Privacy Policy

This Privacy Policy describes how signitur, operated by Central Media LLC ("signitur," "we," "us," or "our"), a Florida limited liability company located in Orlando, Florida, collects, uses, maintains, and discloses information from users of the signitur.ai website, our web application, our browser extensions and marketplace applications, and all related products and services (collectively, the "Service").

1. Scope of This Policy

This Policy applies to the Service in its entirety, including the marketing website, the signature application at app.signitur.ai, and any integrations, extensions, or applications we distribute.

Where you use the Service as an individual, we act as the controller of your personal information. Where your employer or organization deploys the Service and configures signatures on your behalf, that organization is the controller of the employee data it supplies, and we act as its processor, handling that data according to the organization's instructions and our agreement with it. Employees whose details are placed into a signature by their employer should direct access and deletion requests to their employer in the first instance.

2. Personal Identification Information

We collect personal identification information in the following ways:

Information you provide. When you register for an account, subscribe to a plan, contact support, respond to a survey, or otherwise interact with the Service, we may collect your name, email address, phone number, job title, company name, mailing address, and the contact and profile details you choose to place into a signature.

Account credentials. Where you register with an email address and password, we store your email address and a cryptographic hash of your password. We never store your password itself, and we cannot recover or display it to you or to anyone else, including our own staff. Where you register using Google Sign-In, no password is created or stored at all. If you forget your password, you can ask us to email a reset link to your account email address; that email comes from support@signitur.ai, and the link works only once and expires after one hour.

Payment information. Subscription payments are processed by Stripe, Inc., a PCI DSS Level 1 certified payment service provider. Card details are collected directly by Stripe through its hosted payment fields and are transmitted to Stripe, not to us. We receive only confirmation of payment, the last four digits and brand of the card, the card expiry, billing country and postal code, and subscription status. We do not collect, process, or store full payment card numbers, magnetic stripe data, or card security codes on our systems. Stripe's handling of your payment information is governed by the Stripe Privacy Policy.

Information collected automatically. Certain information is collected automatically when you use the Service and is not "voluntarily submitted." See Sections 3, 6, and 7.

Information from your organization. Where an administrator deploys the Service across a domain, we may receive employee names, email addresses, job titles, departments, phone numbers, and profile photographs from your organization's directory in order to generate signatures.

3. Non-Personal Identification Information

When you interact with the Service, our servers and our hosting provider automatically receive technical information with each request, including your IP address, browser and operating system type (from your browser's user agent), the page or file requested, the referring URL, and the date and time of the request. If we use website analytics tools (see Section 7), they may also collect information such as screen size, pages viewed, and session duration. Depending on jurisdiction, IP addresses may be treated as personal information, and we handle them accordingly.

4. Content You Upload

When you use the Service you may upload logos, photographs, brand assets, illustrations, and other files ("User Content").

• You retain ownership of your User Content. We store and process it only to provide the Service to you.
• We do not use your User Content to train artificial intelligence or machine learning models, and we do not license, sell, or share it with third parties for that purpose.
• Hosted assets are served from public URLs. For a signature to display in a recipient's email client, the image or animation must be retrievable over the public internet. Signature assets are therefore stored at unguessable but publicly addressable URLs on our content delivery network. They are not indexed or listed, but they are not access-controlled. Do not upload material you are unwilling to have retrievable by anyone holding the URL.
• Retention of hosted assets after deletion. See Section 11, which explains what happens to these URLs when you cancel or delete your account.
• Features that process your content automatically. See Section 9 for how your logo is animated, how your profile photo is processed if you use AI video, and how article links you paste into a credibility banner are read.

5. Google Workspace and Microsoft 365 Data

Where you connect a Google Workspace or Microsoft 365 account, we request only the permissions needed to install and manage signatures. Depending on the integration and the permissions you or your administrator grant, this may include the ability to read and update signature settings on the mailbox, and, for organization-wide deployments, to read directory information about users on your domain.

