Privacy Policy

1. Introduction

SignalSyncAds respect your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our SaaS platform.

Roles. For data you submit through the Service (such as conversion events forwarded on your behalf to ad platforms), Elaidy acts as a data processor on your behalf, and you act as the data controller. For data we collect about visitors to our own website and about your use of the Service (such as account information and usage logs), Elaidy acts as the data controller.

2. Information We Collect

• Account Information: Name, email address, password (hashed), company name, and payment information (processed via Paddle).
• Usage Data: Information about how you use the Service, including log files, IP address, browser type, device identifiers, and pages viewed.
• Client Data (Conversion Events): Data you send to us via our API for forwarding to ad platforms (e.g., conversion events). We hash sensitive identifiers (emails, phone numbers, names) before storage unless required for the core function of the Service.
• Support Data: Any information you share with us when you contact support, including the contents of emails and any diagnostic data you attach.
• Cookies and Similar Technologies: See our Cookie Policy for details on the cookies and trackers used on our website and Service.

3. How We Use Your Information

We use the collected information to provision the Service, process payments, improve our algorithms, comply with legal obligations, and communicate with you about your account.

• Service Delivery: To receive conversion events from your store, format them, and forward them to the ad platforms you have authorized (Meta, Google, and any others you connect).
• Account & Billing: To create and manage your account, process subscription payments via Paddle, and send billing notifications.
• Support and Communication: To respond to your requests, troubleshoot issues, and send you service-related announcements.
• Product Improvement: To analyze aggregate usage patterns, debug issues, and develop new features.
• Security and Fraud Prevention: To detect and prevent abuse, unauthorized access, and violations of our Terms.
• Legal Compliance: To comply with applicable laws, regulations, and valid legal processes.

4. Lawful Basis for Processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR:

• Contract: To provide the Service you signed up for and to manage your subscription.
• Legitimate Interests: To secure and improve the Service, prevent fraud, and analyze aggregate usage, where our interests are not overridden by your rights.
• Consent: For non-essential cookies, marketing emails, and any processing where we specifically ask for your consent. You can withdraw consent at any time.
• Legal Obligation: To comply with tax, accounting, and other legal requirements.

5. Disclosure of Your Information

We do not sell your personal data. We may share information with third-party vendors (e.g., Paddle for payments, cloud providers for hosting) who perform services on our behalf. We also share conversion data with the Ad Platforms (Meta, Google) strictly as instructed by you via your configuration.

Sub-processors

We use the following categories of sub-processors to deliver the Service. We require each sub-processor to process data only on our documented instructions and to protect it with appropriate technical and organizational measures.

• Paddle: Merchant of Record for subscription billing and tax collection.
• Meta Platforms, Inc.: Receives server-side conversion events for ad measurement and optimization, only for ad accounts you authorize.
• Google LLC: Receives server-side conversion events for Google Ads Enhanced Conversions, only for ad accounts you authorize.
• Cloud hosting provider: Hosts our application and database infrastructure (data center region: see Section 6).
• Email and transactional notification provider: Sends account, billing, and support emails on our behalf.
• Error monitoring and analytics provider: Collects aggregated, pseudonymized error and usage telemetry.

For a current list of named sub-processors, contact privacy@signalsyncads.com.

6. International Data Transfers

SignalSyncAds is operated from outside the European Economic Area, and our sub-processors may be located in different countries. When we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement, or other lawful transfer mechanisms recognized in the destination jurisdiction.

Note: the specific transfer mechanism and the data center region we operate in must be confirmed by counsel and reflected in this section before launch in the EEA or UK.

7. Data Retention

We retain conversion data for a period of 30 days (by default) to facilitate troubleshooting and deduplication, after which it is deleted or anonymized. Account information is retained as long as your account is active.

Retention schedule:

• Account data: Retained while your account is active and for up to 30 days after termination, then deleted.
• Conversion event payloads: Retained for up to 30 days for deduplication and debugging, then deleted or anonymized.
• Billing records: Retained for the period required by applicable tax and accounting law (typically 7 years).
• Support correspondence: Retained for up to 2 years for quality and training, then deleted or anonymized.
• Server logs: Retained for up to 90 days, then deleted or anonymized.

8. Security

We use administrative, technical, and physical security measures to help protect your personal information. These include encryption in transit (TLS), encryption of sensitive identifiers at rest, role-based access controls, and continuous monitoring of our infrastructure. However, no electronic transmission over the internet is 100% secure.

Incident Notification. In the event of a personal data breach affecting your account, we will notify you and the relevant supervisory authority without undue delay, and in any case within the timeframes required by applicable law (for example, 72 hours under the GDPR where applicable).

9. Your Rights

If you are in the EEA, the UK, or Switzerland (GDPR / UK GDPR), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request erasure of your data, subject to legal retention obligations.
• Restrict or object to processing in certain circumstances.
• Receive your data in a portable, machine-readable format (data portability).
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

If you are a California resident (CCPA / CPRA), you have the right to:

• Know what categories of personal information we collect and how we use them.
• Request access to and deletion of your personal information.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information. (See Section 10.)
• Limit the use and disclosure of sensitive personal information.
• Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, email privacy@signalsyncads.com. We will respond within the timeframes required by applicable law (typically 30 days under GDPR, 45 days under CCPA). We may need to verify your identity before processing your request.

10. Do Not Sell or Share My Personal Information

SignalSyncAds does not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the CCPA and CPRA. If our practices change, we will provide a clear opt-out mechanism and update this section before any such activity begins.

11. Children's Privacy

The Service is not directed to children under 16 years of age (or such other age as required by local law), and we do not knowingly collect personal information from children. If you believe we have collected information from a child in error, contact privacy@signalsyncads.com and we will delete it promptly. SignalSyncAds is not intended for use with child-directed websites or services subject to the U.S. Children's Online Privacy Protection Act (COPPA).

12. Automated Decision-Making

The Service does not make automated decisions that produce legal or similarly significant effects on individuals. The ad platforms you authorize may use the conversion events we forward to power their own optimization algorithms. For information about how Meta and Google use event data, please review their respective privacy policies and ad product terms.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you through the Service or by email. We encourage you to review this policy periodically.