not be possible. Optional marketing information is not required simply to buy the service.

3. Our own purposes and legal bases

Where UK or EU data protection law requires a lawful basis and we act as controller, we use the bases below. Contract applies only when the individual is personally a party to the relevant contract; handling an employee's details for a corporate customer will ordinarily rely on legitimate interests instead.

We balance legitimate interests against individuals' rights and reasonable expectations. You can object as explained in section 12. We do not treat acceptance of a business contract as blanket consent from every individual whose information it contains. Where we rely on consent, withdrawal does not affect processing already lawfully carried out.

4. Processing on customers' instructions

We process connected data to deliver the features the customer has selected: importing and reconciling sources; maintaining customer and transaction history; linking advertising, bookings, calls and revenue; analysing calls against configured criteria; calculating metrics; displaying evidence and results; providing support; and executing enabled, authorised actions. These activities may include profiling or automated classification.

The customer determines the lawful basis for its processing, supplies appropriate notices and obtains required permissions. We assist with rights requests and compliance as set out in the Data Processing Schedule. We do not make a customer's data available to another customer merely because both use Signet. Cross-customer use is limited to the eligible anonymous information described in section 7 or a separately lawful and expressly agreed arrangement.

5. Meta and other connected services

5.1 Meta access. Connecting Meta uses Meta's authorisation process. The permissions granted may include ads_read, ads_management and business_management, and selected assets may include ad accounts and pixels or datasets. An administrator chooses which permitted assets Signet uses. A permission grant does not mean every optional feature is enabled.

5.2 Meta information. For authorised assets, Signet may receive account and business identifiers, names, currency and time zone; campaign, ad-set and ad structure, settings and status; creative content, including retained media copies or thumbnails; reporting figures such as spend, impressions, clicks and actions; and selected pixel or dataset identifiers and diagnostics. We store the access credential securely and use it for authorised integration functions. We do not request friends lists or personal social-media posts for this reporting service.

5.3 Management and conversion actions. Where available and enabled, an authorised workspace member may instruct Signet to manage supported ad settings, such as pausing or activating ads. Where a conversion destination is supported, enabled and lawfully configured, Signet may send event details and permitted matching identifiers to the selected Meta pixel or dataset through the Conversions API. Hashing an identifier does not necessarily make it anonymous. The customer must have the required authority, notices, consents and opt-out handling for these instructions. Connecting Meta alone does not initiate every management action or enable conversion sending.

5.4 Disconnect and revoke. You may disconnect an integration through Signet's integration settings or ask us for assistance. This stops the relevant ongoing access or synchronisation; it is not a request to delete data already imported. The scope of a disconnection matters: disconnecting one ad account need not revoke a shared authorisation still used by another authorised asset. To revoke the underlying Meta authorisation, remove Signet through Meta's connected-app or business-integration settings. Revocation does not itself delete independently held records in every connected service.

5.5 Source-specific restrictions. We use Meta Platform Data only for permitted customer-directed functions and subject to Meta's applicable terms. Meta-sourced information is not authorised for our cross-customer network models merely by removing identifiers. Data from any provider remains subject to its applicable restrictions, including restrictions that extend to anonymous, aggregated or derived information. We exclude restricted data from cross-customer learning unless the specific proposed use has been verified as permitted and all other legal conditions are met.

5.6 Other integrations. The enabled integration determines what information is accessed. Connected scheduling, CRM, payment, meeting and other providers also process information under their own terms and may act independently. Where Google API Services are used, our use and transfer of information received from those APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements. Google Workspace API data is not used to develop, improve or train non-personalised AI or machine-learning models. Applicable restrictions on advertising use, human access and anonymous or derived data continue to apply; section 7 does not override them. We do not treat an integration provider as our subprocessor merely because you connect your own account to Signet.

6. AI and automated analysis

Signet may send the information needed for an enabled feature, including transcripts, relevant business records, prompts or creative briefs, to contracted AI or transcription providers. These providers process it to supply the relevant feature. The providers, applicable data types and processing locations must be identified in the relevant supplier information before use.

