Privacy Policy

This Privacy Policy explains how ServiceSignal collects, uses, and protects information when you use our website and product. ServiceSignal is a UK-focused service; this policy is written with UK GDPR and the Data Protection Act 2018 in mind.

This is an MVP document for our beta period, prepared for clarity rather than as a substitute for professional legal advice. It will be reviewed by a qualified solicitor before general availability.

1. Information we collect

Account and profile data

When you create an account, we collect your email address, a securely hashed password (via Supabase Auth — we never see or store your plaintext password), and any business details you choose to add, such as a business name, contact email, contact phone, and reminder preferences.

Invoice and customer data

You may enter your customers' names, email addresses, phone numbers, invoice amounts, due dates, and optional payment links. This data is used solely to provide the invoice-chasing service back to you.

Beta signup data

Before creating a full account, you may submit your email address through our beta waitlist form on the landing page. This is used to contact you about ServiceSignal's beta and is stored separately from full account data.

Technical and usage data

We collect standard technical data needed to operate the service — such as authentication session tokens (via cookies) and basic request logs on our hosting and database infrastructure — used for security, debugging, and reliability.

Email-delivery data

When we send reminder or account emails through Resend, delivery metadata (such as whether an email was sent successfully) is recorded so we can show you accurate activity history and avoid sending duplicate emails.

2. Purposes and lawful bases (UK GDPR)

• Providing the service — performance of our contract with you (Art. 6(1)(b)).
• Security and fraud prevention — our legitimate interests (Art. 6(1)(f)).
• Beta communications — your consent, given when you submit the waitlist form (Art. 6(1)(a)).
• Legal compliance — where we're required to by law (Art. 6(1)(c)).

3. Processors and third-party services

We use the following processors to operate ServiceSignal:

• Supabase — authentication and database hosting.
• Resend — sends reminder and account emails on our behalf.
• Vercel — application hosting.

Where you add a payment link to an invoice, the third-party payment provider you choose (for example Stripe, GoCardless, PayPal, or SumUp) processes any payment made by your customer directly — ServiceSignal is not party to that transaction and does not process payments itself.

4. International transfers

Some of our processors (including Resend) operate infrastructure outside the UK, which may involve transferring data internationally. Where this happens, we rely on the processor's own UK/EU-adequacy safeguards, such as Standard Contractual Clauses, as required by UK GDPR.

5. Retention

We keep account and invoice data for as long as your account is active, plus a reasonable period afterward to allow account recovery and meet legal obligations. You can request deletion at any time — see Section 7.

6. Security

We use industry-standard measures to protect your data, including encryption in transit and at rest (via our infrastructure providers) and row-level access controls that ensure your data is only accessible to your own account.

7. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• restrict or object to certain processing;
• request a portable copy of your data;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@servicesignal.app.

8. Cookies and similar technology

We use essential cookies to keep you signed in and to secure your session. We do not currently use advertising or third-party tracking cookies.

9. Children

ServiceSignal is intended for business use by adults. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this policy as ServiceSignal develops. We'll update the version number and effective date above when we do.

11. Contact and complaints

Questions about this policy can be sent to privacy@servicesignal.app. If you're unhappy with how we've handled your data, you also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.