Sigbot complies with applicable privacy laws, including: UK GDPR & Data Protection Act 2018, EU GDPR, and Canada PIPEDA.
Where Sigbot processes personal data as a Processor, the terms of our Data Processing Addendum apply.
If you have never used Sigbot but your details are in the contact book of someone who does — for example because you exchanged emails with them — see If your details are in Sigbot for what is kept, where, and how to have it removed.
Account Data: Name, email address, login credentials, whether two-step verification is on, subscription status. If you sign in with Microsoft or Apple (or Google, where offered), the identity that provider confirms; signing in this way grants identity only and does not give Sigbot access to your mailbox.
Contact Data (Customer-provided): Names, email addresses, phone numbers, job titles, company names, and other details extracted from email signature blocks in connected inboxes.
To find the signature, Sigbot reads each email in memory. It does not store or index email bodies, subjects, recipients or attachments: only the contact details from the signature block are kept, with a one-way hash of each message id so that a message is not scanned twice.
Enquiry Data: if you use the booking or contact form on sigbot.co, or email us: your name, email address, company, phone number, message and preferred times, and the page you wrote from. The form stores your enquiry in our database in the EU, emails it to our support mailbox (Microsoft 365) through Resend, and sends you a short confirmation that does not repeat what you wrote. To limit abuse, a one-way hash of your IP address is kept for one day. If you book a call through the calendar on the booking page instead, Calendly collects your name, email address, the time you pick and anything you add to the booking, and adds the call to our Microsoft 365 calendar.
Security Data: to keep accounts and the service secure, our sign-in service (Google Identity Platform) logs each sign-in, sign-up and account change with the email address used, your IP address, browser details and whether it succeeded, and our servers log the requests they receive, with IP addresses. Sigbot's own logs shorten any email address they mention to its first character and domain. Section 11 says how long each is kept.
People we contact about Sigbot: we contact people at construction firms and other businesses whose work Sigbot could help, by email and on LinkedIn, and by text or phone when you agreed to it through an introduction. For this we keep your name, job title, employer, work email address, work phone number if your company publishes it or you agreed to share it through an introduction, the address of your LinkedIn profile, where and when we found each detail, and the messages and call notes between us. We find these details on your company's website, in business and trade-association directories, on LinkedIn and, for UK businesses, in the business-contact database Apollo.io, or from someone who knows us both and checked you were happy to hear from us, and our first message tells you which. Our lawful basis is legitimate interests: telling businesses about a product that is relevant to their work. In the UK we send unsolicited email only to limited companies and LLPs, never to sole traders or ordinary partnerships; in Canada, only to addresses that you or your firm have published, or that someone who knows us both passed on with your agreement, and only about your role. To stop hearing from us, reply “stop”, use the unsubscribe link in any of our emails, or write to legal@sigbot.co: we stop within two working days and keep your address on a do-not-contact list so that it is never added again. If you never reply, we delete your details 6 months after our last message; if we have talked, 24 months after our last contact. For Canadian addresses we keep a record of where we found the address for 3 years after our last message, to show we were allowed to write. The tools we use to send these emails and keep these notes process your details for us under data protection agreements.
Your public contact card (optional): if you choose to publish a contact card, the details you enter for it — such as your name, job title, company, phone numbers, email address, website and location — are shown on a web page at sigbot.app/c/… that anyone with the link or your QR code can open and save to their address book. The page is not listed anywhere and asks search engines not to index it. You can edit or unpublish the card at any time in the app, and it is deleted with your account. When someone opens a card, we record anonymous usage events (for example, that a card was viewed or saved). The card page sets no cookies and stores nothing on the visitor's device, and our analytics provider is set not to keep their IP address. To prevent abuse, we keep a pseudonymised key derived from the visitor's IP address for up to a day; the secret it is derived with changes every day and is deleted after two. Like any website, the page's hosting and cloud providers (Vercel and Google Cloud) log each request, including the IP address and the page address; Sigbot's copy of these logs in Google Cloud is kept for 30 days. Every card has a link for reporting one that looks wrong, and we can take a card down.
Usage Data: which pages of sigbot.co and the web app are viewed and which of Sigbot's features are used — for example, that a scan finished and how many contacts it filed. In the web app these events are linked to your account id, never your email address, and never include contact data. See Section 6.
Signature-block text is processed using third-party artificial-intelligence models to identify and structure contact details. Only the extracted signature zone — not the message body, subject, recipients or attachments — is sent server-side to Anthropic PBC's Claude API for parsing, capped at 4,000 characters per message. Images captured with the business-card scanner are sent to Google Cloud Vision's EU endpoint for optical character recognition, which processes them in the European Union; the app then reads the contact details from that text itself. With AI parsing on, Sigbot can also classify a contact's company by sector by sending the text of the company's public website to Claude. These providers process the data solely to provide the extraction service to us, under data protection agreements, and are listed as subprocessors in our Data Processing Addendum.