Limited Use commitment. signitur's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We do not use data obtained from Google Workspace APIs to develop, improve, or train generalized artificial intelligence or machine learning models.
• We do not retain, store, or repurpose Google Workspace API data for any AI-related process.
• We do not transfer, sell, or share Google Workspace API data with third parties except as necessary to provide the user-facing functionality you have requested, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• We do not read, index, store, or analyze the body content of your email messages.
• All data accessed through these APIs is used strictly to deliver the functionality you have explicitly requested, such as creating, installing, and updating email signatures.

6. Information About Email Recipients

This section describes information collected about people who receive email containing a signature created with the Service. Recipients are not users of the Service and have not agreed to this Policy, so we describe this activity plainly.

What happens. Signature images and animations are hosted on our servers. When a recipient opens an email and their email client loads the signature image, that client makes a request to our servers. That request necessarily transmits the recipient's IP address, user agent string, and the time of the request. This is how images work on the internet and is inherent to any hosted email signature.

Signature analytics (when available). When signature analytics is available on the sender's plan and the sender has enabled it, a signature may include a small invisible image that lets us count when the signature is displayed (an "open"), and links in the signature, such as social profile links, buttons, the logo, or a banner, may be routed through our servers so that we can count clicks before forwarding the recipient to the intended destination. For each open or click we record the time, the signature and link involved, the recipient's approximate country (derived from the IP address), the general device type and operating system (derived from the user agent), and a short one-way hashed identifier, calculated from the IP address and user agent, that lets us count unique visitors without storing the IP address itself. Requests that appear to come from automated link scanners and bots are flagged and left out of the counts. Senders see reports of these opens and clicks for their own signatures.

What we do not do. We do not build advertising profiles of recipients, we do not sell or share recipient data with advertisers or data brokers, we do not attempt to identify recipients by name from these requests, and we do not track recipients across unrelated websites.

Roles and responsibility. When signature analytics is available, with respect to recipient data generated by analytics, the sending user or their organization is the controller and signitur acts as processor. The sender is responsible for providing any notice and obtaining any consent required by law in their jurisdiction and their recipients' jurisdictions. Consent requirements for email tracking pixels are significantly stricter in the European Union and the United Kingdom than in the United States, and enforcement in that area has been increasing.

Controls. When signature analytics is available, senders will be able to turn off analytics and link tracking for their signatures. Turning it off applies to signatures copied or installed after the change; links in emails already sent keep routing through our servers so that they continue to work, and clicks on them may still be recorded. Recipients can prevent opens from being counted by configuring their email client to block remote images, which most major clients support.

Retention. Raw request logs containing recipient IP addresses are retained for no more than thirty (30) days and are then deleted or irreversibly aggregated. When signature analytics is available, open and click records do not contain raw IP addresses and are kept for up to 400 days.

7. Cookies and Tracking Technologies

We use your browser's local storage, and may use cookies and similar technologies, on our website and application, as described below.

Strictly necessary storage. The application keeps your sign-in session, your signatures, and your settings in your browser's local storage so that the Service works and stays in sync with your account. Our hosting and security provider may also set strictly necessary cookies, for example to protect the Service from bots and abuse. These are required for the Service to work and are used without consent, as permitted by law.

Preference storage remembers choices such as your editor and dashboard settings.

Analytics cookies. We may use website analytics tools, such as Google Analytics, to understand how our website and application are used so that we can improve them. If we do, those tools may set analytics cookies and collect information such as pages viewed, time spent on the site, referring pages, device and browser type, and approximate location derived from your IP address. Section 10 lists the website analytics provider we use, if any, and we will add any other provider there before it begins collecting data.

Signature analytics (counting opens and clicks on the signatures you send) is a separate feature, described in Section 6.

Tutorial videos. Tutorial videos in the dashboard are hosted on YouTube, a Google service. Nothing is loaded from YouTube until you press play. When you do, the video loads from youtube-nocookie.com (YouTube's privacy-enhanced mode), and Google receives your IP address and browser information and may use cookies or similar technologies, as described in the Google Privacy Policy.

