Privacy Policy

Last updated: 12 October 2026. This policy explains what data Signguin (signguin.com) collects, why, who helps us process it, how long we keep it and what you can ask us to do with it. Short version: we only use your data to make and deliver your email signature, we never sell it, we don’t use advertising trackers and we don’t use your photo to train AI.

1. Who we are

Signguin is run by Dibsido.com s.r.o., Hlinky 995/70, Staré Brno, 603 00 Brno, Czech Republic, company ID 04779568, VAT ID CZ04779568 (“we”, “us”). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). Contact for anything about your data: hello@signguin.com.

2. What we collect and why

Data	Why we use it	Legal basis (GDPR)
Your work email address, entered when you start	To find your company’s website, logo and colours, to save your signature and to send you login links and messages about your signature.	Contract (Art. 6(1)(b)); for follow-up messages about your unfinished signature, legitimate interest (Art. 6(1)(f))
Signature details you type: name, job title, company, phone numbers, address, website, social and other links, button text, disclaimer	To build your signature. Without an account they stay in your browser only. With an account we store them so you can edit and reinstall your signature.	Contract (Art. 6(1)(b))
Your photo, logo and banner images	To show them in your signature. Signatures in email load images from our servers, so we host them. We remove location and other metadata from uploads and resize them.	Contract (Art. 6(1)(b))
Public data from the website you enter: logo, colours, contact details, social links	To pre-fill your signature. We read the public web page once when you ask us to.	Contract (Art. 6(1)(b))
Account and purchase records: email, sign-in sessions, whether you bought Premium, payment reference	To log you in, unlock Premium and keep accounting records.	Contract (Art. 6(1)(b)); legal obligation for accounting (Art. 6(1)(c))
Team waitlist: email and team size	To tell you when team signatures are available.	Consent (Art. 6(1)(a)); you can withdraw it at any time
Product news and tips	Only if you tick the box to receive them.	Consent (Art. 6(1)(a)); unsubscribe in any email
Anonymous usage events (for example “design chosen”, “signature copied”), with a random browser ID, language, the page you first arrived on and where you came from (the referring site or campaign tag), and no name or email	To understand which steps work and improve the product.	Legitimate interest (Art. 6(1)(f))
Technical data: IP address, browser, request logs	To run the service securely, prevent abuse (for example rate limits) and fix errors.	Legitimate interest (Art. 6(1)(f))

We do not sell your data, we do not show ads, and we do not use your photo or any of your content to train AI models.

3. Gmail access

Signguin does not connect to Gmail at the moment: you copy your signature and paste it into Gmail’s settings yourself. The optional “Add to Gmail automatically” feature is switched off. If we turn it back on, it works like this: when you choose it, Google asks you to allow the scope gmail.settings.basic. Everything then happens in your browser: Google gives the page a short-lived access token, your browser sets the signature on your default sending address with the Gmail API, and the permission is revoked right after. The token and your Gmail data (your send-as addresses and settings) never reach our servers, and we do not store them. We cannot read, send or delete your email and request no other Gmail access. You can also check or remove the permission at any time in your Google Account under “Third-party apps and services”.

Signguin’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. AI assistants (ChatGPT and other MCP apps)

Signguin can be used from AI assistants such as ChatGPT through our public MCP server. When you ask an assistant to make a signature, it sends us only the details it passes to our tool: name, job title, company, email, phone numbers, website, address and the design. We use them to draw the preview and send the result back to the assistant. We do not store them on our servers, and we do not receive your conversation.

The “Open in Signguin” link carries those details inside the link itself, signed so they can’t be changed, and it stops working after 7 days. Opening it fills in the editor; nothing is saved until you save it yourself. For rate limiting we keep your IP address and the anonymous user id the assistant sends briefly in server memory; they are never written to storage or logs. What the assistant itself does with your conversation is covered by its provider’s privacy policy (for ChatGPT, OpenAI’s).

5. Cookies and browser storage

Sign-in cookie (sid): keeps you logged in for up to 180 days after you sign in. Strictly necessary.
Browser storage (localStorage): your draft signature, a random ID for anonymous usage statistics and the page you first arrived on with where you came from. It never leaves your device except as described above, and you can clear it in your browser settings.

We use no advertising or cross-site tracking cookies, so we don’t show a cookie banner.

6. Who processes data for us

We use these service providers (processors). Each processes data only on our instructions and under a data processing agreement.

Vercel Inc. (USA): website hosting, image storage and anonymous visitor statistics (Vercel Web Analytics and Speed Insights: page views, page loading speed and a few anonymous steps such as sign-up, checkout and purchase, tagged with the page you first arrived on and where you came from. Vercel uses no cookies, stores nothing on your device and can’t identify you).
Neon Inc. (USA): database hosting.
Resend (USA): sending login and service emails.
Google LLC (USA): the Gmail connection, only if you use “Add to Gmail automatically” (currently switched off); and Google’s public favicon service, which we ask for a website’s icon when a site has no usable logo (it receives the website’s domain, not your data).
Functional Software, Inc. (Sentry) (USA): error reports from our servers, so we can fix problems. They contain technical details about the error, not your signature, cookies or IP address, and email addresses are masked.
Paddle.com Market Ltd (UK): when you buy Premium, Paddle sells it to you as our reseller (merchant of record). Paddle handles payment, invoices and tax under its own privacy policy, and tells us your email address, country and what you bought so we can activate Premium. We never see or store your card number.

Where data is transferred outside the European Economic Area, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

7. How long we keep data

Login links expire after 30 minutes.
Your account, saved signatures and uploaded images: until you delete them or ask us to delete your account.
An email address you entered without creating an account: deleted 24 months after you last used Signguin.
Anonymous usage events: 24 months.
Team waitlist entries: until we launch team signatures and tell you, or until you ask us to remove you.
Purchase and invoicing records: as long as accounting and tax law requires (in the Czech Republic, up to 10 years).

Images in signatures you have already sent are loaded from our servers when someone opens your email. If an image is deleted (for example when your account is deleted at your request), it no longer shows in those emails.

8. Your rights

Under the GDPR you have the right to:

get a copy of your data and information about how we use it (access);
have incorrect data corrected;
have your data deleted;
restrict processing or object to processing based on legitimate interest;
receive your data in a machine-readable format (portability);
withdraw consent at any time, without affecting earlier processing.

You can delete saved signatures yourself under “My signatures”. For anything else email hello@signguin.com; we reply within one month. You can also complain to a data protection authority, in the Czech Republic the Office for Personal Data Protection (uoou.gov.cz), or the authority where you live or work.

9. Security

All connections use HTTPS. Login links and sessions are stored only as one-way hashes, login links work once, and access to production systems is limited to people who need it. Dibsido.com s.r.o. is certified to ISO/IEC 27001.

10. Children

Signguin is meant for work email and is not directed at children under 16.

11. Changes

If we change this policy, we update the date at the top. For significant changes we tell account holders by email before they take effect.