Privacy Policy

1. Who we are

SignalBraid is a product of Gain Solutions AS, Solheimsgata 11A, N-2000 Lillestrøm, Norway (organisation number 918 479 961). Gain Solutions AS is the data controller for personal data processed through this website and for the account, billing and support data of SignalBraid customers. For the business data a customer connects to SignalBraid from third-party platforms, Gain Solutions AS acts as a data processor on the customer's instructions, under the Data Processing Agreement that forms part of our Terms.

Contact for privacy matters: privacy@signalbraid.com.

2. Data we collect on this website

We collect:

• Server and security logs — IP address, user agent, requested page and timestamp, processed by our hosting provider Cloudflare to deliver the site and protect it from abuse. Retained for up to 30 days.
• Your cookie choice — when you answer the cookie banner, your browser keeps your choice (whether you accepted analytics and marketing, when, and the version of the banner you answered) in its local storage under the key ghq_consent. It is not a cookie, holds no identifier and is not sent to us. We treat it as expired after 180 days, or sooner if we change the banner's version, and then ask you again. It is strictly necessary to respect your choice, so it is stored without asking.
• Website analytics, only if you accept them — if you accept the Analytics category in the cookie banner, this website loads three analytics services. Until you accept, none of them is loaded and no request is sent to Google, Ahrefs or PostHog.
  • Google Analytics 4, provided by Google, records the pages you view, how you arrived, your device and browser, and your approximate location derived from your IP address. Its enhanced measurement also records when you scroll down a page, click a link to another website, use the site search, play an embedded video, download a file or interact with a form. It sets the cookies _ga and _ga_<ID>, which hold a random identifier so that repeat visits can be counted.
  • Ahrefs Web Analytics, provided by Ahrefs, records the address of the page, the page that referred you and your browser's user agent, from which it derives your device, operating system and browser; like any web server, it also receives your IP address with the request. Ahrefs states that it sets no cookies, stores no personally identifiable information and counts visitors without a persistent identifier.
  • PostHog, provided by PostHog, Inc., records, among other things, the address of the page, the page that referred you, your device, operating system, browser, screen and viewport size, language and time zone, and an approximate location that it derives from your IP address, which it receives with the request. Session recording, surveys, heatmaps and the automatic capture of clicks and form entries are switched off, and we do not ask PostHog to build a profile of a visitor we cannot identify. PostHog sets no cookie. It keeps a random identifier and session information in your browser's local storage under the key ph_<project key>_posthog, and entries in session storage whose names also begin ph_<project key>_, which your browser clears when you close the tab.
• Correspondence — if you email us (for example about becoming a design partner), we keep your name, email address and the content of your message for as long as needed to respond and, if you become a design partner or customer, for the duration of that relationship.

We do not load advertising or marketing tags on this website.

Legal bases: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR); for correspondence, steps taken at your request before entering into a contract (Article 6(1)(b)); and for website analytics, your consent (Article 6(1)(a)), which the Norwegian Electronic Communications Act (ekomloven § 3-15) also requires before anything that is not strictly necessary is stored on or read from your device. You can withdraw your consent at any time with Cookie settings in the footer of every page outside the documentation at /docs/, which loads no analytics. When you do, the site deletes the analytics cookies and the analytics entries in local and session storage for this website in your browser and reloads the page so that no analytics script keeps running. Data collected before you withdrew is kept as described in section 6.

3. Data we process in the SignalBraid service

When the service launches, the following applies to customers and their users.

3.1 Account, billing and support data (we are the controller)

• Account data — name, work email, password hash, organisation and workspace names, role, sign-in and audit events. Basis: performance of the contract (Article 6(1)(b)).
• Billing data — plan, invoices and payment status, and the VAT or business ID number you give us. A Norwegian number is checked against the Brønnøysund registry and an EU number against VIES; a number from another country is checked by hand or approved on your declaration. We keep the number with the record of that check. Card details are entered directly with our payment processor Stripe and never stored by us. Basis: contract and legal obligations (bookkeeping, Article 6(1)(c)).
• Support data — tickets and messages exchanged through our support portal. Basis: contract and legitimate interest in providing support.
• Product telemetry — sync success, freshness, row counts and feature usage, used to operate the service, publish reliability statistics and enforce fair use. No report contents, account names or credentials are placed in analytics. Basis: legitimate interest (Article 6(1)(f)).

