Privacy Policy

We collect the following categories of information:

• Account information. Your name, email address, and sign-in details when you create an account or sign in, the workspaces you belong to and your role in them, and the email addresses of people you invite. If you sign in with Google, see section 9.
• Billing information. When you subscribe to a paid plan, our payment provider Stripe collects your card details, billing name, email address and billing address (and a tax ID if you add one). We do not receive or store your full card number. From Stripe we keep your plan, subscription status, renewal date and a customer reference. See section 4.
• Meta advertising data. When you connect a Meta (Facebook/Instagram) Business or Ads account, we access advertising data through the Meta Marketing API, including ad accounts, campaigns, ad sets, ads, creatives, and aggregated performance metrics (such as spend, impressions, clicks, and conversions). We access this data only with your authorisation and only to provide the Service.
• Public advertising data. Ads from the Meta Ad Library, and public social media posts, for the brands you ask us to analyse, including competitors. These can include the names, images or voices of people who appear in those ads and posts.
• Content you provide. Briefs, audience and persona inputs, notes, chat messages, and other content you enter or upload into the Service.
• Technical data. Your IP address, browser and device type, and the pages you request, recorded in our hosting and error-monitoring logs.

We use the information we collect to:

• Provide, operate, and maintain the Service and your account;
• Generate creative strategy outputs, including audience research, personas, synthetic focus groups, creative briefs, and performance reporting, from your inputs and connected Meta advertising data;
• Take payments and manage your workspace’s plan;
• Send you emails about the Service, such as when a report you started is ready;
• Authenticate you and keep the Service secure;
• Monitor errors, costs and usage so we can fix problems and improve features;
• Respond to your requests and provide support; and
• Comply with legal obligations, including tax record-keeping.

Emails we send. We send the service emails you need to use Signal Labs: a welcome email, a notice when a report you started is ready, a warning when your workspace nears or reaches its monthly allowance, payment problems, and invitations to join a workspace. We may also send occasional reminder emails about your account. You can stop reminder emails at any time with the unsubscribe link in any of our emails or on our unsubscribe page. Emails about your account, billing or security still arrive while your account is open.

We do not use your Meta advertising data to build cross-customer advertising profiles, and we do not sell your personal information.

Signal Labs uses Google’s Gemini models to generate research, personas, focus-group simulations, reports, and other outputs. To produce a result, we send Google the content needed for that task: for example your inputs, and the images, video, copy and figures of the ads being analysed. We use Google’s paid Gemini API, under terms that do not allow Google to use this content to train its models, and we send only the data needed to produce the requested output.

Payments are processed by Stripe, our payment provider. When you subscribe, you enter your card details into Stripe’s secure payment form, and they go directly to Stripe. We never see or store your full card number. Stripe also uses the details it collects to prevent fraud, and it handles them under its own Privacy Policy. We keep a record of your plan, your subscription status and renewal date, and Stripe’s reference for your workspace, so we know which plan your workspace is on.

We do not sell your personal information. We share information only in the following circumstances:

• Service providers. With the companies that process data on our behalf to run the Service, listed in section 6.
• Your workspace. Other members of a workspace can see the brands, reports and other content in that workspace.
• Share links. If you create a share link to a report or brief, anyone with that link can view it.
• Apps you connect. If you connect Signal Labs to Claude (made by Anthropic), Claude can read the Signal Labs data your account can see when you ask it to. What Claude receives is then handled by Anthropic under your own agreement with them. You can disconnect it at any time from your connectors in Claude.
• Legal and safety. Where required by law, or to protect the rights, property, or safety of Signal Labs, our users, or others. Requests from public authorities are handled under our Government & Authority Data Request Policy.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this Policy.

These companies process personal information for us, under contract, only to provide their service to us:

• Supabase — Our database, sign-in, file storage and back-end processing.Data: your account, workspace and billing records, your content and reports, and stored Meta advertising data.Where: Sydney, Australia.
• Vercel — Hosts the Signal Labs website and app.Data: your requests to the site, including your IP address and browser details.Where: the United States, served through Vercel's global network.
• Google (Gemini API) — AI processing that produces research, personas, reports and briefs (section 3).Data: the inputs, ad content and figures needed for each task.Where: the United States and other countries where Google processes data.
• Stripe — Takes payments and manages subscriptions (section 4).Data: name, email address, workspace name, card details, billing address, and a tax ID if you add one.Where: Australia and the United States.
• Resend — Sends our emails, such as report-ready notices.Data: your email address and name, and the content of the email.Where: the United States.
• Sentry — Tells us when something in the app breaks.Data: technical details of the error, the page, your browser and device, and possibly your IP address.Where: Germany (European Union).
• SearchAPI — Retrieves ads from the Meta Ad Library.Data: the brand or Page names and IDs you ask us to look up, not your personal information.Where: outside Australia.

