Privacy Policy

1. Who we are

SignalBraid is a product of Gain Solutions AS, Solheimsgata 11A, N-2000 Lillestrøm, Norway (organisation number 918 479 961). Gain Solutions AS is the data controller for personal data processed through this website and for the account, billing and support data of SignalBraid customers. For the business data a customer connects to SignalBraid from third-party platforms, Gain Solutions AS acts as a data processor on the customer's instructions, under the Data Processing Agreement that forms part of our Terms.

Contact for privacy matters: privacy@signalbraid.com.

2. Data we collect on this website

This website is a static site. It does not use advertising, analytics or tracking cookies. We collect:

• Server and security logs — IP address, user agent, requested page and timestamp, processed by our hosting provider Cloudflare to deliver the site and protect it from abuse. Retained for up to 30 days.
• Correspondence — if you email us (for example about the private beta), we keep your name, email address and the content of your message for as long as needed to respond and, if you become a design partner or customer, for the duration of that relationship.

Legal bases: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR) and, for correspondence, steps taken at your request before entering into a contract (Article 6(1)(b)).

3. Data we process in the SignalBraid service

When the service launches, the following applies to customers and their users.

3.1 Account, billing and support data (we are the controller)

• Account data — name, work email, password hash, organisation and workspace names, role, sign-in and audit events. Basis: performance of the contract (Article 6(1)(b)).
• Billing data — plan, invoices and payment status. Card details are entered directly with our payment processor Stripe and never stored by us. Basis: contract and legal obligations (bookkeeping, Article 6(1)(c)).
• Support data — tickets and messages exchanged through our support portal. Basis: contract and legitimate interest in providing support.
• Product telemetry — sync success, freshness, row counts and feature usage, used to operate the service, publish reliability statistics and enforce fair use. No report contents, account names or credentials are placed in analytics. Basis: legitimate interest (Article 6(1)(f)).

3.2 Connected platform data (we are the processor)

Customers authorize SignalBraid to read data from platforms they use — for example advertising accounts, analytics properties, online stores, payment accounts or CRM systems. That data may contain personal data of the customer's own customers and contacts. We process it only to provide the service to the customer: synchronizing, storing, normalizing, reconciling and serving it to the customer's authorized users, API clients and AI clients. We do not sell it, use it for advertising, or use it to train machine-learning models. Fields containing contact-level personal data are classified before storage and are excluded by default unless the customer enables them. Customers can delete a connection, a workspace or their account at any time, which deletes the connected data as described in section 7.

3.3 Google user data

SignalBraid's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data (for example Google Analytics, Search Console, Google Ads and Google Sheets data that a customer connects) is used only to provide and improve the user-facing features of SignalBraid for that customer, is never transferred to others except as necessary to provide those features, to comply with the law, or as part of a merger or acquisition with notice, is never used for advertising, and is never read by humans except with the customer's consent, for security purposes, to comply with the law, or in aggregated and anonymized form.

3.4 Meta platform data

Data received from Meta's platforms (for example Meta Ads reporting) is used only to provide SignalBraid's reporting and analysis features to the customer who authorized the connection, in accordance with Meta's Platform Terms and Developer Policies. It is not shared with third parties except as necessary to provide the service, and it is deleted when the customer disconnects the account, deletes the workspace, or requests deletion as described in section 7.

4. Who we share data with

We use a small number of service providers (subprocessors) to run SignalBraid. Each is bound by a data processing agreement.

A current list, including any observability providers, is maintained on our Security page once the service is live. We may also disclose personal data where required by law, or to a successor in a merger or acquisition, with notice.

5. Where data is stored

We create our infrastructure in European Union regions wherever the provider offers one; customer data at rest is stored in the EU. Some processing — request handling on a global edge network, payments, transactional email — takes place outside the EU under the safeguards listed above. We do not promise that no data ever leaves the EU; the table in section 4 describes the actual data flow, and we update it when it changes.

6. How long we keep data

• Website logs: up to 30 days.
• Correspondence: for the duration of the relationship it concerns, then up to 12 months.
• Account and billing data: for the life of the account, then as required by Norwegian bookkeeping law (five years for accounting records).
• Connected platform data: for the history period of the customer's plan; deleted within 30 days of the customer deleting the connection, workspace or account, including from backups within their expiry period.

7. Deleting your data

Customers can delete connections, workspaces and their account in the application; deletion propagates to all systems, including replay storage and backups, within 30 days. Anyone can request deletion of their personal data by emailing privacy@signalbraid.com. If your personal data reached SignalBraid through a customer's connected platform, please contact that customer, who controls the data; we will assist them.

8. Your rights

Under the GDPR you have the right to access, rectify, erase and port your personal data, to restrict or object to its processing, and to withdraw consent where processing is based on consent. Write to privacy@signalbraid.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Norway, Datatilsynet (datatilsynet.no).

9. Security

Credentials for connected platforms are encrypted and are never displayed, logged or returned through our API or AI interfaces. Access to customer data is scoped per workspace and audited. We use least-privilege permissions when connecting to platforms and show the requested scopes and the reason for each before you authorize. No method of transmission or storage is completely secure, and we will notify affected customers and authorities of a personal data breach as required by law.

10. Cookies

This website sets no cookies. The SignalBraid application will use strictly necessary cookies for sign-in sessions and security; no advertising or third-party tracking cookies are used, and we will ask for consent before any non-essential cookie is set.

11. Children

SignalBraid is a business service and is not directed at children under 16. We do not knowingly collect personal data from children.

12. Changes

We will post any changes to this policy on this page with a new version number and effective date, and notify customers of material changes by email.

13. Contact

Gain Solutions AS · Solheimsgata 11A · N-2000 Lillestrøm · Norway · privacy@signalbraid.com