Privacy Policy

Privacy Policy

Last updated: 14th October 2026

This Privacy Policy explains how SIGNALHR LTD ("we", "us", "our") collects, uses, stores, and protects your personal data when you use www.signalhr.co.uk.

Company details: SIGNALHR LTD. Company number: 17169846. Registered with the Information Commissioner's Office, registration number ZC238126. Registered office: 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ. Email: hello@signalhr.co.uk.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is: SIGNALHR LTD, Company number: 17169846, 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ. Email: hello@signalhr.co.uk.

2. What Personal Data We Collect

Account and Registration Data: We collect your first and last name, email address, phone number, home or business address including postcode, password (stored as a secure hash — we never store your password in plain text), and account type (employer, employee or HR specialist).

Usage and Case Data: We do not store the content of your AI chat conversations — see section 4 below. We do collect the cases you create and the details held within them, including the case subject, the summary and chronology of events generated from your conversation, messages exchanged between you and specialists, feedback you give on AI responses, case outcomes you log, and documents and files you upload to the platform.

Payment Data: We collect your subscription plan and billing history. Payment card details are processed and stored securely by Stripe — we do not store your card details on our servers.

Technical Data: We collect your IP address, browser type and version, device information, login timestamps, and pages visited and features used. We use IP addresses briefly to protect the platform from abuse, for example by limiting repeated sign-up, contact form or password reset attempts. These records are deleted after a day.

Free Tool and Link Usage Data: When you use one of our free tools, such as our calculators and checklists, or open our HR specialist sign-up link, we record which tool or link you used, the country you are in (and, in the UK, whether England, Scotland, Wales or Northern Ireland), the name of the website or app that sent you (for example Google or LinkedIn), and whether you are using a phone, tablet or computer. Your location is worked out from your internet connection; we do not store your IP address for this. To count how many different people visit each day, we also create a code from your connection and browser using a secret that changes every day and is then deleted, so the code cannot be traced back to you or linked to your visits on other days. If you apply to join as an HR specialist after opening the sign-up link, we note on your application that you came through it and which website or app sent you. We do not use cookies for this and nothing is stored on your device. Visits by search engines and other automated software are not recorded.

Communications Data: We collect emails you send to us, contact form submissions, and your email marketing preferences.

Law Change Alert Data: You do not need an account to sign up for our law change alerts. If you sign up, we collect your email address, the date you signed up, the date you confirmed your sign-up, the page of our website you signed up on, and, if you later unsubscribe, the date you did so.

3. How We Use Your Personal Data

To provide the service (Contract): We use your data to create and manage your account, process your subscription and payments, provide AI chat guidance and tools, facilitate specialist referrals, send service-related emails such as verification, password reset, and case notifications, and maintain your case history and HR audit trail.

To comply with legal obligations (Legal Obligation): We use your data to maintain financial records and respond to lawful requests from regulatory or law enforcement authorities.

For our legitimate interests (Legitimate Interests): We use your data to improve the platform and AI guidance quality, monitor for fraud, abuse, and security threats, analyse platform usage and performance, understand which of our free tools are useful, how people find them, and which of our posts lead HR specialists to apply (see Free Tool and Link Usage Data in section 2), and send service announcements and platform updates.

With your consent (Consent): We send marketing emails and product updates where you have opted in. We also send law change alerts to people who have signed up for them. When you sign up for law change alerts, you tick a box to agree to receive them, and we then send a confirmation email to your address. We only add you to the list once you click the link in that email, so nobody can sign up someone else. Law change alerts tell you about changes to UK employment law and what employers need to do, and may include related SignalHR updates. We expect to send one or two a month.

You may withdraw your consent at any time by clicking the unsubscribe link included in every marketing email and law change alert, by updating your preferences in your account settings, or by contacting us at hello@signalhr.co.uk. Unsubscribing takes effect immediately.

4. AI Chat Data

We do not store your AI chat conversations.

Your messages are sent to OpenAI's API to generate a reply, and are held in your browser for the length of that conversation only. They are never written to our database. We cannot read them back, we cannot recover them for you, and they are gone once you close the page.

OpenAI processes this data as a data processor acting on our behalf under a data processing agreement. Your data is not used to train AI models: content you submit through our AI chat is not used by OpenAI to train or improve its models, and we do not use your content to train any AI model.

If you turn a conversation into a case, we do store the case record. That includes the case subject, a summary and chronology of events generated from what you have described, any severity assessment, messages exchanged between you and a specialist, and any documents you attach. That record is what allows you — and any specialist you are referred to — to pick the matter up again later.

Please share only what the question needs. Some HR questions genuinely require health information — a sickness absence, a fit note, a stress-related case — and you can include that where it is relevant to the guidance you need. But there is rarely any reason to enter an employee's full name, National Insurance number, bank or payroll details, home address or date of birth. Using initials or a job title instead will get you the same guidance while reducing the personal data held about that person.

