Privacy Policy

Last Updated: September 29, 2026

Effective Date: December 31, 2025

1. Introduction

SignalBridge ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our server-side conversion tracking platform.

By using SignalBridge, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address: For account creation and communication
• Name: For personalization
• Password: Encrypted and stored securely via Clerk authentication
• Setup-call details: Booking time, status, and the name and email supplied to Cal.com when you choose to book onboarding

2.2 Integration Data

When you connect advertising platforms, we collect:

• Facebook Pixel ID: To identify your Facebook pixel
• Facebook Access Token: Encrypted OAuth token for API access
• Google Ads Customer ID: To identify your Google Ads account
• Google Ads Conversion Action ID: To specify which conversion to track
• Google Ads OAuth Tokens: Encrypted access and refresh tokens

When you authorize a Google integration, we use the permissions you grant to access the Google Ads accounts and conversion actions available to you, including their IDs, names, status, and counting settings. For features you enable, we may also access campaign details, advertising spend, and Google Analytics property information. We use this data to configure your chosen destinations, display reporting, attribute events, and check integration health. We store the account and destination configuration and the reporting data needed to provide those features; we do not access unrelated Google account content.

2.3 Conversion Event Data

When your website visitors trigger conversion events, we collect:

• Event name: (e.g., "Purchase", "Lead", "AddToCart")
• Event value: Monetary value of the conversion
• Currency: Currency code (e.g., USD, EUR)
• Order ID: For deduplication
• Timestamp: When the event occurred
• User data (when provided):
  • Email address (hashed before transmission)
  • Phone number (hashed before transmission)
  • First and last name (hashed before transmission)
  • Address information (city, state, zip, country)
• Technical data: IP address, user agent, referrer URL
• UTM parameters: Campaign tracking data

2.4 Usage Data

We automatically collect:

• Pages visited on our platform
• Features used
• Time spent on pages
• Browser type and version
• Device information
• Error logs and performance data

3. How We Use Your Information

3.1 Core Service Delivery

• Conversion Tracking: Upload conversion events to Facebook, Google Ads, TikTok, Taboola, Microsoft Ads, and Google Analytics 4 on your behalf
• Enhanced Conversions: Hash and transmit user data to improve attribution accuracy
• Analytics: Provide dashboards showing conversion performance
• Bot Filtering: Identify and filter bot traffic

For a Google Ads destination you connect, we send the website conversion events you configure and check Google's delivery responses. Where the Data Manager integration is enabled after authorization, we use it to submit those events and retrieve asynchronous request status so we can distinguish processing, accepted, partially accepted, and failed deliveries. Events may include event time, value, currency, transaction or submission ID, and advertising click identifiers. We include hashed email, phone, or supported address identifiers only when available and permitted by the website visitor's advertising consent. The Data Manager transport is not enabled for ordinary customer connections while its additional Google permission is pending verification.

3.2 Platform Improvement

• Monitor and improve service performance
• Debug and fix technical issues
• Develop new features
• Analyze usage patterns

3.3 Communication

• Send service updates and announcements
• Respond to support requests
• Send security alerts
• Provide account notifications

4. How We Share Your Information

4.1 Advertising Platforms

We share conversion data with the advertising platforms you connect:

• Facebook: Conversion events with hashed user data
• Google Ads: Customer-selected conversion events, including eligible consented, hashed identifiers when available, through the connected Google Ads integration or, where enabled, Google Data Manager
• Google Analytics 4: Events sent to the measurement destination you configure

Important: Where we send supported personal matching identifiers to an advertising platform, we normalize and hash them before transmission. We do not send plain-text email addresses, phone numbers, or names for Google Ads enhanced conversion matching. Other event fields, such as click IDs, timestamps, values, and currency, are sent in the form required by the selected destination.

Google account, campaign, conversion-action, and reporting data obtained through Google APIs is used only to provide the connected features you authorize and related support or security operations. We do not sell that Google data or use it for unrelated advertising or profiling. We do not share it with another advertising platform; our service providers listed below process it only as needed to operate SignalBridge. You can disconnect a Google integration in SignalBridge or revoke its access in your Google account.

4.2 Service Providers

We use the following third-party services:

• Clerk: Authentication and user management
• Supabase: Database hosting (PostgreSQL)
• Cloudflare: Edge computing and DDoS protection
• Tinybird: Analytics data processing (ClickHouse)
• Vercel: Web hosting and deployment
• Sentry: Error and performance monitoring
• Cal.com: Scheduling and calendar invitations for optional onboarding calls

4.3 Legal Requirements

We may disclose your information if required by law or to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or abuse
• Protect user safety

4.4 Business Transfers

If SignalBridge is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

5. Data Security

5.1 Security Measures

• Encryption at Rest: Sensitive data is protected at rest
• Encryption in Transit: Data is transmitted over HTTPS
• PII Hashing: Email, phone, and names hashed before transmission (SHA-256)
• Access Control: Row-level security in database
• DDoS Protection: Cloudflare protection against attacks
• Security Reviews: We regularly review and improve security controls

5.2 Data Isolation

Your data is isolated from other users through:

• User ID-based access control
• Database row-level security policies
• API authentication and authorization