We do not use identifiable customer content to train Signet's own general-purpose AI models under the standard service. We do not authorise an AI supplier to use customer content for its own independent general-purpose model training under our standard processing instructions. Provider-specific contractual terms and configurations must support the processing in use; this is not a claim that every provider has identical retention or no-training settings. Any materially different training use requires a separate lawful arrangement and appropriate disclosure before it begins. Permitted anonymous network-model development is addressed in section 7.

AI results may be incomplete or incorrect. Signet's outputs are not, by themselves, instructions to make employment, lending, insurance, healthcare or other significant decisions about an individual. Customers must apply the safeguards required for their use, including meaningful review and challenge where applicable. We do not use the standard service to make solely automated decisions with legal or similarly significant effects about individuals on our own behalf. Where a customer uses automated evaluation, the customer must identify the applicable legal requirements and provide an appropriate route to review or contest a result.

Authorised review of content. Our personnel and contracted providers may access the content reasonably needed for the requested feature, support, security, legal compliance or permitted quality control, under access restrictions and confidentiality duties. This is not a public-content licence or permission for routine unrelated review of communications. Source-provider restrictions on human access apply in addition to these limits. A separate publication or testimonial instruction must identify what may be made public and who may use it.

7. Anonymous insights, benchmarking and future network models

7.1 What we mean. Anonymous Service Intelligence means statistical information, patterns, evaluation results, benchmarks and model improvements from which no person can reasonably be identified, singled out or linked back, whether alone or with other information reasonably likely to be used. It must also meet any applicable US deidentification standard. We additionally protect customers' confidential commercial information: it must not disclose a customer's identity, identifiable customer-level performance, proprietary content or trade secrets.

7.2 Permitted development. Subject to applicable law, customer instructions and source-provider restrictions, we may create and use Anonymous Service Intelligence to evaluate and improve Signet, develop statistical or predictive models, measure reliability, and provide aggregated comparisons and recommendations. We may combine eligible anonymous information across workspaces and retain it without a fixed end date while it remains genuinely anonymous and permitted for these uses. This describes the permitted approach to development, including future network models; it does not promise that a particular network-model feature is currently available.

7.3 Personal data is not automatically anonymous. Removing names, hashing emails, substituting customer IDs, redacting obvious identifiers or calling a dataset “aggregated” is not sufficient by itself. Recordings, transcripts, embeddings, transaction histories and model parameters can still contain or reveal personal data. We assess reidentification, linkage and extraction risks before treating a dataset or model as anonymous, and reassess material changes. Information that fails that assessment remains subject to the personal-data rules, retention limits and rights in this notice.

7.4 Creation must itself be lawful. Anonymising personal data is still processing personal data. We require a lawful basis and, when acting as processor, the customer's lawful documented instructions. We do not retain personal data indefinitely merely because it may be useful to future models. The standard agreement does not permit cross-customer identifiable prospect or employee profiles, the sale of customer lead lists, or unauthorised combination of individuals' data across businesses.

7.5 Limits survive anonymisation. We do not reidentify anonymous information or permit recipients to do so. We impose appropriate restrictions on any recipient of eligible anonymous datasets. Contractual confidentiality, intellectual-property rights and provider conditions can restrict use even where data protection law no longer applies. Data that is restricted, insufficiently anonymised or not validly authorised is excluded. A customer can ask us about its processing instructions and available contribution controls at tom@signetapp.ai; statutory rights are unaffected. Information already irreversibly anonymised may no longer be attributable to a person or customer for individual removal.

7.6 Any different programme. A proposal to use identifiable or pseudonymous customer data for Signet's own cross-customer model training requires a separate documented legal and product assessment, a defined purpose and retention period, the correct controller or processor arrangements, and any additional notices and consents required. It is not activated or authorised simply by this notice.

7.7 Commercial use of eligible intelligence. Within the safeguards above, we may publish aggregated benchmarks or license qualifying anonymous statistical products and non-identifying models to customers and commercial partners, including for a fee. This does not authorise disclosure of identifiable records, customer-attributable results, raw content or restricted-provider derivatives. Recipients must be bound not to reidentify people or customers or use the information inconsistently with its permitted purpose. No rights are obtained over a customer’s underlying creative assets merely by producing a statistical derivative.