Neither provider uses this data to train its models. Google Cloud Vision processes card images in memory and does not keep them. Under Anthropic's commercial terms, Anthropic does not train on what Sigbot sends to its API and deletes it within 30 days, unless Anthropic's safety systems flag it — it may then be kept for up to 2 years — or the law requires it to be kept longer.
AI parsing can be switched off for your account (Account details → Privacy → Use AI to read signatures) and, by the team owner, for a team's scans (Admin console → Settings → AI parsing for team scans). When it is off, Sigbot's built-in parser runs alone and nothing from your inbox leaves the platform.
Sigbot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Sigbot uses secure cloud infrastructure (including Google Cloud Platform and Firebase) to provide device synchronisation, backups, team collaboration, and real-time database features. Contact data is stored in the European Union (Google Cloud Firestore, eur3) and processed in London (europe-west2). Sign-in data is held by Firebase Authentication, which Google states runs from data centres in the United States. Data may be cached locally and stored in the cloud.
The Sigbot mobile apps process the same data described above and add the following, each only when you choose to use the feature. No device permission is required to use the app.
The iOS app contains no advertising or tracking SDKs and does not track you across other companies' apps or websites. Subscriptions are purchased on our website and honoured in the app. You can delete your account, including all contacts and team memberships, from Profile → Delete Account in the app.
We rely on contractual necessity (to provide the Services), legitimate interests (security, improving the Services through the analytics in Section 6, and telling businesses about Sigbot, as described under People we contact about Sigbot), legal obligations, and consent where required by law.
Data may be transferred outside the UK/EU/Canada. We rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, and adequacy decisions, as detailed in our Data Processing Addendum.
We implement encryption in transit (TLS), encryption at rest, application-level encryption of mailbox tokens, access controls, OAuth-based authentication where supported, two-step verification, and monitoring systems. Full details are available on our Security Overview page.
Everything else is erased automatically on the schedule below. Deleting your account erases all of it at once, after your subscription is cancelled, except the logs, which age out on their own schedule; copies in backups age out within 14 days.
| Data | Kept for |
|---|---|
| Contact records | Until you delete them, then 30 days in Trash (restorable), then erased. Delete permanently erases at once. |
| Records another member removed from a team folder | 30 days (restorable), then erased |
| Review-queue entries you rejected | 180 days |
| Scan coverage hashes (SHA-256 of message ids; no content) | 180 days |
| Cached signature parses | 90 days |
| Scan job records | 90 days |
| Done-for-you build orders that were never paid (a saved brief or an application) | 90 days from when it was last saved or approved; 1 year for a Tell me when Gmail is ready request. A paid order is kept as a billing record. |
| Throttle counters | 1 day |
| OAuth sign-in state | 10 minutes |
| Mailbox tokens | Until you disconnect the mailbox. Google grants are revoked at Google immediately; Microsoft tokens are deleted at once, with a link to revoke the grant in your Microsoft account. |
| Application logs, and the sign-in service's log of each sign-in, sign-up and account change | 30 days |
| Security logs: refused and failed sign-ins, sign-ups and requests (with the email address and IP address used), failed mailbox connections, reads of stored secrets, and staff and administrative actions | 400 days |
| Admin-activity logs | 400 days |
| Product analytics linked to your account | Until you delete your account; a request for PostHog to erase them is then queued |
| Your public contact card | Shown publicly until you unpublish it; the details stay in your account until you change them or delete your account |
| Contact-card visitors' pseudonymised rate-limit keys | 1 day (the daily secret they are derived with: 2 days) |
| Details of people we contact about Sigbot | 6 months after our last message if you never replied; 24 months after our last contact if we have talked. Where we found a Canadian address: 3 years after our last message. A do-not-contact entry is kept so that we never contact you again. |
The same schedule, with more detail, is on our Security Overview.
Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. Two of these are self-serve in the app: Download my data (Account details → Your data) gives you a JSON archive of your account and a CSV of your contacts, and Delete account (Account details → Danger zone) erases your account and all associated data at once — see Delete your account. For anything else, including requests about data held in someone else's account, contact legal@sigbot.co.
Sigbot is not intended for individuals under 18. We do not knowingly collect personal data from children.
You may lodge a complaint with a supervisory authority: UK ICO, an EU Data Protection Authority, or the Office of the Privacy Commissioner of Canada, depending on your location.
We may update this Privacy Policy periodically. We will post the updated version with a new "Last updated" date and provide notice of material changes.
Sigbot is provided by SIGBOT LTD, registered in England and Wales (company no. 16997653), 5 Willow Green, West End, Woking GU24 9HR, United Kingdom. We are registered with the UK Information Commissioner's Office as a data controller, registration number ZC202535.
Our privacy lead handles privacy questions and requests to exercise your rights: legal@sigbot.co. We are not required to appoint a statutory data protection officer, because our core activities do not involve large-scale regular and systematic monitoring of individuals or large-scale processing of special category data; we will review this as Sigbot grows.
General enquiries: support@sigbot.co. Security: security@sigbot.co.