6. Data Retention

6.1 Retention Periods

• Account Data: Retained while your account is active
• Merchant Analytics: Our plans offer detailed history for 6 months on Starter, 12 months on Growth, 24 months on Pro, and no plan-imposed historical limit on Ultra/Enterprise while the account remains active. We are aligning access and storage with those plan windows. For finite plans, we intend to preserve up to 24 months of underlying detail so upgrading can reveal eligible older history. Downgrading narrows what you can view but does not itself delete that underlying history; a former Ultra/Enterprise account also keeps its older history while active. Older event records may currently remain beyond the period shown in the dashboard. A shorter display window does not mean those records have been deleted. Specific valid erasure requests and account closure are handled separately below.
• OAuth Tokens: Retained until you disconnect the integration
• Logs: Retained for 30 days for debugging

6.2 Data Deletion

When you delete your account or disconnect an integration:

• OAuth tokens are immediately revoked and deleted
• We process requests to remove account and conversion-event data from active systems and revoke connected credentials. Some limited billing and deletion evidence may need to be retained where required by law or to prevent deleted data from reappearing. Please contact support for the status of a specific request; we do not promise that every active-system copy is removed within 30 days.
• Encrypted processor backups can persist after active-system deletion under the processor's documented schedule. Tinybird's automated backups may remain for up to 14 months from their creation. Backup copies are not used for ordinary analytics.

We are implementing a separate restore check so applicable deletions can be replayed and verified before an older backup is made available. This safeguard is not yet fully deployed, and removal from active analytics alone does not prove that every backup copy has been removed.

7. Your Rights

7.1 GDPR Rights (EU Users)

If you are in the European Union, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing of your data
• Withdraw Consent: Withdraw consent at any time

7.2 CCPA Rights (California Users)

If you are a California resident, you have the right to:

• Know: What personal information we collect and how we use it
• Delete: Request deletion of your personal information
• Opt-Out: Opt-out of the sale of personal information (Note: We do NOT sell personal information)
• Non-Discrimination: Not be discriminated against for exercising your rights

7.3 Exercising Your Rights

To exercise any of these rights, contact us at:

• Email: support@signalbridgedata.com
• Subject:Privacy Rights Request
• Response Time: Within 30 days

8. Cookies and Tracking

8.1 Cookies We Use

8.2 Google Consent Mode v2

We implement Google Consent Mode v2 to respect your privacy choices while still providing measurement and insights. When you reject marketing cookies:

• Google tags operate in a limited mode without using cookies
• Conversion data is sent without personal identifiers
• Your privacy choices are respected across all Google services

8.3 Third-Party Tracking

We use the following third-party services:

• Google Tag Manager / Google Analytics: Website measurement, governed by Google Consent Mode v2
• Meta Pixel, TikTok Pixel and VisitorTracking: Advertising measurement and visitor analytics, loaded only with your marketing consent where consent is required
• SignalBridge measurement pixel: Our own first-party pixel that measures the visits and sign-ups our marketing produces
• SignalBridge site statistics: Our own cookieless page-view statistics for the public pages of this website. For each page view we record the page, the referring site and campaign parameters, your approximate location (country, region and city derived from your IP address), your device, browser and language, and a pseudonymous visitor identifier: a keyed hash of your IP address and browser details that changes every day. We also record which buttons and links you click (for example sign-up buttons and outbound, download, phone and email links), how long a page stays in the foreground, how far you scroll, and how quickly the page loads and responds (standard web performance timings). These statistics set no cookies and store nothing on your device, we do not store your IP address in them, and the records are kept for up to 13 months. When you create an account, we link the visit that led to your sign-up to your account so we can understand which pages and campaigns produce sign-ups. The link is the same day's pseudonymous visitor identifier and, only if you accepted marketing cookies, your SignalBridge visitor identifier (_sb_vid), so that earlier visits from the same browser can be included. It is stored with your account record, not in the statistics, is visible only to our administrators, and is deleted when you delete your account. We do not record these statistics, and do not create this link, when your browser sends Do Not Track or Global Privacy Control, or when you decline analytics cookies in the cookie banner. We also count business events on our servers, such as a paid plan starting or ending or a trial expiring, together with the plan and the marketing channel that first brought the account, but without any account, email or visitor identifier. We rely on our legitimate interest in understanding how our website is used.
• FingerprintJS: A device identifier used while you are signed in to detect abuse of free trials and fraud
• Sentry: Error and performance monitoring. We do not record session replays.
• Chatwoot: In-app support chat
• Cal.com: Scheduling for optional onboarding calls you choose to book

8.4 Managing Your Cookie Preferences

You have full control over your cookie preferences:

• Cookie Banner: Choose your preferences when you first visit (EU/EEA/UK users only)
• Manage Preferences: Click the button at the top of this page to update your choices
• Browser Settings: You can also control cookies through your browser settings
• Consent Duration: Your preferences are stored for 13 months

9. Children's Privacy

SignalBridge is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) with service providers
• Compliance with GDPR and other data protection laws
• Encryption of data in transit and at rest

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification for material changes

Your continued use of SignalBridge after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Support: support@signalbridgedata.com
• Website: https://www.signalbridgedata.com