Privacy Policy

Last updated: [DATE]

This policy explains how SigMonster Pty. Ltd. (ABN 49 639 500 299, ACN 639 500 299) ("SigMonster", "we", "us") collects, uses, discloses and protects personal information. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and, where it applies, the EU and UK General Data Protection Regulation (GDPR) and applicable US state privacy laws. More detail for people in the EU and UK is on our GDPR page.

1. Who this policy covers

Our customers (organisations and individuals who subscribe to SigMonster), the users their organisations add, and visitors to our websites.

Where your organisation manages your SigMonster account, your organisation decides how your information is used, and we process it on its behalf. Your organisation's own privacy policy also applies. See our GDPR page for more detail.

2. What we collect

• Sign-in information: when you sign in with Microsoft, Google, Facebook or Apple, we receive the information that provider shares with us, typically your name, email address, a unique account identifier and, where available, a profile picture.
• Information you give us: for example the content of your email signature (name, job title, phone numbers, photo, social links), and anything you send us when you contact support.
• Information your organisation gives us: your organisation's administrators may provide or manage information about you, such as signature fields and organisation-wide values.
• Billing information: payments are processed by Stripe. We don't store full card details.
• Usage and device information: collected via cookies and similar technologies, including through Google Analytics (with consent where required), for example pages visited, browser type, approximate location and IP address.
• Signature view counts: we count how many times each signature image is viewed. We don't identify or track the people who receive your emails.

3. How we collect it

Directly from you, from your organisation, from your chosen sign-in provider, and automatically through cookies, analytics and server logs when you use our websites and apps.

4. Why we use it

• To provide, run and support the SigMonster service, including generating and hosting your email signatures.
• To bill customers and manage accounts.
• To communicate with you, including onboarding, service and support emails and, where permitted, marketing emails. Every marketing email has an unsubscribe link.
• To understand how our service is used and improve it.
• To meet our legal obligations.

GDPR legal bases: performance of a contract, our legitimate interests (running, securing and improving the service, and marketing similar products to existing customers), consent (analytics cookies, and marketing where required), and compliance with legal obligations.

We do not sell personal information, and we do not share it for third-party advertising. We do not make automated decisions that have legal or similarly significant effects on individuals.

5. Publicly visible signature images

Signature images are hosted so they can be displayed in emails you send. Anyone who receives your email, or who has the image link, can view the information contained in your signature, and recipients can forward your emails. Please don't put anything in your signature you wouldn't want shared publicly.

6. Who we share it with

We share personal information only with service providers who help us run SigMonster:

• Linode (Akamai) — application hosting and databases (United States)
• Cloudflare — content delivery and hosting of signature images
• Google — Google Analytics and Gmail (support and marketing email)
• Stripe — payment processing
• OneSignal — marketing communications [if/when adopted]
• Sign-in providers (Microsoft, Google, Facebook, Apple), only the one you choose, as needed to authenticate you

All our other systems, including identity and authentication, are self-hosted on our own infrastructure.

We may also disclose information where required by law, or to your organisation's administrators where your account is managed by your organisation. Some of these providers act as sub-processors for data we handle on behalf of customer organisations; see our GDPR page and Data Processing Agreement.

7. Overseas storage and disclosure

Our servers are located in the United States (hosted by Linode/Akamai), and our service providers may process information in the United States and other countries where they operate. By using SigMonster you consent to this. For people in the EU or UK, we rely on appropriate safeguards such as Standard Contractual Clauses and the UK International Data Transfer Addendum. [Lawyer: confirm APP 8 approach and transfer mechanisms.]

8. Security

All data is encrypted in transit and at rest. Access to personal information is strictly limited to those who need it, and credentials are stored in secure key vaults. If a data breach affects customer data, we'll notify affected customer organisations within 48 hours of detecting it, and notify regulators and affected people where the law requires.

9. How long we keep it

• Account and signature data: kept for as long as you, or your organisation, remain a customer. When an organisation leaves, we follow our offboarding process to remove its data.
• Deletion requests: we delete your data within 24 hours of confirming your request.
• Backups: deleted data is fully removed from backups within 30 days.
• Web server logs: deleted within 7 days at most.
• Billing and tax records: kept for as long as the law requires.

10. Your rights

You can ask to access or correct your personal information, or to have it deleted. If you are in the EU, UK or certain US states, you may also have rights to data portability, to restrict or object to processing, and to withdraw consent. On request, we'll send you a copy of your data in a machine-readable format such as JSON, within one month. Some information may sit in different systems (for example support or billing); we'll help you find and handle it. If your account is managed by your organisation, we may refer your request to them. Contact support@sigmonster.net.

11. US state privacy laws

We do not sell personal information, and we do not share it for cross-context behavioural or targeted advertising, as those terms are defined under US state privacy laws such as the California Consumer Privacy Act. We do not use or disclose sensitive personal information for purposes that would require a right to limit. If you live in a US state with a privacy law, you can exercise your rights by contacting support@sigmonster.net, and we won't discriminate against you for doing so.

12. Cookies

We use essential cookies to run the service and analytics cookies (Google Analytics) to understand usage. Visitors in the EU and UK are asked to opt in to analytics cookies through our cookie banner, and can change their choice at any time. You can also control cookies through your browser settings.

13. Age

SigMonster is for people who have reached the age of legal majority in their jurisdiction and can enter into a contract in their own right. We do not knowingly collect information from anyone younger.

14. Complaints

Contact support@sigmonster.net. We'll acknowledge your complaint and respond within one month. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, in the EU or UK, your local data protection authority.

15. Changes

We may update this policy from time to time. We'll post the current version on our website and, for significant changes, let customers know.