Privacy Notice
What we collect, why we collect it, and what you can ask us to do about it.
Last updated 28 July 2026. This is the first published version.
In short. We collect the minimum needed to run the service: your name and email so you have an account, and what you use inside the platform so we can improve it. We do not sell your data, we do not use it to train AI models, and we do not run third-party advertising or tracking on our website.
Who we are
Signalcroft AI Ltd is the data controller for the personal data described here. We are registered in England and Wales, company number 17364692, with our registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
For any privacy question, or to exercise any right below, email [email protected]. A person reads it and we aim to reply within five working days, and always within one month as the law requires.
What we collect, and why
| What | Why we need it | Lawful basis |
|---|---|---|
| Name and email | To create your account, sign you in, and send service messages such as your trial confirmation and password resets | Contract |
| Password | To protect your account. We never store it: we keep only a one-way cryptographic hash, and we check new passwords against a public breach database so you cannot pick one already exposed | Contract |
| Sign-in sessions | To keep you signed in securely and let you sign out | Contract |
| Which sections you open | To see which parts of the platform earn their place and which do not, so we improve the right things | Legitimate interests |
| Ratings and posts you write | To show your contributions to colleagues in your own organisation | Contract |
| Website visits | To count visitors and see which pages work. No cookie is set unless you consent, and we never store your IP address | Legitimate interests, and consent for any cross-visit identifier |
| Emails we send you | To keep a record that a message was sent and delivered, so we can help if something goes missing | Legitimate interests |
Where we rely on legitimate interests, we have considered your rights and concluded that the processing is limited, expected, and does not override them. You can object at any time using the contact address above.
What we do not do
- We do not sell or rent your personal data to anyone.
- We do not use your personal data, your content or your usage to train AI models, and our AI supplier is contractually barred from training on it.
- We do not run third-party advertising, marketing pixels or analytics trackers on our website. Our measurement is our own and stays on our own systems.
- We do not store your IP address in our website analytics.
Who else processes your data
We use a small number of suppliers to run the service. Each acts only on our instructions under a data processing agreement.
| Supplier | What they do | Where |
|---|---|---|
| Cloudflare | Hosts the platform and stores its database | Global edge network, with EU and UK presence |
| Resend | Delivers our emails to you | EU region |
| Google Workspace | Our business mailbox, when you email us | EU and US |
| Anthropic | Provides the AI models behind the service | US, under terms that forbid training on our data |
Where a supplier processes data outside the UK, the transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards approved under UK law.
Your organisation and what colleagues can see
If you sign up with a work email address, anything you post to the community board is visible to colleagues who share your email domain, and to nobody outside it. If you use a personal email provider such as Gmail or Outlook, you are treated as an organisation of one and no other member can see your posts or your name.
How long we keep it
- Account details: while your account is open, and for up to 90 days after you close it in case you return or a dispute arises.
- Sign-in sessions: up to 30 days, then they expire automatically.
- Usage records: up to 24 months, after which they are aggregated so they no longer identify you.
- Website analytics: up to 24 months.
- Email delivery records: 12 months. The contents of any message containing a password are erased as soon as it is delivered.
- Records we must keep by law, such as accounting records, are kept for the period the law requires.
Your rights
Under UK GDPR you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct anything inaccurate.
- Delete your data. Deleting your account removes your profile, sessions, posts, ratings and saved notes.
- Restrict or object to processing, including anything we do on the basis of legitimate interests.
- Receive your data in a portable, machine-readable format.
- Withdraw consent at any time where we relied on it, such as the cookie choice on our website. Withdrawing consent does not affect anything done before you withdrew it.
Email [email protected] and we will act without charge. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
Cookies and similar technology
Our website sets no cookie until you choose. If you accept, we store a single identifier so we can tell a returning visitor from a new one. If you decline, we still count the visit but cannot link it to any other visit. You can change your choice at any time using the link in our website footer.
The platform itself sets one essential cookie when you sign in, which keeps you signed in. It is required for the service to work and is not used for tracking.
Security
Everything travels over encrypted connections. Passwords are protected with strong, deliberately slow one-way hashing that meets current OWASP guidance. Access to the platform requires a valid session, and members of one organisation cannot see another organisation's people or content. We review the platform's security every day and fix problems as we find them.
If something goes wrong
If a breach occurs that is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, and tell you directly without undue delay where the risk to you is high.
Children
The service is sold to professionals and is not intended for anyone under 18. We do not knowingly collect data about children.
Changes to this notice
If we change how we use personal data, we will update this page and change the date at the top. Where a change materially affects you, we will tell you by email.