Privacy Policy

Account Information

• SignalSpect uses Clerk for member authentication. SignalSpect stores the member identity it needs to run the product, including member id, email address, display name, authentication provider, authentication subject, organization membership, selected site, and sign-in timestamps.
• SignalSpect records customer product visits, site selections, and openings of findings, evidence, supporting sessions, and replay. These records contain account and resource identifiers and timestamps, not a second copy of the website visitor payload.
• SignalSpect stores site records created by a member, including site name, hostname, origin, public site key, collection state, site configuration, and Focus Areas.
• SignalSpect does not ask customers to give SignalSpect authentication passwords. Authentication cookies and similar sign-in storage are handled by Clerk on authenticated SignalSpect pages.

Website Activity

• The browser SDK receives a site key and sends activity batches to the SignalSpect collector for sites where it is installed.
• Current events include session start and end, page views, navigation changes, click and scroll interactions, search events submitted through the SDK, form view/start/complete/abandon signals, conversion events submitted through the SDK, timestamps, browser viewport details, and limited device/browser strings.
• SignalSpect observes bounded details of the rendered page, including titles, headings, navigation, controls, form structure and content-region summaries. Depending on the privacy treatment, these contain approved text or hashes of page content. Click-related information can include element labels, destination context and bounded position/reach information; protected controls suppress precise spatial observations.
• SignalSpect derives sessions, entry-source categories, observed paths, behavioral threads, findings, comparisons, traffic-quality labels and selected evidence from observed activity. Source and before/after comparisons are limited by available evidence; they do not establish why someone acted or prove that a change caused an outcome.
• Structural capture is OFF. SignalSpect does not collect the separate structural visual representation at launch. Rendered-page observations and selectively retained session replay described here are separate features.
• Core observation does not require third-party analytics integrations. SignalSpect does not build cross-site visitor identity graphs, device fingerprints for visitor identification, or advertising audiences from this activity. Hashes used to compare page content are not visitor identities.

Privacy Protections

• Page URLs and referrers have embedded credentials, query values and fragments removed; query parameter names may remain. Paths and page titles are privacy-filtered. The collector sanitizes accepted event and replay data before queueing or storage.
• Form interaction signals describe activity rather than raw field values. Search text deliberately submitted through the SDK may be retained after privacy filtering; a search event is not a promise that all free text is anonymous.
• Email addresses, phone numbers, likely payment-card numbers, and sensitive token-like values are masked when detected.
• Sensitive form fields are blocked or masked based on field type, name, id, label, autocomplete, textarea status, and SignalSpect privacy attributes.
• Session replay may include page structure, unprotected page text and interaction changes. Input values are masked; explicitly blocked or masked regions and editable content receive additional protection. Canvas recording, inline image capture and font collection are disabled. Replay is sanitized before buffering and upload and again before storage; only selected evidence is uploaded for retention.
• These controls reduce disclosure risk; they do not make account information or every page anonymous. Do not intentionally submit passwords, payment-card details, authentication secrets or other prohibited sensitive information, including through custom events, page content or support messages.

Browser Storage

• The current SignalSpect browser SDK does not set its own cookies and does not use localStorage, sessionStorage, or IndexedDB. Its generated session id and event buffer live in memory for the page session.
• This SDK boundary is different from the SignalSpect member application. Clerk may use cookies or browser storage for sign-in, and Stripe manages storage in its hosted payment flows. SignalSpect holds current workspace and product-visit state in application memory. The SDK does not provide automatic consent management; website owners must arrange any required consent before loading it.

Billing

• SignalSpect uses Stripe for checkout, subscription state, billing portal access, and billing webhooks.
• Stripe collects payment details in its hosted checkout. SignalSpect stores customer, checkout session, subscription, price, status, billing-period, cancellation and payment-failure information needed to operate membership access, rather than collecting payment-card details in its own payment form.
• Behavioral events, findings, Focus Areas, and replay payloads are not sent to Stripe by SignalSpect.