3.2 Connected platform data (we are the processor)

Customers authorize SignalBraid to read data from platforms they use — for example advertising accounts, analytics properties, online stores such as Shopify (section 3.7), payment accounts, CRM systems or email marketing platforms such as Klaviyo (section 3.6). That data may contain personal data of the customer's own customers and contacts. We process it only to provide the service to the customer: synchronizing, storing, normalizing, reconciling and serving it to the customer's authorized users, API clients and AI clients. We do not sell it, use it for advertising, or use it to train machine-learning models. Fields containing contact-level personal data are classified before storage and are excluded by default unless the customer enables them. Customers can delete a connection, a workspace or their account at any time, which deletes the connected data as described in section 7.

3.3 Google user data

SignalBraid's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google data (for example Google Analytics, Search Console, Google Ads and Google Sheets data that a customer connects) is used only to provide and improve the user-facing features of SignalBraid for that customer, is never transferred to others except as necessary to provide those features, to comply with the law, or as part of a merger or acquisition with notice, is never used for advertising, and is never read by humans except with the customer's consent, for security purposes, to comply with the law, or in aggregated and anonymized form.

3.4 Meta platform data

Data received from Meta's platforms (for example Meta Ads reporting) is used only to provide SignalBraid's reporting and analysis features to the customer who authorized the connection, in accordance with Meta's Platform Terms and Developer Policies. It is not shared with third parties except as necessary to provide the service, and it is deleted when the customer deletes the connection, the workspace or their account, or requests deletion, as described in section 7; data already delivered to a place the customer controls is not deleted by SignalBraid.

3.5 YouTube API Services

If a customer connects a YouTube channel, SignalBraid uses YouTube API Services to read that channel's data. By using the YouTube connector you also agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. SignalBraid's use of information received from YouTube API Services also adheres to the Google API Services User Data Policy, including the Limited Use requirements, described in section 3.3.

• What we access. Read-only access, with the scopes shown before you authorize: for the channel, its title, identifier, handle and creation date, and its public lifetime counters (views, subscribers where the channel shows them, and number of videos); for each video, its title, identifier, publish time, duration, privacy status (public, unlisted or private) and whether it is or was a live stream or premiere; and the channel's and videos' performance metrics. For each video and day the metrics include where its views came from: the traffic source type (for example YouTube search or an external website) and, where YouTube provides it, the traffic source detail, which can be a search term a viewer entered or the web address (URL) of an external page that referred the viewer.
• What we store. The channel and video details and the metrics listed above, including the traffic source detail, as a copy kept for the customer's workspace. We store the traffic source detail exactly as YouTube sends it, without filtering or redacting it, together with the day, the video and the counts it belongs to and not with any identifier of a viewer; the text itself can still contain personal data if a viewer typed it. We keep YouTube history for up to 36 months, even where the customer's plan allows a longer history for other sources.
• Who it is shared with. The authorized users of the customer's workspace, and the tools the customer chooses to connect or export to, such as AI assistants, spreadsheets and files. Serving YouTube data through our REST API and our MCP connector is switched off by default. Our service providers (section 4) process it only to run the service. We do not sell it, use it for advertising or use it to train machine-learning models.
• How it is shown. YouTube values are shown separately from the data of other platforms, labelled with their source. We do not add them to, or combine them with, data from other sources.
• Deleting it. We erase the stored YouTube data within 7 calendar days after the customer disconnects the channel, asks us to delete it, or deletes the account. If you instead revoke SignalBraid's access at Google, we erase it within 30 days of the revocation. These periods apply to the live copy; section 7 describes backup copies and data you have already delivered elsewhere.
• Revoking access. In addition to disconnecting the channel in SignalBraid, you can revoke SignalBraid's access to your Google data at any time on the Google security settings page.
• Questions and complaints. Write to privacy@signalbraid.com.

3.6 Klaviyo data

If a customer connects a Klaviyo account, SignalBraid reads that account's data through the Klaviyo API with read-only access, and processes it as described in section 3.2. Klaviyo hosts its service in the United States, and that is where Klaviyo normally stores this data; where a particular Klaviyo account's data is held is set by that customer's own agreement with Klaviyo. Klaviyo is a platform the customer connects as a source, not one of our service providers in section 4. Our own copy of the data is kept as described in sections 5 and 6; that copy does not change where Klaviyo holds the data.