8. Recipients and suppliers

We disclose information only as needed for the stated purposes and subject to appropriate safeguards. Recipients may include authorised workspace users; contracted hosting, storage, AI, transcription, monitoring and communications providers; payment providers for our own billing; professional advisers; public authorities where legally required; and a potential or actual successor in a properly controlled corporate transaction.

The technical supplier inventory includes Vercel for application hosting and private storage, Neon for database hosting, Anthropic and OpenAI for relevant AI functions, including analysis of calls and meetings, AssemblyAI for transcription, Sentry for monitoring, and Resend for enabled transactional email. OpenAI may also support specifically enabled image-generation functions. For enabled call and meeting analysis, OpenAI may include API inputs and outputs, including submitted transcript content, in abuse-monitoring logs. These logs are retained for up to 30 days by default, unless longer retention is required by law or reasonably necessary to protect services or third parties from harm. OpenAI does not use API data to train models by default unless the customer opts in; Signet does not authorise training on this workload. OpenAI processing may occur outside the UK and EEA, principally in the United States, under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as provided in OpenAI's data processing addendum. A listing does not mean every supplier receives every workspace's data. Any additional supplier or materially different processing must follow the applicable notification and authorisation process. The Data Processing Schedule contains the initial supplier categories; the current supplier details, locations and safeguards are available from tom@signetapp.ai.

Services that customers independently connect, such as Meta, Google, Microsoft, Zoom, Calendly, Typeform, HubSpot or Stripe, are not automatically our subprocessors. Their role depends on the actual arrangement. Where a customer instructs a disclosure to an advertising or other destination, that recipient's subsequent processing is also governed by its own applicable terms and privacy information.

Corporate and legal disclosures. A proposed financing, reorganisation or business transfer may require limited due-diligence disclosure to advisers or counterparties subject to appropriate confidentiality, minimisation and transfer safeguards; any successor must be bound by applicable protections. For legal demands, security investigations or protection of rights, we limit disclosure to a lawful and proportionate purpose and notify affected parties where required and permitted. Neither a corporate transaction nor a generic “business purpose” expands the permitted uses of Customer Personal Data.

External sites and payment providers. A link to another site is not an endorsement, and the other provider’s privacy notice governs its independent activity. Where payment details are supplied through a payment provider, that provider handles them under its own applicable terms. Connecting a payment-data source for revenue measurement does not grant Signet a general right to access bank accounts or move money. The same provider can have different legal roles for different services.

9. Cookies, tracking and marketing choices

Our website and application may use essential storage or similar technologies for authentication, security, configuration and reliable operation. Optional analytics or advertising technologies must not be used without consent where consent is required, unless a specific lawful exemption applies and its conditions are met. Advertising tracking is not treated as essential merely because it benefits the business.

Customers deploying Signet's tracking on their websites must provide clear notices and implement applicable consent and opt-out requirements. A first-party domain, server-side event, or hashed identifier does not remove those obligations. We process the resulting customer events under lawful instructions and the relevant technical settings. A customer must not instruct Signet to ignore a valid privacy choice.

You can unsubscribe from our marketing messages using the link provided or contact tom@signetapp.ai. Necessary service, billing and security communications are separate from marketing. Where applicable, we recognise legally required browser or device opt-out signals, including Global Privacy Control, for processing within our control; customers remain responsible for implementing signals on their own sites and instructions. Further technology-specific information must be provided when optional technologies are deployed.

Technologies and controls. Cookies, local storage, pixels, scripts and similar tools can support different functions and are governed by their purpose, not their name. Browser settings can remove or block storage, which may impair login or remembered preferences; they are not a substitute for a consent or opt-out mechanism the law requires us or the customer to provide. Optional email-open or click measurement, if used, is subject to applicable notice and choice requirements. This notice does not assert that a particular cookie-settings screen or advertising technology is already deployed.

