Privacy Policy

Who we are

SignalDeck is a social media publishing, approval, and reporting service operated by AuraOne, Inc., a Delaware corporation ("SignalDeck", "we", "us"). This policy covers the marketing site at signaldeck.us, the product at app.signaldeck.us, the API at api.signaldeck.us, the MCP server at mcp.signaldeck.us, link-in-bio pages at link.signaldeck.us, and client approval and report links we send. Contact us about privacy at [email protected].

Our role: controller and processor

We are the controller of the data we need to run your account: who you are, how you sign in, billing, security logs, and how you use the product. For the content your organization puts into SignalDeck (posts, media, approvals, inbox messages, client details, and analytics from connected social accounts), your organization is the controller and we process it on its behalf under our Terms of Service and Data Processing Addendum. If you are a client reviewer or a member of someone else's organization, questions about that content should go to the organization that invited you; we will help them respond.

Data we collect

We collect only what we need to provide and secure the service:

Account data: name, email address, organization and workspace names, role, profile image, time zone, and preferences.
Sign-in data: a hashed password if you set one (scrypt; we never store the password itself), one-time magic-link tokens (stored hashed), and, if you sign in with Google or Microsoft, the account identifier, email address, name, and profile picture that provider shares with us. We request only the openid, email, and profile scopes for sign-in.
Connected social accounts: when you connect LinkedIn, Instagram, Facebook, YouTube, TikTok, Pinterest, X, or another network, we receive the account's identifier, handle, display name, and the access tokens needed to publish and read results. Tokens are encrypted at rest and are used only for the actions you or your team approve.
Workspace content: drafts, posts and their versions, captions, links, comments, approval decisions and comments, schedules, publishing receipts, inbox messages and replies, link-in-bio pages, reports, notes, and campaign records.
Media: images, video, and documents you upload or import, with file metadata (name, type, size, dimensions, checksums), rights and consent records you attach, and derived renditions. Uploaded files are scanned for malware.
Analytics from networks: post and account metrics the networks return, such as impressions, reach, engagement, and follower counts.
Billing data: plan, invoices, billing contact, and payment status. Card details are collected and held by our payment processor, Stripe; we do not see or store full card numbers.
Developer data: API key names, scopes, prefixes, and hashes (the full key is shown once and never stored), webhook endpoints, OAuth applications, and MCP or API request records.
Technical and security data: IP address, browser and device details, request logs, audit logs of actions taken in the product, error reports, and rate-limit and abuse-prevention signals.
Communications: emails and support requests you send us, and records of the transactional emails we send you.
Marketing site analytics: described in the website analytics section below.

How we use data

We use personal data to:

Provide the service: create and manage accounts, run approvals, publish approved posts to the accounts you connect, read back results, import inbox messages, generate reports, and host link-in-bio pages.
Secure the service: authenticate users, enforce roles and workspace boundaries, detect and prevent abuse, fraud, and unauthorized access, and keep audit records.
Operate AI features you choose to use, such as drafting captions or replies (see the AI features section).
Bill you and keep tax and accounting records.
Send transactional messages: sign-in links, invitations, approval requests, publishing alerts, security notices, and billing notices.
Provide support, investigate problems, and improve reliability and performance.
Comply with law, enforce our terms, and protect the rights and safety of users and the public.

We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use your workspace content, connected-account data, or Google user data to train AI models.

Legal bases (EEA, UK, and Switzerland)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the service you or your organization signed up for); legitimate interests (to secure the service, prevent abuse, improve reliability, and communicate about the service, balanced against your rights); consent (for optional marketing site analytics, which you can refuse); and legal obligation (tax, accounting, and responding to lawful requests).

Google user data

SignalDeck's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

Google sign-in (openid, email, profile): used only to create your account and sign you in.
Google Drive import (drive.file): when you choose files in the Google Picker, we receive access to only those files, download them into your media library, and do not access any other files in your Drive. The short-lived access token is used in your browser for that import and is not stored on our servers.
YouTube (through the account you connect): used only to publish the videos your team approves and to read back their status and metrics.
We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your consent, for security or abuse investigations, to comply with law, or when it has been aggregated and anonymized for internal operations.