3.7 Shopify data

If a customer connects a Shopify store, SignalBraid reads that store's data through the Shopify API with read-only access, and processes it as described in section 3.2. Shopify holds the store's data on infrastructure Shopify chooses, under the merchant's own agreement with Shopify; SignalBraid does not control where Shopify holds it. Shopify is a platform the customer connects as a source, not one of our service providers in section 4. Our own copy of the data is kept as described in sections 5 and 6; that copy does not change where Shopify holds the data.

4. Who we share data with

We use a small number of service providers (subprocessors) to run SignalBraid. Each provider of the service is bound by a data processing agreement. The three website analytics providers are used only if you accept analytics (section 2): Google processes that data under its data processing terms for Google Analytics, Ahrefs under its data processing addendum, and PostHog under the data processing agreement of PostHog, Inc.

A current list, including any observability providers, is maintained on our Security page once the service is live. We may also disclose personal data where required by law, or to a successor in a merger or acquisition, with notice.

5. Where data is stored

We create our infrastructure in European Union regions wherever the provider offers one; customer data at rest is stored in the EU. Some processing — request handling on a global edge network, payments, transactional email and, if you accept them, website analytics by Google and Ahrefs — takes place outside the EU, as described in section 4. If you accept analytics, PostHog data is sent to the region of PostHog Cloud that PostHog calls EU; PostHog, Inc. is a United States company, so we do not promise that this data stays in the EU. Klaviyo, which a customer may connect as a source, normally holds its data in the United States (section 3.6) and is not one of our subprocessors. Shopify, which a customer may also connect as a source, holds a store's data on infrastructure Shopify chooses (section 3.7) and is not one of our subprocessors either. We do not promise that no data ever leaves the EU; the table in section 4 describes the actual data flow, and we update it when it changes.

6. How long we keep data

• Website logs: up to 30 days.
• Your cookie choice: treated as expired after 180 days, or sooner if the banner's version changes; it stays in your browser until you clear it or make a new choice.
• Google Analytics cookies (_ga, _ga_<ID>): up to 2 years, Google's default expiry, unless your browser deletes them sooner or you withdraw consent.
• Google Analytics event data: no longer than 14 months; reports aggregated from it are not subject to that limit.
• Ahrefs Web Analytics: kept by Ahrefs under its own terms; Ahrefs states that it stores no personally identifiable information.
• PostHog event data: kept in our PostHog project for the retention period set in that project's settings; the identifiers PostHog keeps in your browser's storage stay until you clear them or withdraw consent.
• Correspondence: for the duration of the relationship it concerns, then up to 12 months.
• Account and billing data: for the life of the account, then as required by Norwegian bookkeeping law (five years for accounting records); tax evidence, below, has its own period.
• Connected platform data: for the history period of the customer's plan; deleted within 30 days of the customer deleting the connection, workspace or account; backup copies expire within a further 30 days, so it is gone within 60 days. YouTube data is the exception described in section 3.5: up to 36 months of history, and erasure within 7 days of a disconnection, deletion request or account deletion, or within 30 days of a revocation at Google.
• Identifiers and audit history: 24 months.
• Acceptance records — which version of the Terms and of this policy an account accepted, and when: kept with the identifiers for 24 months, also after the account is erased.
• Tax evidence — every VAT or business ID number given for billing, the answer of the registry to each check of it, including any registered name it returns, and the record of that check: 10 years, also after the organisation is deleted.

7. Deleting your data

Customers can delete connections, workspaces and their account in the application; deletion propagates to every live system SignalBraid manages, including replay storage and the export files we store, within 30 days; backup copies expire within a further 30 days, so every copy we manage is gone within 60 days, and a restore from backup cannot bring deleted data back. Deletion erases content; the exception is tax evidence, which is kept for 10 years: every VAT or business ID number given for billing, the answer of the registry to each check of it, including any registered name it returns, and the record of that check. Identifiers and audit history are retained for 24 months, to cover an annual cycle plus a dispute window, and the audit history holds identifiers and hashes, never content. Data a customer has already delivered to a place they control — for example a Google Sheet, a downloaded file, a conversation in an AI client or a Looker Studio report — belongs to the customer and is not deleted by SignalBraid; the customer removes it there. For YouTube data the periods in section 3.5 apply to the live copy instead of the 30 days above; backup copies follow the normal backup cycle, expiring within a further 30 days, so YouTube data is gone from every copy we manage within about 37 days of a disconnection, deletion request or account deletion, and within about 60 days of a revocation at Google. Anyone can request deletion of their personal data by emailing privacy@signalbraid.com. If your personal data reached SignalBraid through a customer's connected platform, please contact that customer, who controls the data; we will assist them.