We also exchange data with Meta, as the source of your advertising data (section 8), and with Google if you use Google sign-in (section 9). Each of them handles that data under its own privacy policy.

Our main database is in Sydney, Australia. Some of our service providers store or process personal information outside Australia: in the United States (Vercel, Google, Stripe and Resend), in Germany (Sentry), and in other countries where those providers operate. We choose providers with strong security and privacy commitments and use them under contracts that limit how they may use your information. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

Our use and transfer of information received from the Meta Marketing API adheres to the Meta Platform Terms and Developer Policies. We access your Meta advertising data only with your explicit authorisation and read-only: we never create, change or pause ads. We use it only to provide the Service to you and keep it only as long as needed for that purpose. Disconnecting Meta in Settings → Integrations deletes our access token straight away, so we can no longer read your account. To delete the Meta data we have already stored, follow the steps in section 11.

If you choose “Continue with Google”, Google shares your name, email address and profile picture with us. We use them only to create your account, sign you in, and show who you are to the other members of your workspaces. We do not ask for access to your Gmail, Drive, Calendar or any other Google data, and we do not sell or share the information Google gives us.

Signal Labs’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Signal Labs’ access at any time from your Google Account’s security settings.

• Your account, workspace and content. Kept while your account is active, and deleted within 30 days after you ask us to delete your account.
• Meta access tokens. Deleted as soon as you disconnect Meta.
• Stored Meta advertising data and reports. Kept while you use the Service, so your reports and performance history stay available, and deleted when you ask us to delete them or your account.
• Billing records. Kept for at least five years after each payment, as Australian tax law requires. Stripe keeps its own records under its policy.
• Logs and error reports. Kept for a limited period set by our hosting and error-monitoring providers, then deleted automatically.

Our database provider keeps backups that are overwritten on a rolling basis, so deleted data can remain in a backup for a short time before it is overwritten.

You can ask us to delete your personal information, including any advertising data we hold from your connected Meta account, at any time:

• To stop access to your Meta account: go to Settings → Integrations and click Disconnect next to Meta. This deletes our access token immediately. You can also remove Signal Labs from the Business Integrations settings in your Facebook account.
• To delete your data or your account: email us at harry.mcgovern@halfdome.com.au with the subject “Data Deletion Request”, from the email address on your account. Tell us whether you want everything deleted or only your Meta advertising data.

We will confirm your request and complete it within 30 days. If the law requires us to keep something, such as billing records, we will tell you what we kept and why. If your workspace has a paid plan, cancel it first in Settings → Plan & billing.

We use industry-standard technical and organisational measures, including encryption in transit, access controls, and authenticated access, to protect your information. Card details are handled by Stripe, which is certified to the highest level of the payment card industry’s security standard (PCI DSS Level 1). No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Depending on where you live, you may also have rights under other laws:

• Australia (APPs). You may request access to, and correction of, the personal information we hold about you, and complain about how we handle it.
• EEA/UK (GDPR). You may have rights to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. Our legal bases for processing are performance of a contract, your consent, our legitimate interests, and compliance with legal obligations.
• California (CCPA/CPRA). You may have rights to know, access, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell or share personal information as those terms are defined under the CCPA.

To exercise any of these rights, contact us at harry.mcgovern@halfdome.com.au. We will respond within 30 days and will not discriminate against you for exercising your rights. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We use only the cookies and browser storage needed to sign you in, keep you signed in, and remember settings such as your theme. We do not use advertising cookies or analytics cookies. On the payment page, Stripe sets its own cookies to process your payment and prevent fraud. You can control cookies through your browser settings, though blocking essential cookies will stop you from signing in.

The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Privacy Policy or how we handle your information, want to access or correct it, or want it deleted, contact us at harry.mcgovern@halfdome.com.au.