Retention And Deletion

• Routine replay evidence becomes eligible for cleanup after 10 days; friction and finding-support evidence after 30 days. These are cleanup eligibility periods, not a guarantee of deletion at an exact time.
• Saving evidence pins it against ordinary cleanup. Although saved evidence receives a 90-day retention date, pinned evidence is not automatically deleted at that date. Unsave it to restore ordinary reason-based retention, or delete its owning site or account to remove it.
• Session summaries, rendered-page observations, behavioral threads, findings, comparisons and customer product-use records do not share the replay expiry periods. They currently have no automatic age-based deletion period and remain until their applicable account, site or linked-resource deletion.
• Accepted event batches pass through temporary processing queues. In-flight messages may remain until processed or expired, including after a deletion request; deletion controls prevent them from restoring deleted site data. Safe processing/dead-letter metadata can remain separately until applicable site/account deletion.
• Site deletion removes the selected owned site and related sessions, summaries, observed facts, inferences, findings, evidence metadata, processing state, dead-letter metadata, metering, site configuration, Focus Areas, and referenced evidence objects.
• Account deletion does not cancel a Stripe subscription or delete your Clerk sign-in identity. Manage cancellation separately in Billing; contact support if you need help after losing account access. Provider-held authentication, payment and transaction records are governed separately by those providers and applicable requirements.
• Account deletion removes the member's SignalSpect account data, single-owner organization, membership and Stripe reconciliation state stored by SignalSpect, owned sites, and the site-related data described above. Signing in again with the same authentication provider may create a new empty SignalSpect account.
• Minimal deletion-audit records and deletion markers retain identifiers, timestamps, outcomes, counts and safe error categories, without copies of deleted behavioral content. These records currently have no automatic expiry. Site deletion alone does not remove account-level billing records; account deletion removes the linked billing/webhook reconciliation records held by SignalSpect.
• Deletion may need retry if storage or another dependency is unavailable. A failed or partial request is not a completed deletion. Provider logs, support correspondence and any provider recovery copies are separate from the active product-data deletion path; this policy does not promise immediate erasure from every provider system or recovery copy.
• Subscription cancellation is not account deletion. It keeps account, site, Focus Area, finding, evidence, and replay records through the paid-through date and ordinary retention/deletion behavior.

Service Providers

• SignalSpect uses Clerk for authentication, Stripe for billing, Cloudflare for application delivery, event processing, evidence storage, operational monitoring and email routing, and Neon-hosted PostgreSQL for product data. Support email is forwarded to a monitored Google Gmail inbox.
• The primary product database is configured in the United States and replay object storage uses a U.S. jurisdiction. This is not a U.S.-only processing or all-provider data-residency promise. Authentication, billing, support and infrastructure providers may process information in other locations.

Purposes And Operations

• SignalSpect processes information to operate accounts and subscriptions, observe website experiences, select relevant evidence, present findings, support customers and improve the service. SignalSpect determines what is relevant from evidence; customers decide what action to take.
• Infrastructure handles network request information, including IP addresses used for abuse rate limiting. Operational logs and monitoring use request/error classifications, timestamps, identifiers, aggregate service metrics and incident notifications to detect failures, secure the service and support recovery. Production monitoring checks service health; it is not additional behavioral collection on customer websites.
• Support correspondence includes the contact information and details you choose to send. Please include the affected site and a description of the issue, without passwords, card details or unredacted visitor data.

Customer Responsibilities

• Customers are responsible for installing SignalSpect only on websites they are authorized to operate.
• Customers must explain their use of SignalSpect in appropriate website privacy notices, establish any required lawful basis, obtain consent where applicable, configure privacy exclusions and comply with laws applicable to their business and audience. Do not deliberately expose sensitive information to collection. SignalSpect does not determine a universal consent exemption or provide automatic legal compliance.

Support

SGNL HOLDINGS LLC handles privacy requests. Contact support@signalspect.com for account help, privacy questions, correction inquiries or deletion assistance when self-service controls are unavailable. If your inquiry concerns a website using SignalSpect, identify that website so the request can be directed to the responsible owner. We verify requests through the account or customer relationship where reasonably possible and may request additional evidence of authority when necessary. Ambiguous, third-party, statutory or legally sensitive requests are escalated for appropriate review. Do not send identity documents or sensitive visitor data unless a secure, necessary verification method has been agreed. Available assistance depends on the request and the supported product controls; we do not promise unsupported data exports or a universal set of rights or completion deadlines. No response-time commitment is published.

Policy Updates

The current policy is available at /privacy with its update date. Changes to product practices must be reflected here. Contact support about a previous version or a change that affects your use.