When you connect a social account, you authorize SignalDeck to act for that account within the permissions you grant. We publish only posts that have been approved in SignalDeck, check that the connected account is still the intended account before each publish, and record a receipt of what was sent. Content you publish becomes subject to that network's own terms and privacy policy. You can disconnect an account in SignalDeck at any time, and you can also revoke access from the network's own settings (for example, Google Account permissions, X connected apps, or Meta business integrations). We stop using a token once it is disconnected or revoked.

AI features

Optional AI features, such as caption drafting, reply suggestions, and media descriptions, send the relevant prompt and content to Kiro Prism, the AI gateway we use, which routes the request to a model provider to generate a response. AI output is a draft: it is never published or sent without a person approving it. We do not use your content to train AI models.

We share personal data only as follows:

Within your organization: with the members, clients, and reviewers your organization invites, according to the roles it assigns.
With the social networks you connect, to publish the content you approve and to retrieve results.
With service providers (subprocessors) that host, secure, and run SignalDeck under contracts that limit their use of the data to providing services to us. The current list is on our subprocessors page.
For legal reasons: to comply with law or valid legal process, to protect the rights, property, or safety of SignalDeck, our users, or others, or to enforce our terms.
In a business transfer: if SignalDeck or AuraOne, Inc. is involved in a merger, acquisition, financing, or sale of assets, subject to this policy's protections.
With your direction or consent, for example when you connect an integration or share a report link.

Website analytics

On the public marketing site at signaldeck.us we use Google Analytics 4, provided by Google, to measure page views, traffic sources, and how the site is used, and Microsoft Clarity, provided by Microsoft, for usage analytics, heatmaps, and session replay that show how visitors scroll, click, and move through pages. Both set cookies or similar identifiers and receive information such as the pages you visit, your interactions, the referring site, device and browser details, and an approximate location derived from your IP address. Google and Microsoft process this data under their own privacy terms. These scripts load only on the production marketing site; the SignalDeck product does not load them.

Your analytics choices

If your browser sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, the marketing site does not load Google Analytics or Microsoft Clarity, so neither sets cookies or records your visit. You can also block or delete cookies in your browser settings, and Google offers a browser add-on that opts you out of Google Analytics on every site. Our cookie disclosure lists the cookies we use.

Security

We protect data with TLS for all traffic, encryption at rest for databases and object storage, separate encryption for social account tokens and other provider credentials, secrets held in a managed key vault, private networking for databases and caches, role-based access with workspace isolation, hashed passwords, API keys, and sign-in tokens, malware scanning of uploads, rate limiting, and audit logs of sensitive actions. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and the relevant authorities as the law requires. Report security issues to [email protected].

Where data is stored and international transfers

SignalDeck is hosted in the United States (Microsoft Azure, Central US region), with files stored in Cloudflare R2 and traffic served through Cloudflare's global network. If you are outside the United States, your data will be transferred to and processed in the United States. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, and we require our subprocessors to do the same.

How long we keep data

We keep personal data only as long as needed for the purposes in this policy:

Account and workspace data: for as long as the account or organization is active. After an owner requests deletion or the organization is closed, we delete or anonymize it within 30 days, and it leaves our backups within a further 35 days.
Connected-account tokens: until you disconnect the account, the network revokes access, or the organization is deleted.
Media: until deleted by your team or the organization is deleted.
Sign-in links and sessions: they expire and stop working; sign-in links work only once.
Security, audit, and publishing receipt records: up to 7 years where needed for security, dispute resolution, or legal obligations.
Invoices and tax records: as long as tax and accounting law requires, typically 7 years.
Marketing site analytics: according to Google Analytics and Microsoft Clarity retention settings, at most 14 months.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. California residents have the rights to know, delete, correct, and opt out of sale or sharing (we do not sell or share personal data) and to not be discriminated against for exercising these rights. You can:

Update your profile and sign-in methods in Settings.
Disconnect social accounts and revoke API keys at any time.
As an organization owner, export workspace data and request deletion of the organization from Settings or through the API.
Email [email protected] for any other request. We will verify your identity and respond within 30 days (45 days where California law allows). You may use an authorized agent; we may ask for proof of their authority.

If your data is in an organization's workspace, we may refer your request to that organization, as it controls that content.

Children

SignalDeck is a business service and is not directed to children. You must be at least 16 years old (or the age of digital consent where you live, if higher) to use it. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the effective date. If a change materially affects how we use personal data, we will notify account owners by email or in the product before it takes effect.

Contact

AuraOne, Inc., operator of SignalDeck. Privacy requests and questions: [email protected]. Security reports: [email protected].