SignatureHQ← Back to sign in

Privacy Policy

Last updated: March 2026

1. Introduction

SignatureHQ ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose information when you use our Service. By using SignatureHQ, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you sign in with Google, we receive your name, email address, and profile picture from your Google account. We store this to identify you within the Service.

2.2 Google Workspace Directory Data

With your authorisation, we access your organisation's Google Workspace directory to retrieve user profile information including names, job titles, departments, phone numbers, office locations, and profile photos. This data is used solely to personalise email signatures and is cached temporarily in our database for performance.

2.3 Usage Data

We collect information about how you use the Service, including pages visited, features used, and actions taken. This helps us improve the Service and troubleshoot issues.

2.4 Campaign Analytics

If you use the campaign banner feature, we track click and impression events. IP addresses used for analytics are cryptographically hashed (SHA-256) before storage and cannot be reversed to identify individuals. User agent strings are similarly hashed.

3. How We Use Your Information

  • To provide and operate the Service
  • To personalise email signature templates with employee data from your Google Directory
  • To deploy email signatures to Gmail accounts on behalf of your organisation
  • To send transactional emails (billing receipts, deployment notifications, team invitations)
  • To detect, investigate, and prevent fraudulent or unauthorised activity
  • To comply with legal obligations
  • To improve and develop the Service

We do not sell your personal information or your users' data to third parties. We do not use your data for advertising purposes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area, we process your data under the following legal bases:

  • Contract: Processing necessary to provide the Service you have subscribed to
  • Legitimate Interests: Security monitoring, fraud prevention, and service improvement
  • Legal Obligation: Compliance with applicable laws and regulations
  • Consent: Where you have given explicit consent for specific processing activities

5. Data Sharing and Disclosure

We may share your information with:

  • Google: We use Google APIs to access directory data and set Gmail signatures, in accordance with Google's API policies
  • Stripe: Our payment processor handles billing information. We do not store card details on our servers
  • Railway: Our hosting provider where the application and database run
  • Resend: Our transactional email provider
  • Law enforcement: When required by law or to protect the rights and safety of our users

All third-party service providers are required to handle your data in accordance with applicable privacy laws.

6. Data Retention

We retain your account data for as long as your account is active. Directory user data (synced from Google) is refreshed regularly and deleted when you disconnect your Google Workspace or close your account. Audit logs are retained for 12 months. Campaign analytics data is retained for 24 months. You may request deletion of your data at any time by contacting us.

7. Data Security

We implement appropriate technical and organisational security measures to protect your data. Service account credentials are encrypted with AES-256 before storage. All data is transmitted over HTTPS. Access to production systems is restricted to authorised personnel only. Despite these measures, no system is completely secure, and we cannot guarantee absolute security.

8. Google API Disclosure

SignatureHQ's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only request the minimum scopes necessary to provide the Service
  • Google Workspace user data is used exclusively to personalise and deploy email signatures
  • We do not share Google Workspace user data with third parties except as necessary to provide the Service
  • We do not use Google Workspace data to serve advertisements
  • We do not allow humans to read your Google data unless you have given explicit permission or it is necessary for security or legal purposes

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data
  • Portability: Request your data in a machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Restriction: Request restriction of processing in certain circumstances

To exercise these rights, please contact us via our support page.

10. Cookies

We use essential cookies to maintain your login session. We do not use tracking cookies or third-party advertising cookies. Session cookies are deleted when you close your browser. Authentication cookies expire after 30 days of inactivity.

11. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice in the Service. Your continued use of the Service after the effective date of changes constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us via our support page.