This policy explains what personal data Sigly ("we", "us") collects when you use Sigly, why we collect it, and what rights you have. We've tried to write it in plain language.

1. Data we collect

Account data

Your name, email address and a securely hashed password. If you subscribe to a paid plan, we also store your plan status and subscription identifiers from Stripe.

Signature content

Everything you enter into the signature builder — names, job titles, phone numbers, addresses, logos and image URLs, links, disclaimers — and the resulting signature HTML.

Directory data from connected services

If you connect Microsoft 365 or Google Workspace, we retrieve, for users in your organisation: display name, email address, job title, department, company name, phone numbers, and office location. This is read-only and used solely to personalise signatures.

The permissions requested are deliberately narrow:

• Microsoft 365: User.Read.All and Organization.Read.All — directory information only.
• Google Workspace: admin.directory.user.readonly (directory) and gmail.settings.basic (to set a signature).

None of these grant access to email content, attachments, calendars or files, and we do not request such access.

Team data you upload

If you use CSV import, we store the details you upload for each team member — typically name, email, job title, department, phone and address.

Technical data

Standard server and security logs: IP address, browser user agent, timestamps, pages requested, and records of failed login attempts. These are used to operate and secure the Service.

Payment data

Card payments are processed by Stripe. We never see or store your full card number. We retain only the transaction records and identifiers Stripe returns to us.

2. How we use data

• To provide the Service: create signatures, personalise them, and deploy them to your team.
• To manage accounts, authentication, plans and billing.
• To provide support when you contact us.
• To secure the Service — detecting abuse, brute-force attempts and fraud.
• To send essential service messages (verification, billing, security). We do not send marketing email without consent.

We do not sell personal data, and we do not use your signature content or directory data to train machine-learning models.

3. Where you are the controller and we are the processor

When you upload a team roster or connect your organisation's directory, the personal data of your staff is data you control. In that relationship you are the data controller and we act as a data processor, handling that data on your instructions to provide the Service.

This means you are responsible for having a lawful basis to provide us with your employees' details and for informing them as required. We process that data only to deliver the Service, retain it while your account is active, and delete it on request or when you disconnect or delete your account. If you require a Data Processing Agreement, contact us at [email protected].

3a. Signature open tracking

Paid accounts may switch on open tracking for a signature. When enabled, the signature includes a small invisible image; when a recipient's mail client loads that image, we record the time, the loading IP address, the country derived from it, the device/browser identification string, and which team member's signature the email carried (the sending mailbox, not the recipient's). This data is shown only to the account that owns the signature, is retained for 3 months, and is then deleted automatically. We do not read message content, subject lines or recipient addresses — only the fact that the image was loaded.

If you enable open tracking, you are the controller of that recipient data and are responsible for ensuring you may lawfully collect it in your jurisdiction, including any notice obligations to the people you email. Note that many mail providers (including Gmail and Apple Mail) load images through their own servers, in which case the IP address and country recorded reflect those providers rather than the recipient.

4. Legal bases (UK/EU GDPR)

• Contract: providing the Service you signed up for.
• Legitimate interests: securing the Service, preventing abuse, and improving reliability.
• Legal obligation: retaining financial records where required.
• Consent: where required, for example optional communications. You may withdraw consent at any time.

5. Service providers

We share data with a small number of providers who help us operate Sigly:

• Stripe — payment processing
• Microsoft — where you connect Microsoft 365 (directory data, Outlook add-in delivery)
• Google — where you connect Google Workspace (directory data, Gmail signature settings)
• Cloudflare — network security, DNS and content delivery
• hCaptcha — bot protection on sign-in and registration forms
• Our web hosting provider, which stores the application and its database

We may also disclose data if required by law, or to protect our rights, safety, or the integrity of the Service.

6. International transfers

Our providers may process data outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Retention

We keep account and signature data for as long as your account is active. Directory data is retained until you disconnect the integration, delete the team, or delete your account. Security and server logs are kept for a limited period for troubleshooting and abuse prevention. Financial records are kept as long as tax and accounting law requires. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where retention is legally required.

8. Security

Passwords are stored using industry-standard hashing — never in plain text. Traffic is encrypted in transit with HTTPS. Access to production systems is restricted, forms are protected against cross-site request forgery, and sign-in is rate-limited with lockout after repeated failures. Optional two-factor authentication is available on accounts. No system is perfectly secure, but we take these safeguards seriously and will notify you and any relevant regulator of a qualifying breach as the law requires.

9. Cookies

We use a session cookie to keep you signed in — it is strictly necessary for the Service to function. Cloudflare and hCaptcha may set their own cookies for security and bot detection. We do not use advertising cookies or third-party ad tracking.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive a portable copy, and to complain to a data protection authority. In Canada, PIPEDA gives you rights of access and correction; in the UK/EU, the GDPR rights above apply.

To exercise any of these, email [email protected]. We will respond within the time the applicable law requires. Much of this can also be done directly in your dashboard — you can edit your profile, delete individual signatures, disconnect integrations, and remove team members at any time.

If you are an employee whose details appear in a signature created by your employer, please contact your employer first — they control that data. We will assist them in responding to you.

11. Children

Sigly is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves. Material changes will be signalled by updating the date at the top and, where appropriate, notifying you directly.

13. Contact

Sigly
18 King Street East, #1400, Toronto, Ontario M5C 1C4, Canada
[email protected]