Your choices. If we use non-essential cookies, such as analytics cookies, we will provide a way to manage your preferences (for example, a cookie settings link) and, where required by law, including in the EU, UK, and certain other jurisdictions, ask for your consent before setting them. You will be able to change or withdraw that consent at any time. You may also configure your browser to refuse cookies or clear local storage, though this may sign you out or stop parts of the Service from working. We honor Global Privacy Control (GPC) signals where applicable law requires it.

We do not use cookies for cross-context behavioral advertising.

8. How We Use Collected Information

We use the information we collect to:

• Provide and operate the Service — create, render, host, and deploy your signatures, including optional features you choose to use, such as AI video and credibility banners;
• Process payments — bill subscriptions and custom design fees through our payment processor;
• Provide customer support — respond to inquiries, troubleshoot, and resolve issues;
• Improve the Service — analyze aggregate usage patterns to understand how the Service is used and where it can be improved;
• Communicate with you — send transactional messages, service announcements, security notices, and, where you have opted in, marketing communications you can unsubscribe from at any time;
• Secure the Service — detect, investigate, and prevent fraud, abuse, credential compromise, and unauthorized access;
• Comply with legal obligations — meet applicable laws, regulations, tax requirements, and lawful requests from authorities.

9. Artificial Intelligence and Automated Features

This section explains which features process your content automatically, and which of them involve an outside provider.

Logo animation

Your animated logo is generated by our own software, running on our hosting provider's infrastructure (Cloudflare). Your logo is not sent to a third-party AI vendor to create it.

AI video (Pro feature)

AI video is an optional feature that turns your profile photo into a short moving portrait, about five seconds long, for your signature. Nothing is sent to an outside provider unless you start a generation yourself.

• Who processes your photo. When you start a generation, we send your profile photo to Replicate, LLC ("Replicate"), which runs a third-party video-generation model, currently Kling v2.1, developed by Kuaishou. Replicate states that data for this model is sent from Replicate to Kuaishou. We send only the photo and our own fixed instructions for the motion; we do not send your name, email address, or other contact details.
• How the photo reaches Replicate. Smaller photos are sent directly with the request. Larger photos are placed at a temporary, hard-to-guess web address on our servers so that Replicate can fetch them; anyone holding that address could retrieve the photo while it exists. That copy is deleted as soon as the generation finishes and expires automatically within one hour in any case.
• What we keep. We download the generated video and store it on our servers, at an unlisted address, with your account and with no fixed expiry. We use it only to build the animated profile image in your signature, which is then hosted like your other signature assets (see Section 4).
• What Replicate keeps. According to Replicate's documentation, for predictions created through its API, which is how we use it, input parameters, output values, output files, and logs are automatically removed after one hour by default. Replicate's terms allow it to use the inputs and outputs it receives to provide the output and operate its service (and to train models that a customer chooses to create, which we do not do), and to improve its products only with aggregated, anonymized usage data. See the Replicate Privacy Policy and Replicate Terms.
• What Kuaishou keeps. Kuaishou's handling of the data it receives is governed by its own API terms and privacy policy, which are linked from the model's page on Replicate.
• Your choice. If you do not want your photo processed this way, do not use AI video. Every other feature works without it.

Credibility banners (Beta)

When you paste a link to an article or publication into a credibility banner, our server fetches that public web page, identifying itself as "signitur-credibility/1.0", to read the publication's name, its logo, and the article's headline. The request comes from our server, not from your browser, so the publisher sees our server's address rather than yours. We cache the publication's name and logo for 30 days so that the next customer featured by the same publication does not trigger another fetch; that cache is kept per publication and is not linked to your account. The link you paste, any logo you upload instead, and the banner you create are saved with your signature like your other User Content.

