Privacy Policy

Signal Send is operated as a software service for preparing audience segments and campaign copy. Questions: hello@signal-send.com. We typically respond within one business day.

Depending on how you use the service, we may process: account email and display name; passwords (hashed); uploaded contact lists and campaign files; job outputs (segments, copy, confidence scores); billing records if you pay; if you connect Klaviyo, OAuth tokens, the Klaviyo account name/id, and — when you import — list membership and profile fields you choose to pull; and, if you connect Google Analytics, an encrypted refresh token, the property you choose, and the website metrics we import for that property. We do not scrape your storefront or infer private facts you did not upload or import.

We use this information to run the product: authenticate you, process lists, generate recommendations and copy, export workbooks, push optional results to Klaviyo when you ask, bill usage, prevent abuse, and improve reliability. Uploaded lists are not pooled into public model training.

Connecting Klaviyo is optional. CSV and workbook export work without it. If you authorize the connection, we request only the API permissions needed to identify your account, read lists and profiles so you can import an audience, update matching profiles, create or reuse lists, and optionally create email templates. We do not request permission to send or schedule campaigns, and we do not send email from Signal Send.When you click Import, we may read list names and profile fields (typically email, name, company, title, location, phone, and custom properties) from the list you select, then store them like an uploaded CSV for segmentation and copy. We only import when you ask.When you click Push, we may write: profile properties signal_send_segment and signal_send_job_id; lists named like Signal Send · {campaign} · {segment}; and, if you opt in, email templates from approved copy. We match contacts by email. We do not overwrite unrelated Klaviyo fields or push columns you marked as protected (except email, which is required to match).You can disconnect in Signal Send, which revokes our tokens. If you uninstall the app inside Klaviyo, we treat the connection as revoked the next time we refresh tokens and ask you to reconnect. Until Klaviyo reviews a listing, their install screen may warn that the app is unreviewed — that is their default for private OAuth apps, not an endorsement.

Connecting Google Analytics is optional. If you authorize it, we request read-only access with the scope https://www.googleapis.com/auth/analytics.readonly. We use that access to list the properties on the Google account you connect and to import website metrics for the property you choose, including sessions, engaged sessions, key events, and purchase revenue by campaign, source, and medium. We store the refresh token encrypted and remove it when you disconnect. Disconnect also revokes the token with Google.The use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to show tracked website outcomes on your Signal Send account. We do not sell it, use it for advertising, or use it to decide creditworthiness.Website recommendations are calculated in Signal Send from those imported metrics. When you choose Generate, we send that account’s computed metrics — the numbers, date range, and campaign, source, and medium labels — to OpenAI so it can write the short note shown on your Analytics page. We do not use Google Analytics data to create, train, or improve a general machine learning or artificial intelligence model, and we do not allow that request to be stored for model distillation.

The public site loads Google Tag Manager container GTM-WL6BN2F7. Until you accept the banner, analytics storage stays off. If you accept, the tag sends page views and product events to Signal Send's own Google Analytics property. Those events can include the page you viewed, a completed account creation, a sign-in, the start or completion of a payment, the payment amount and currency, and that a list was uploaded. They do not include your email, name, or the contents of a contact list. Decline keeps analytics storage off. This is separate from the optional connection in section 5, which reads a Google Analytics property you choose.

We use other companies to operate the service:

• OpenAI — generates segments and copy from campaign fields you approve, and, when you generate Analytics recommendations, writes the note from that account’s computed Google Analytics metrics.
• Amazon Web Services (S3, us-east-1) — stores uploaded files and export workbooks.
• Render — hosts the application and PostgreSQL database.
• Stripe — processes payments if you buy credits or a subscription.
• Klaviyo — only if you connect your account; we read lists/profiles when you import, and write the data described above when you push, into the account you authorize.
• Google — if you accept site analytics, we send the events in section 6 to our own property. If you connect Google Analytics, we read the property you choose and do not write changes back to that property.

Application hosting, database, and file storage currently run in the United States (Render and AWS us-east-1). If you are in the EU/UK, you acknowledge that information you upload is processed in the US. We are building toward formal data-processing terms on request; email hello@signal-send.com if you need a DPA or deletion confirmation before using the product with EU personal data.

Account records last until you ask us to delete them. Job files and list uploads are kept so you can resume work; we may expire unused uploads. Klaviyo tokens and Google Analytics refresh tokens are stored encrypted and removed when you disconnect. Imported website metrics for a property are removed when that connection is disconnected. Billing records are kept as required for taxes and disputes. You can request deletion of your account and stored lists at the contact email above.

You can access or correct account details, disconnect Klaviyo, disconnect Google Analytics, export a workbook instead of pushing, and request deletion. Do not upload data you are not allowed to process. You are responsible for having a lawful basis to use contact information in your campaigns.

We transmit data over HTTPS. Klaviyo OAuth tokens and Google Analytics refresh tokens are encrypted at rest. Access to production systems is limited to operators who need it. No method of transmission or storage is perfectly secure; report issues to the contact email above.

Signal Send is a business tool. It is not directed at children, and we do not knowingly collect personal information from children.

We may update this policy. The date at the top will change. Continued use after an update means you accept the revised policy.