Sigbot for Outlook — Privacy notice

Summary

This notice covers Sigbot for Outlook, the Sigbot add-in for Microsoft Outlook, provided by Sigbot Ltd (company no. 16997653, England and Wales). It adds to our Privacy Policy, which applies to all of Sigbot and to the add-in.

What the add-in reads

Only the email you have open, through Outlook's ReadItem permission: its sender, the date and the message text. The add-in reads the signature inside Outlook on your device. It cannot read your other emails, your calendar or your address book, and it cannot send or change anything in your mailbox.

What is sent to Sigbot

Nothing, until you sign in and act. The email itself — its text, subject, recipients and attachments — is never sent to Sigbot, and no artificial-intelligence service sees it.
When you sign in: your Sigbot email and password go to our sign-in service (Google Firebase Authentication), as on sigbot.app. With Continue with Microsoft, Microsoft gives the add-in a token that confirms which Microsoft account you are using; our servers check it and do not keep it.
To check for a duplicate: the email address on the card, to look it up in your own Sigbot contacts.
When you save: the contact details on the card, which ones you edited, the email's date (so older emails never overwrite newer details) and the folder you chose. They are stored in your Sigbot account like a contact you add on sigbot.app, and handled as described in our Privacy Policy and Data Processing Addendum.

What is kept

Microsoft sign-in link: if you choose Use Microsoft sign-in next time, we keep a one-way hash of your Microsoft account's identifiers with your Sigbot account id, so the add-in can sign you in. No email address, name or token is kept. It is deleted when you choose Sign out and forget Microsoft sign-in or delete your Sigbot account.
On your device: your Sigbot sign-in (kept by Firebase Authentication in Outlook's browser storage, separately for each Outlook account) and Microsoft's sign-in cache, as on any Microsoft sign-in.

Who processes it

Google Cloud and Firebase (sign-in, database and servers; data stored in the EU and processed in London) and Microsoft (your Microsoft sign-in). The add-in's files are served from sigbot.co (GitHub Pages). The add-in uses no analytics or advertising.

Your choices and rights