Marketing suppression. We action valid direct-marketing objections and withdrawal requests promptly within the applicable legal deadlines, and retain only the limited suppression details reasonably needed to avoid contacting the person again. A privacy request is not used as an opportunity for new marketing. Necessary security, billing and service communications can continue where lawful. An automated promotional SMS programme is not authorised by accepting this notice; any future programme requires its own applicable notices, lawful permission and opt-out arrangements.

10. International processing

Signet is established in the United Kingdom, but many customers and data subjects are in the United States. Data may be processed in the UK, the US, the European Economic Area and other disclosed supplier locations. Our documented infrastructure includes a database in the United States; using Signet does not imply UK-only storage.

Where a transfer is restricted by applicable data protection law, we use a valid applicable mechanism before transferring. Depending on the parties and destination, this may be an adequacy regulation or decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with required assessments and supplementary measures. A data-privacy-framework mechanism is used only if the particular recipient and data are covered by a valid applicable certification. We do not assume that all US recipients qualify.

You may contact us for information about relevant safeguards or an appropriately redacted copy. Any valid restriction on disclosure will be explained. Where EU law applies in addition to UK law, its transfer requirements are assessed separately. The Data Processing Schedule governs customer-data transfers; this notice is not itself a transfer agreement.

11. Retention, disconnection and deletion

11.1 Purpose-based retention. We keep personal data only for as long as reasonably necessary for its lawful purposes. We consider the customer's instructions, the need for historical attribution and auditability, the sensitivity and volume of the data, dispute and legal requirements, available deletion or anonymisation methods and provider conditions. We review retention rather than keeping all identifiable data indefinitely by default.

11.2 Active workspace history. While providing the service, customer records may be retained across reporting periods where needed for the customer's historical analysis, reconciliation, evidence and continuing instructions. Recordings, transcripts, raw model responses and derived records need not share the same retention period. A source-specific shorter limit, a valid deletion instruction or applicable law takes precedence. Deletion of evidence may limit later reconstruction of a metric or explanation, which we will explain where relevant.

11.3 Disconnect is not deletion. Disconnecting an integration does not cancel the Signet subscription or delete previously synchronised history. That history remains subject to the service's lawful purposes and retention rules. We may nevertheless need to remove particular provider data following a valid deletion request, provider requirement or legal obligation. We do not interpret an accidental disconnect as an instruction to destroy a workspace.

11.4 Ending the subscription. The agreement provides a limited 180-day offboarding and recovery period after the paid service ends, under the customer's documented instruction, unless the customer requests earlier lawful return or deletion or a shorter legal or provider limit applies. During this period we restrict processing to storage, security, export assistance, recovery and completion of lawful instructions; we do not continue ordinary collection from disconnected sources or use the archive as an identifiable training pool.

11.5 Beyond 180 days. A separate archive or recovery service may be agreed in writing before the period ends, with a genuine specified purpose, documented duration and periodic review. It is not automatic. At the end of the processing service, including any agreed offboarding or archive service, we delete or return Customer Personal Data at the customer's choice and delete remaining copies, unless applicable law requires storage. Properly authorised Anonymous Service Intelligence already lawfully created may be retained under section 7, but anonymisation is not a device to defeat a deletion request or provider restriction.

11.6 Separate records. We retain our own invoices and necessary tax and accounting records for the applicable statutory period, generally six years after the end of the relevant company financial year, and longer where law requires. Necessary contract, rights-request, security and dispute records have separate, proportionate schedules. A legal hold is limited to relevant records, reviewed and lifted when no longer justified. This is not permission to retain a customer's entire operational database for our own use.

11.7 Backups. Where immediate selective deletion from a backup is not practicable, affected information is put beyond ordinary use, protected against restoration into active use without reapplying deletion, and removed through the documented backup-expiry cycle. The actual applicable cycle is explained on request. Backups are not used for analytics or model training after an effective deletion instruction.

11.8 How to request deletion, including Meta data. Email tom@signetapp.ai, preferably with the subject “Signet data deletion request”, identifying the workspace, connected provider or account, and data concerned. Do not send passwords, tokens or unnecessary identity documents. We verify identity and authority proportionately. Administrators can request deletion of an integration's imported data without canceling the whole subscription. Individuals can request deletion of their own information. Where we act for a customer, we promptly route the request to the appropriate controller and assist; we do not reject a valid request simply because the person has no Signet account. We act within applicable legal timescales, explain lawful retention exceptions and the expected backup treatment, and confirm the outcome. Requests are not dependent on cancelling a subscription or paying an exit fee.