To improve the quality of the guidance we give, we rely on the thumbs up and thumbs down rating you can leave on an individual answer. Where you rate an answer, that question and that answer are stored so we can check whether the guidance was accurate and correct it if it was not. The rating is stored against your account so that you can change or remove it, but the review screen we use to check answer quality does not show who gave the feedback. All feedback is deleted automatically after 90 days (see section 7).

Where you enter personal data about your own employees, you remain the controller of that data and are responsible for having a lawful basis for entering it. We process it as your processor in order to provide the service.

5. Who We Share Your Data With

We share your personal data with the following third parties only where necessary to provide the service:

Stripe — payment processing. Stripe is PCI DSS compliant and processes your payment data under their own privacy policy.

OpenAI — AI chat processing. Your chat content is sent to OpenAI's API to generate guidance responses.

Supabase — database hosting and storage. Your account and case data, law change alert sign-ups and free tool and link usage statistics are stored on Supabase's infrastructure.

Vercel — platform hosting. The SignalHR application is hosted on Vercel's infrastructure. Vercel also tells us the approximate country of each visit to our free tools and our HR specialist sign-up link, worked out from the internet connection.

Resend — email delivery. We use Resend to deliver system emails such as account verification, password reset, and case notifications, and to deliver marketing emails and law change alerts to people who have agreed to receive them.

Independent HR specialists — if you request a specialist referral, your name, email address, and relevant case details will be shared with the specialist you are referred to. You will be informed before this occurs.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. International Data Transfers

Some of our third-party providers, including OpenAI and Vercel, are based in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on standard contractual clauses or adequacy decisions where applicable.

7. How Long We Keep Your Data

AI chat conversations are not retained at all. They are not stored on our servers at any point — see section 4.

Account data and case records are retained for as long as your account remains active.

If you close your account or ask us to delete your data, we will delete your personal data within 30 days of your request, except where we are legally required to retain certain records for longer (see Payment Records below).

Documents you upload follow a separate, automatic retention process rather than a fixed date: see Document Retention further down this page for the full detail on deactivation and deletion timings.

Feedback you provide on individual AI responses (thumbs up/down) is retained for 90 days and then automatically deleted, as it is only used to review and improve response quality shortly after it is given.

Payment records are retained for 7 years to comply with financial record-keeping obligations under HMRC requirements.

Marketing preferences are retained until you withdraw consent or close your account.

Law change alert sign-ups are retained for as long as you remain subscribed. If you do not confirm your sign-up within 30 days, it is deleted automatically. If you unsubscribe, we keep your email address marked as unsubscribed so that we do not email you again. If you would like that record deleted entirely, contact us at hello@signalhr.co.uk.

Free tool and link usage statistics are kept so that we can see how use of the tools and the link changes over time. The secret behind each day's visitor code is deleted once that day is over, so the statistics cannot be linked back to you.

Records used to protect the platform from abuse, which can include your IP address, are deleted after a day.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access — you can request a copy of the personal data we hold about you (commonly known as a Subject Access Request).

Right to rectification — you can ask us to correct inaccurate or incomplete data.

Right to erasure — you can ask us to delete your personal data in certain circumstances (the "right to be forgotten").

Right to restriction — you can ask us to restrict the processing of your data in certain circumstances.

Right to data portability — you can ask us to provide your data in a structured, commonly used, machine-readable format.

Right to object — you can object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making — you have the right not to be subject to solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, please contact us at hello@signalhr.co.uk. We will respond within one month of receiving your request. We may need to verify your identity before processing your request. There is no charge for exercising your rights in most circumstances.

9. Cookies

SignalHR uses cookies and similar technologies to operate the platform.

Essential cookies are required for the platform to function, including session authentication cookies, and cannot be disabled without affecting platform functionality.

Analytics cookies may be used to understand how users interact with the platform to help us improve it.

Our free tool and link usage statistics (see section 2) do not use cookies and do not store anything on your device.

By using SignalHR, you consent to the use of essential cookies. Where we use non-essential cookies, we will seek your consent in accordance with applicable law.

10. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include encrypted data storage, secure HTTPS connections, hashed and salted passwords, access controls limiting who can access personal data, and regular review of our security practices.

No method of transmission or storage is completely secure. We cannot guarantee the absolute security of your data, but we take our obligations seriously and will act promptly in the event of any incident.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will notify affected individuals where required by law.

11. Children

SignalHR is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at hello@signalhr.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of significant changes by email or by posting a notice on the platform. The date shown at the top of this page indicates when it was last updated. Continued use of the platform following notification of changes constitutes your acceptance of the updated policy.

13. Complaints

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk. Helpline: 0303 123 1113.

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at hello@signalhr.co.uk.

14. Contact

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please contact: SIGNALHR LTD, 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ. Email: hello@signalhr.co.uk