Our commitments

• We do not use your uploaded content, or the output generated from it, to train AI models, and we do not sell or license your content to anyone for that purpose.
• If we add a feature that sends your content to another AI provider, we will name that provider in the sub-processor table in Section 10 before it begins processing.
• AI-generated output belongs to you, as described in our Terms of Use.

10. Sharing Your Information and Service Providers

We do not sell, rent, or trade your personal information. We do not share personal information for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

We share information only in these circumstances:

Service providers (sub-processors). We use the vendors below to operate the Service. We share with each vendor only the information it needs for the purpose listed, and each handles that information under its own terms.

Aggregated information. We may share aggregated or de-identified statistics that cannot reasonably be used to identify any individual.

Legal requirements. We may disclose information where required by law, subpoena, court order, or other legal process, or where we reasonably believe disclosure is necessary to protect our rights, the safety of any person, or to investigate fraud.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

Google user data. Data obtained through Google APIs is never shared with third parties except as strictly necessary to deliver the functionality you requested, as required by law, or with your explicit authorization.

11. Retention and Deletion of Data

We retain data only as long as necessary to provide the Service, meet legal or regulatory obligations, resolve disputes, and enforce our agreements.

Deletion requests. You may request deletion of your personal data, including any Google user data, by emailing support@signitur.ai. Upon verification of your identity, we will delete the data within thirty (30) days unless retention is required for legitimate business or legal reasons, and we will tell you if that is the case.

12. How We Protect Your Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, and destruction. These include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of data at rest for databases and stored files;
• Passwords stored only as salted PBKDF2-SHA256 hashes, never in recoverable form;
• Role-based access controls limiting employee access to what is needed for their role;
• Multi-factor authentication on administrative and infrastructure accounts;
• Logging and monitoring of administrative access;
• Regular application of security patches and dependency updates;
• Periodic review of access permissions and vendor security posture.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. In the event of a data breach affecting your personal information, we will notify affected users and applicable regulators without undue delay and within the timeframes required by applicable law.

13. Your Rights

Subject to applicable law and verification of your identity, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your personal data, as described in Section 11;
• Port your data by receiving a copy in a structured, machine-readable format;
• Restrict or object to certain processing;
• Withdraw consent at any time where processing is based on consent;
• Opt out of marketing communications;
• Be free from discrimination for exercising any of these rights.

To exercise any right, email support@signitur.ai. We will respond within thirty (30) days, and will tell you if we need an extension permitted by law. An authorized agent may submit a request on your behalf with proof of authorization.

Residents of California and other U.S. states with comprehensive privacy laws. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act as amended, and we do not process sensitive personal information for purposes requiring a right to limit. You may exercise your rights to know, delete, correct, and opt out through the address above, and you may appeal a denied request by replying to our response.

Residents of the European Economic Area and United Kingdom. Our lawful bases for processing are: performance of a contract (providing the Service), legitimate interests (security, fraud prevention, service improvement), consent (marketing communications and non-essential cookies), and legal obligation (tax and compliance records). You have the right to lodge a complaint with your local supervisory authority.

14. Children's Privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children under 13, and we do not knowingly collect personal information from minors under 18 without appropriate consent.

If we learn that we have collected information from a child under 13, we will delete it promptly. Parents or guardians who believe we may hold such information should contact support@signitur.ai.

15. International Users

The Service is operated from the United States, and information we collect is processed and stored in the United States and in other countries where our service providers operate. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your country.

Where we transfer personal data from the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses, and we make those terms available to business customers on request. Payment data for customers in the EEA and United Kingdom is handled by Stripe Payments Europe, Ltd., established in Ireland, under Stripe's own data processing terms.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For material changes affecting how we use your personal information, we will provide notice by email or through the Service at least fourteen (14) days before the change takes effect.

We encourage you to review this page periodically. Your continued use of the Service after a change takes effect constitutes acceptance of the updated Policy.

17. Contact Information

Questions, requests, or complaints regarding this Privacy Policy may be directed to:

signitur
Central Media LLC
Orlando, Florida, United States
support@signitur.ai