Privacy Policy

This policy explains what Signalpath (operated by Deterministic Inc.) collects, why, and your choices.

1. What we collect

• Account data: your email address (for login and transactional email), your name if you provide it, and your team/workspace.
• Login data: magic codes/links we generate, session tokens, timestamps — to authenticate you and prevent abuse.
• Work data you provide: leads (names, titles, companies, emails, profile identifiers), signals, messages and enrollment activity your team creates or connects.
• Discovery data: your search keywords and the public job postings we index from public job boards for the companies you track.
• Connected mailbox credentials: if you connect a mailbox for the drafts flow, we store your app password encrypted at rest (AES-256-GCM) and use it only to create drafts on your behalf.
• Billing data: handled by Stripe — we store your Stripe customer ID and plan, never raw card numbers.
• Usage/logs: request logs and diagnostics needed to run and secure the service.

2. Email we send, and recipient choices

• To you: transactional email — login codes, account and billing notices.
• To your outreach recipients: only the messages your sequences produce. If you use the drafts flow, the email is created in your own mailbox and you send it yourself. If you don't connect a mailbox, outreach is sent on your behalf through our email provider using your sender identity.
• Every outreach email carries sender identification and a one-click unsubscribe link. When a recipient unsubscribes, we record the opt-out and stop contacting them; recipients can also reply asking to be removed.

3. What we don't do

• We don't sell your data.
• We don't use your team's leads or messages to train AI models.
• We don't send your recipients anything you didn't configure.

4. Third-party processors

• Resend — delivers transactional email to you and outreach email on your behalf (when you don't use the drafts flow).
• Stripe — payment processing.
• OpenAI (or configured gateway) — message personalization; your lead context is sent to generate drafts.
• Unipile (or alternative connectivity provider) — operates connected LinkedIn accounts.
• Neon / cloud hosting — data storage and infrastructure.

Each processes data only as needed to provide its function. We'll keep this list current.

5. Lawful basis & purposes (GDPR framing)

We process account and login data to perform our contract with you (or pre-contractual steps at signup), and logs for legitimate interests in security and service integrity. You're the controller of the lead data you import or generate, and of the outreach you send; we act as processor on your instructions. Recipients of outreach you send should expect their data (name, email, message history with you) to be processed by us as your processor.

6. Retention

• Account and billing records: for the life of the account plus any legally required period.
• Leads, signals and messages: until you delete them or close your team's account.
• Unsubscribe records: retained so we can honor opt-outs across any future re-contact attempts.
• Login codes: short-lived (minutes); sessions until logout or expiry.

7. Your rights

Depending on your jurisdiction: access, correction, deletion, portability, and objection. Email [email protected] and we'll respond within 30 days. If you're in the EU/EEA you can also complain to your local data-protection authority.

8. Security

Data is encrypted in transit (TLS). Stored credentials (mailbox app passwords) are encrypted at rest with AES-256-GCM using keys we manage separately from the data. Access is limited to what's needed to run the service. No system is perfectly secure — we'll notify you of any breach as required by law.

9. International transfers

Our processors may operate outside your country; transfers rely on appropriate safeguards (e.g. EU Standard Contractual Clauses) where applicable.

10. Changes

We'll notify you of material changes by email or in-app notice before they take effect.