Privacy Policy

Privacy Policy

Last updated: April 2026

This Privacy Policy explains how SIGNALHR LTD ("we", "us", "our") collects, uses, stores, and protects your personal data when you use www.signalhr.co.uk.

Company details: SIGNALHR LTD Company number: 17169846 Registered office: 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ Email: hello@signalhr.co.uk

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is:

SIGNALHR LTD Company number: 17169846 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ Email: hello@signalhr.co.uk

2. What Personal Data We Collect

Account and Registration Data We collect your first and last name, email address, phone number, home or business address including postcode, password (stored as a secure hash — we never store your password in plain text), and account type (employer user or specialist).

Usage and Chat Data We collect the content of your AI chat conversations, cases you create and the details you provide within them, messages exchanged between you and specialists, feedback you provide on AI responses, case outcomes you log, and documents and files you upload to the platform.

Payment Data We collect your subscription plan and billing history. Payment card details are processed and stored securely by Stripe — we do not store your card details on our servers.

Technical Data We collect your IP address, browser type and version, device information, login timestamps, and pages visited and features used.

Communications Data We collect emails you send to us, contact form submissions, and your email marketing preferences.

3. How We Use Your Personal Data

To provide the service (Contract) We use your data to create and manage your account, process your subscription and payments, provide AI chat guidance and tools, facilitate specialist referrals, send service-related emails such as verification, password reset, and case notifications, and maintain your case history and HR audit trail.

To comply with legal obligations (Legal Obligation) We use your data to maintain financial records and respond to lawful requests from regulatory or law enforcement authorities.

For our legitimate interests (Legitimate Interests) We use your data to improve the platform and AI guidance quality, monitor for fraud, abuse, and security threats, analyse platform usage and performance, and send service announcements and platform updates.

With your consent (Consent) We send marketing emails and product updates where you have opted in. You may withdraw your marketing consent at any time by updating your preferences in your account settings or by contacting us at hello@signalhr.co.uk.

4. AI Chat Data

The content of your AI chat conversations is processed by OpenAI's API to generate responses. OpenAI processes this data as a data processor acting on our behalf under a data processing agreement. We recommend you do not include highly sensitive personal data — such as National Insurance numbers, financial account details, or medical information — in your chat conversations beyond what is reasonably necessary to describe your workplace situation.

Chat conversations are stored on our servers to allow you to review your conversation history and maintain a case record. We may review anonymised or aggregated chat data to improve the quality of AI guidance provided on the platform.

5. Who We Share Your Data With

We share your personal data with the following third parties only where necessary to provide the service:

Stripe — payment processing. Stripe is PCI DSS compliant and processes your payment data under their own privacy policy.

OpenAI — AI chat processing. Your chat content is sent to OpenAI's API to generate guidance responses.

Supabase — database hosting and storage. Your account and case data is stored on Supabase's infrastructure.

Vercel — platform hosting. The SignalHR application is hosted on Vercel's infrastructure.

Resend — transactional email delivery. We use Resend to deliver system emails such as account verification, password reset, and case notifications.

Independent HR specialists — if you request a specialist referral, your name, email address, and relevant case details will be shared with the specialist you are referred to. You will be informed before this occurs.

We do not sell your personal data to third parties. We do not share your data with advertisers.

6. International Data Transfers

Some of our third-party providers, including OpenAI and Vercel, are based in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including reliance on standard contractual clauses or adequacy decisions where applicable.

7. How Long We Keep Your Data

• Account data is retained for the duration of your account and for up to 2 years after account closure, unless you request earlier deletion.
• Chat and case data is retained for the duration of your account and for up to 2 years after account closure.
• Payment records are retained for 7 years to comply with financial record-keeping obligations under HMRC requirements.
• Marketing preferences are retained until you withdraw consent or close your account.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

Right of access — you can request a copy of the personal data we hold about you (commonly known as a Subject Access Request).

Right to rectification — you can ask us to correct inaccurate or incomplete data.

Right to erasure — you can ask us to delete your personal data in certain circumstances (the "right to be forgotten").

Right to restriction — you can ask us to restrict the processing of your data in certain circumstances.

Right to data portability — you can ask us to provide your data in a structured, commonly used, machine-readable format.

Right to object — you can object to processing based on legitimate interests or for direct marketing purposes.

Rights related to automated decision-making — you have the right not to be subject to solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, please contact us at hello@signalhr.co.uk. We will respond within one month of receiving your request. We may need to verify your identity before processing your request. There is no charge for exercising your rights in most circumstances.

9. Cookies

SignalHR uses cookies and similar technologies to operate the platform.

Essential cookies are required for the platform to function, including session authentication cookies, and cannot be disabled without affecting platform functionality.

Analytics cookies may be used to understand how users interact with the platform to help us improve it.

By using SignalHR, you consent to the use of essential cookies. Where we use non-essential cookies, we will seek your consent in accordance with applicable law.

10. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These measures include encrypted data storage, secure HTTPS connections, hashed and salted passwords, access controls limiting who can access personal data, and regular review of our security practices.

No method of transmission or storage is completely secure. We cannot guarantee the absolute security of your data, but we take our obligations seriously and will act promptly in the event of any incident.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and will notify affected individuals where required by law.

11. Children

SignalHR is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at hello@signalhr.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. We will notify you of significant changes by email or by posting a notice on the platform. The date at the top of this policy indicates when it was last updated. Continued use of the platform following notification of changes constitutes your acceptance of the updated policy.

13. Complaints

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: ico.org.uk Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first at hello@signalhr.co.uk.

14. Contact

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please contact:

SIGNALHR LTD 24 Dane Close, Alsager, Stoke-on-Trent, ST7 2HZ Email: hello@signalhr.co.uk