Privacy Policy

PRIVACY POLICY

Last updated: April 2026

This Privacy Policy explains how Matthew Craig Varley, trading as SignalHR, 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ ("we", "us", "our") collects, uses, stores, and protects your personal data when you use www.signalhr.co.uk.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

Matthew Craig Varley SignalHR 24 Dane Close Alsager Stoke-on-Trent ST7 2HZ Email: hello@signalhr.co.uk

2. What Personal Data We Collect

Account and Registration Data: We collect your first and last name, email address, phone number, home or business address including postcode, password (stored as a secure hash — we never store your password in plain text), and account type (user or specialist).

Usage and Chat Data: We collect the content of your AI chat conversations, cases you create and the details you provide within them, messages exchanged between you and specialists, feedback you provide on AI responses, and documents and files you upload to the platform.

Payment Data: We collect your subscription plan and billing history. Payment card details are processed and stored securely by Stripe — we do not store your card details on our servers.

Technical Data: We collect your IP address, browser type and version, device information, login timestamps, and pages visited and features used.

Communications Data: We collect emails you send to us, contact form submissions, and your email marketing preferences.

3. How We Use Your Personal Data

To provide the service (Contract): We use your data to create and manage your account, process your subscription and payments, provide AI chat guidance and tools, facilitate specialist referrals, and send service-related emails such as verification, password reset, and case notifications.

To comply with legal obligations (Legal Obligation): We use your data to maintain financial records and respond to lawful requests from regulatory or law enforcement authorities.

For our legitimate interests (Legitimate Interests): We use your data to improve the platform and AI guidance quality, monitor for fraud, abuse, and security threats, analyse platform usage, and send service announcements and platform updates.

With your consent (Consent): We send marketing emails and product updates where you have opted in. You may withdraw your marketing consent at any time by updating your preferences in your account settings or by contacting us at hello@signalhr.co.uk.

4. AI Chat Data

The content of your AI chat conversations is processed by OpenAI's API to generate responses. OpenAI processes this data as a data processor acting on our behalf. We recommend you do not include sensitive personal data such as National Insurance numbers, financial account details, or medical information in your chat conversations beyond what is necessary to describe your workplace situation.

Chat conversations are stored on our servers to allow you to review your conversation history. We may review anonymised or aggregated chat data to improve the quality of AI guidance.

5. Who We Share Your Data With

We share your personal data with the following third parties only where necessary to provide the service:

Stripe — payment processing. Stripe is PCI DSS compliant and processes your payment data under their own privacy policy.

OpenAI — AI chat processing. Your chat content is sent to OpenAI's API to generate responses.

Supabase — database hosting and storage. Your account and case data is stored on Supabase's infrastructure.

Vercel — platform hosting. The SignalHR application is hosted on Vercel's infrastructure.

Independent specialists — if you request a specialist referral, your name, email, and case details will be shared with the specialist you are referred to.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. International Data Transfers

Some of our third-party providers, including OpenAI and Vercel, are based in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on standard contractual clauses or adequacy decisions where applicable.

7. How Long We Keep Your Data

Account data is retained for the duration of your account and for up to 2 years after account closure, unless you request earlier deletion. Chat and case data is retained for the duration of your account and for up to 2 years after account closure. Payment records are retained for 7 years to comply with financial record-keeping obligations. Marketing preferences are retained until you withdraw consent or close your account.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access — you can request a copy of the personal data we hold about you.

Right to rectification — you can ask us to correct inaccurate or incomplete data.

Right to erasure — you can ask us to delete your personal data in certain circumstances.

Right to restriction — you can ask us to restrict processing of your data in certain circumstances.

Right to data portability — you can ask us to provide your data in a portable format.

Right to object — you can object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making — you have the right not to be subject to solely automated decisions that significantly affect you.

To exercise any of these rights, please contact us at hello@signalhr.co.uk. We will respond within one month of receiving your request. We may need to verify your identity before processing your request.

9. Cookies

SignalHR uses cookies and similar technologies to operate the platform. Essential cookies are required for the platform to function, including session authentication cookies, and cannot be disabled. Analytics cookies are used to understand how users interact with the platform to help us improve it. By using SignalHR, you consent to the use of essential cookies. Where we use non-essential cookies, we will seek your consent.

10. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data storage, secure HTTPS connections, hashed passwords, and access controls.

No method of transmission or storage is completely secure. We cannot guarantee the absolute security of your data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will notify affected individuals where required.

11. Children

SignalHR is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at hello@signalhr.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by email or by posting a notice on the platform. The date at the top of this policy indicates when it was last updated.

13. Complaints

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Website: ico.org.uk Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at hello@signalhr.co.uk.

14. Contact

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please contact:

Matthew Craig Varley SignalHR 24 Dane Close Alsager Stoke-on-Trent ST7 2HZ Email: hello@signalhr.co.uk