Privacy Policy

This policy applies to signalo.app and the Signalo dashboard (together, the "Service"), operated by ИП АБЕН, Kazakhstan ("Signalo", "we", "us"). If you're reading this expecting your own company's details here instead of ours — see section 12: your customers' data is something you're responsible for too.

Signalo deals with information about two different kinds of people, and treats them differently:

• Business owners — the people and companies who sign up for Signalo, connect their channels, and run their assistant. You're our direct customer, and we're the ones responsible for your account data.
• Customers of those businesses ("end customers") — people who message a business on Telegram, WhatsApp, Instagram, email or that business's website, and end up talking to its Signalo assistant. We process this information on the business's behalf and under their instructions, not for our own purposes — see section 12.

From business owners, when you create and use an account:

• Email address, password (handled by our authentication provider — we never see it in plain text), and business name
• Business details you add: services, products, prices, hours, staff names, knowledge base content, assistant configuration
• Preferences: language, timezone, currency
• Billing and usage records (see section 8 for payments specifically)
• Access tokens for channels and integrations you connect — your Telegram bot token, WhatsApp/Instagram business credentials, Google Calendar authorization — stored so the assistant can act on your behalf

From end customers, as they message a connected business:

• The messages they send and receive, and any files or images shared in that conversation
• Their name, phone number, or messaging handle — whatever identifies them on the channel they used
• What they book or order: appointment times, services, staff requested, delivery or shipping address, order contents
• Facts the assistant notes about them to be helpful next time — a preferred stylist, a recurring request, a date to remember — stored as short notes tied to that customer
• For the website chat widget, only if the visitor accepts its cookie notice: their IP address and the approximate location it implies (country, region, city), the type of device, operating system and browser, screen size, preferred languages and timezone, the page of the business's website they were on, the site that referred them there, and any campaign tags (UTM) in that page's address. A visitor who chooses "Necessary only" has none of this stored, and choosing it later removes what was stored before. We don't use any of it to track anyone across other websites.

To generate a reply, the relevant parts of a conversation — recent messages, the business's knowledge base, and facts remembered about that customer — are sent to Anthropic's Claude API, the AI model that powers the assistant. Anthropic processes this to produce the assistant's response; we do not permit it to be used to train Anthropic's models.

The assistant is instructed to work only from information it's actually given, and never to invent prices, availability or policies — but like any AI system, it can make mistakes. Business owners can hand a conversation to a real person at any time, and customers can ask to speak to one.

• Operate the assistant: understand a message, look up real availability and stock, and reply
• Create and manage bookings and orders, and send reminders or follow-ups the business has switched on
• Let a business owner see their own conversations, clients, bookings and orders in the dashboard
• Process payments, where a business has connected Stripe
• Maintain and secure the Service — debugging, abuse prevention, and keeping the right data behind the right account
• Communicate with business owners about their account — service notices, billing, support

We do not sell personal information, and we do not use end-customer conversations to advertise to them.

We share information with the following kinds of providers, only as needed to run the Service:

• Supabase — database, authentication and file storage that the whole Service runs on
• Anthropic — processes conversation content to generate the assistant's replies (see section 4)
• Stripe — payment processing, for businesses that accept payments through Signalo
• Resend — delivers transactional email sent by the Service
• Google — calendar and video-call integration, only for businesses that connect it
• Telegram, Meta (WhatsApp and Instagram) — the messaging platforms themselves, for businesses that connect those channels (see section 7)

We don't share information with data brokers or advertisers. We may disclose information if required by law, or to protect the rights, safety or property of Signalo, our users, or others.

Each channel a business connects is subject to that platform's own terms as well as this policy. Some specifics worth knowing:

• Telegram — the assistant operates as a bot the business creates; Telegram's own privacy terms govern how Telegram itself handles the underlying message transport.
• WhatsApp and Instagram — these run through Meta's Business Platform; Meta processes message delivery under its own terms, separate from what we do with the content once it reaches us.
• Email — sent and received through the business's connected mailbox and our email provider.
• Web widget — runs directly on the business's own website; no separate platform is involved.

Signalo isn't able to control what a business does with information outside the Service — for example, if they export a conversation and paste it elsewhere. That's their responsibility, not ours; see section 12.

Card numbers and other payment details are entered directly into Stripe's own checkout and never pass through our servers. We store the resulting Stripe identifiers (customer, charge and account IDs) needed to show a business their own payment and billing history.

We use a small number of cookies and browser-storage items:

• A session cookie that keeps a business owner signed in to the dashboard
• A cookie remembering a visitor's chosen language before they're signed in
• On a website that uses the chat widget: the visitor's answer to the site's cookie banner, so they are not asked again, and an identifier for their chat, so a returning visitor continues the same conversation

The widget shows one cookie banner for the whole website it runs on, and collects the visitor details described in section 3 only after the visitor accepts. The chat works fully either way. We don't run third-party advertising or analytics trackers on the Service.

We keep account and conversation data for as long as an account is active, so the dashboard and assistant keep working correctly, and for a reasonable period after to meet accounting, security and legal obligations. If a business closes its account, we delete or anonymize their data within a reasonable period, except where we're required to keep it longer (for example, payment records).

Depending on where you are, you may have the right to:

• Ask what information we hold about you, and get a copy of it
• Ask us to correct information that's wrong or out of date
• Ask us to delete your information
• Object to, or ask us to restrict, certain processing
• Receive your information in a portable format

We don't yet have a self-service way to do this from inside the dashboard — reach us at [privacy contact email] and we'll handle it by hand. If your message is with a business that uses Signalo rather than with us directly, we'll likely need to involve them too, since they're the ones who decide how their customers' data is used — see the next section.

If you're a business owner using Signalo to talk to your own customers, you are the one who decides what your assistant says, what it's allowed to do, and what you tell your customers about how you handle their information. In the language privacy law uses: you're the controller of your customers' data, and Signalo is a processor acting on your instructions.

That means it's your responsibility, not ours, to:

• Have a lawful basis for messaging your customers, and your own privacy notice covering it
• Only connect channels and collect information you're entitled to under the laws that apply to your business
• Respond appropriately if one of your customers asks you to access, correct or delete their information

We'll support you in meeting those obligations — reach out if you need help.

The Service is intended for business use and isn't directed at children. We don't knowingly collect account information from anyone under 16. If a business's own customers include minors, the business is responsible for handling that appropriately under the laws that apply to them.

Our infrastructure providers may process information in countries other than the one you're in. Where that happens, we rely on the safeguards those providers offer (such as standard contractual clauses) to keep information protected to the standard this policy describes, wherever it's processed.

We use industry-standard safeguards — encryption in transit, access controls scoped per account, and credentials stored encrypted at rest — to protect information on the Service. No system is perfectly secure, and we can't guarantee absolute security, but we take it seriously and respond quickly to anything that looks wrong.

We may update this policy as the Service changes. If a change is significant, we'll let business owners know by email or inside the dashboard. The "last updated" date at the top of this page always reflects the current version.

Questions about this policy, or a request about your information? Write to [privacy contact email].