12. Individual rights and requests

12.1 Depending on the applicable law and our role, you may have rights to obtain information and access a copy of your personal data; correct inaccuracies; request deletion; restrict processing; obtain portable data; object to legitimate-interest processing or direct marketing; withdraw consent; and request safeguards, review or challenge in relation to qualifying automated decisions. You do not need to hold a paid Signet account to exercise a legal right.

12.2 Contact tom@signetapp.ai or write to our registered office. Explain what you need; legal terminology is unnecessary. We may ask for information reasonably needed to verify identity, locate the records or confirm an agent’s authority, and use it only for handling the request, security and required records. We do not require excessive identification. Requests are normally free, subject only to legally permitted exceptions. We respond within the applicable deadline: generally one month under UK/EU law, with an explanation of any lawful extension. US deadlines and appeal rights are addressed in section 13.

12.3 Where a request concerns processing for a customer, that customer normally decides the response and we assist. We remain responsible for requests about processing for which we are controller. A commercial export facility and a legal right of access or portability are not the same thing; the absence of a self-service export button does not remove a legal right. If we cannot grant a request in full, we explain the lawful reason, any information retained and the available complaint or appeal route, unless disclosure itself is prohibited.

12.4 Authorised agents. We accept an appropriately authorised representative where the law permits. We may request proportionate proof of authority and, when permitted, verification directly from the individual; a valid power of attorney is handled as the relevant law requires. A sale/sharing or targeted-advertising opt-out is not subjected to the identity-verification requirements used for access or deletion where the law prohibits that. We do not require an individual to create an account to make a request.

13. US-state privacy notice and notice at collection

13.1 Scope and roles. This section supplements the notice where an applicable US-state law, including the California Consumer Privacy Act as amended (CCPA), applies to our activity. Thresholds, exemptions and effective dates differ. B2B sales do not, by themselves, remove the privacy rights of customers’ personnel or end users. Our role for customer-controlled records is described in sections 1 and 4; their controller’s notice explains that customer’s activities.

13.2 Categories and disclosure. The table below describes the categories used in the service described in this notice and the recipient classes for business purposes; a category is processed only where it is actually supplied or generated by an enabled function. Section 2 explains sources, sections 3–8 explain purposes, and section 11 explains retention. Where California requires disclosure about the preceding 12 months, or our shorter operating period, the published notice must reflect actual activity for that period rather than hypothetical future features. A collection interface must provide this notice or an appropriate linked, contextual notice before collection; an undisclosed new purpose requires the applicable further notice and choices.

13.3 Processor restrictions. When acting as service provider, contractor or processor, we process Customer Personal Data only for the specific contractual purposes and lawful instructions. We do not sell or share it under a service-provider label, perform cross-context behavioural advertising under that label, or build identifiable consumer or household profiles for another customer’s benefit. Instructed conversion delivery to an advertising destination may have separate legal implications for the customer and recipient; necessary notices, permissions and opt-outs must be honoured. Source and recipient restrictions continue to apply.

13.4 Sale, sharing, advertising and sensitive information. A regulated “sale” can include an exchange for valuable consideration, not only money; “sharing” in California includes certain cross-context behavioural advertising. For our own controller activities described here, we do not sell personal information for money or use business-contact information for cross-context behavioural advertising. We do not authorise sale of customer lead lists or disclose personal information for unrelated third-party direct marketing under this notice. Before a materially different practice begins, we must assess whether it is a regulated sale, sharing or targeted advertising and implement the required notice, opt-out link and signals. We do not use sensitive information to infer sensitive characteristics for an independent purpose; where a statutory limitation right applies, individuals may exercise it through the same contact channel. Nothing in section 7 changes these restrictions for information that is still personal.