8. Your rights

Under the GDPR you have the right to access, rectify, erase and port your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on consent. Write to privacy@signalbraid.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Norway, Datatilsynet (datatilsynet.no).

9. Security

Credentials for connected platforms are encrypted and are never displayed, logged or returned through our API or AI interfaces. Access to customer data is scoped per workspace and audited. We use least-privilege permissions when connecting to platforms and show the requested scopes and the reason for each before you authorize. No method of transmission or storage is completely secure, and we will notify affected customers and authorities of a personal data breach as required by law.

10. Cookies

Without asking, this website stores only what it needs to work: your cookie choice, described in section 2, kept in local storage rather than as a cookie; and, on the documentation pages under /docs/, which sections of the navigation sidebar are open and where it is scrolled, kept in session storage, which your browser clears when you close the tab. Analytics cookies — Google Analytics's _ga and _ga_<ID> — are set only after you accept the Analytics category in the cookie banner; Ahrefs Web Analytics, which also runs only after you accept, sets no cookies, according to Ahrefs; PostHog, which also runs only after you accept, sets no cookie either, and keeps its identifiers in local storage and session storage under keys that begin ph_, which the site deletes when you withdraw your consent. This website sets no advertising cookies. You can change your choice at any time with Cookie settings in the footer of every page outside the documentation at /docs/. Our Cookie Policy has the details.

The SignalBraid application will use strictly necessary cookies for sign-in sessions and security; no advertising or third-party tracking cookies are used, and we will ask for consent before any non-essential cookie is set.

11. Children

SignalBraid is a business service and is not directed at children under 16. We do not knowingly collect personal data from children.

12. Changes

We will post any changes to this policy on this page with a new version number and effective date, and notify customers of material changes by email.

Version history:

• 1.9 — date to be set at publication: states Google's Limited Use disclosure in the wording Google asks for, which covers the transfer of information received from Google APIs to any other app as well as its use (section 3.3).
• 1.8 — date to be set at publication: adds PostHog, a third analytics service that loads only after you accept analytics and keeps its data in local storage and session storage, not in a cookie (sections 2, 4, 5, 6 and 10); states that the record of which Terms and Privacy Policy versions an account accepted, and when, is kept with the identifiers for 24 months, also after the account is erased (section 6).
• 1.7 — date to be set at publication: names Shopify as a platform a customer may connect as a source, read with read-only access (sections 3.2, 3.7 and 5); states that Shopify is not one of our subprocessors and that SignalBraid does not control where Shopify holds a store's data.
• 1.6 — date to be set at publication: tax evidence (the VAT or business ID numbers given for billing, the answers of the registry to their checks, including any registered name, and the records of those checks) is kept for 10 years, also after the organisation is deleted (sections 6 and 7).
• 1.5 — date to be set at publication: discloses that Klaviyo, a platform a customer may connect as a source, hosts its service in the United States and normally holds its data there (sections 3.2, 3.6 and 5); states that SignalBraid does not control where the platform holds that data.
• 1.4 — date to be set at publication: lists the events Google Analytics records through enhanced measurement (section 2); names Ahrefs's data processing addendum (section 4); keeps the YouTube API Services disclosure (section 3.5).
• 1.3 — 12 October 2026: adds section 3.5 for the YouTube API Services, with the matching lines in sections 6 and 7.
• 1.2 — 2 October 2026: discloses the consent-gated analytics, Google Analytics 4 and Ahrefs Web Analytics, and the cookie choice (sections 2 and 10).
• 1.1 — 1 October 2026: backup copies of connected platform data expire within a further 30 days, so every copy is gone within 60 days (sections 6 and 7).
• 1.0 — 4 September 2026: first published version.

13. Contact

Gain Solutions AS · Solheimsgata 11A · N-2000 Lillestrøm · Norway · privacy@signalbraid.com