13.5 Rights. Subject to the applicable law, you may ask whether we process your information; obtain access to specific information and required categories of information, sources, purposes and recipients, including specific third parties where the law requires; correct inaccuracies; request deletion; receive a portable copy; and opt out of regulated sale, sharing, targeted advertising or qualifying profiling/automated decisions. California rights may include knowing the categories disclosed for business purposes or sold/shared and limiting certain sensitive-information uses. Rights are not arbitrarily confined to a 12-month access period where a longer period is legally required. We do not unlawfully discriminate or retaliate for exercising a right.

13.6 Requests and timescales. Email tom@signetapp.ai, with “US privacy request” in the subject if convenient, or use any additional statutory channel we identify at collection. We handle verification and agents under section 12. For California requests to know, correct or delete, we acknowledge receipt within 10 business days and normally respond within 45 calendar days of receipt; a further permitted 45 days requires timely notice and an explanation. Verification does not silently restart that clock. Other rights, including opt-outs, and other states can require different or shorter periods. We explain any lawful refusal or extension and the applicable escalation route.

13.7 Opt-out signals and appeals. Where legally required for our processing, we honour a valid Global Privacy Control or other recognised universal opt-out signal for the browser/device and, where the law requires and we can link it, the relevant account. Such a signal does not automatically erase stored information or change essential service functions. We will provide required visible opt-out controls before undertaking a regulated activity; the absence of such an activity is not a reason to misstate our practices. To appeal a refusal where appeal rights apply, reply to the decision or email tom@signetapp.ai with “Privacy appeal”. We explain the outcome within the applicable statutory period and provide the available regulator complaint route. No Signet account or payment is required to submit the appeal.

13.8 Minors, deidentification and incentives. The standard service is for adult business users. We do not knowingly sell or share personal information of people under 16. Information about a minor supplied incidentally requires prompt assessment and appropriate restriction, deletion or other lawful handling. We publicly commit to maintaining qualifying deidentified information in deidentified form and not reidentifying it, with appropriate contractual restrictions on recipients; section 7 sets the stricter service standard. This notice does not establish a financial-incentive programme in exchange for personal information. Any such programme would need a separate lawful notice and election before it begins.

14. Security and restricted data

We apply technical and organisational safeguards appropriate to the information and risk, including access controls, tenant separation, encrypted connections and protection of integration credentials. No system is absolutely secure. We investigate incidents and notify affected customers or individuals and authorities where required by law and contract. We do not claim a certification or independent assurance that we have not obtained.

The standard service is for authorised business users aged 18 or over and is not directed to children. It is not designed for children’s services, protected health information requiring a HIPAA business associate agreement, biometric identification, or systematic processing of highly sensitive or specially regulated data unless Signet separately agrees and suitable legal conditions and controls are in place. Ordinary recordings can contain incidental sensitive material; customers should minimise it and notify us promptly. If we learn of an inappropriate collection, including a child’s information, we restrict the affected processing and arrange appropriate deletion or other lawful handling with the relevant controller. A ban in terms is not a claim that incidental sensitive content can never reach the system.

15. Changes and complaints

We may update this notice to reflect actual practices and legal requirements. The published version will show its revision date. Where a change materially affects the use of personal data, we provide appropriate notice and obtain any required fresh permission before the new processing. A policy update does not retrospectively authorise unrelated use of existing customer data. We review this notice at least annually where the law requires and update it when actual practices change. Additional just-in-time notices are provided where a single general policy would not adequately explain a particular collection or use.

You may complain to tom@signetapp.ai or our registered address. For complaints about processing for which we are controller, we provide a clear route to complain, acknowledge receipt within 30 days, investigate appropriately, keep you informed where necessary and communicate the outcome without undue delay. This complaints timetable does not replace a shorter deadline for a particular rights request. You may also raise a concern with the UK Information Commissioner's Office at ico.org.uk, or the relevant supervisory authority, state attorney general or privacy regulator. Contacting us does not remove applicable regulatory or court remedies.

16. Contact details

Signet Technologies Limited (company 17452808), Linley House, Dickinson Street, Manchester, M1 4LF, United Kingdom. Privacy, deletion and legal contact: tom@signetapp.ai. Website: signetapp.ai.