Privacy Policy

Last updated: September 3, 2026

This policy explains how Dotco Technologies LLC ("Dotco Technologies", "we") handles personal information in connection with the Signal service at signalstrm.com (the "Service").

Two different roles. For information about visitors to our website and the people who administer a workspace, we are the "controller" and this policy governs. For the data a customer loads into their CRM about their own contacts and deals ("Customer Data"), the customer is the controller and we are a "processor" acting on their instructions — see our Data Processing Addendum. If you are one of a customer's contacts, please direct requests to that customer.

1. Information we collect

a. Information you provide

Account data: name, email address, and profile details from the Google account you use to sign in, and the workspace/organization names you create. Authentication is handled by Clerk; we receive identifiers and basic profile fields, not your Google password.
Billing data: billing contact, company name, and transaction history. Card details are collected and stored by Stripe, not by us.
Support and communications: messages you send to us and their contents.
Customer Data: records you enter into the CRM (advertisers, contacts, deals, notes, activity). We process this on your behalf under the DPA.

b. Information collected automatically

Log and device data: IP address, browser type, pages viewed, referring page, and timestamps, collected by our hosting provider for security and reliability.
Analytics data: if you consent to analytics cookies, Google Analytics 4 collects pseudonymous usage events, approximate (city-level) location derived from IP, and device/browser information. IP anonymization is enabled. You can decline or withdraw consent at any time via the "Cookie preferences" link in the footer. See our Cookie Policy.
Essential cookies: set by Clerk to keep you signed in and to protect against fraud and abuse. These are required for the Service to work.

2. How we use information

To provide, operate, secure, and support the Service.
To authenticate users and manage workspaces, roles, and permissions.
To process payments and manage subscriptions.
To communicate with you about the Service, including service announcements, security alerts, and billing notices (these are transactional and you cannot opt out while you have an account).
To understand and improve how the Service is used (analytics), where you have consented.
To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Acceptable Use Policy.
To comply with legal obligations and to establish or defend legal claims.

3. Legal bases (EEA/UK)

Where the EU or UK GDPR applies, we rely on: contract (to provide the Service to account holders); legitimate interests (to secure and improve the Service, and for direct business communications), balanced against your rights; consent (for analytics cookies); and legal obligation (for tax, accounting, and lawful requests).

4. How we share information

We do not sell personal information. We share it only as follows:

Service providers / subprocessors who process data on our behalf under contract — hosting, database, authentication, payments, and analytics. The current list is on our Subprocessors page.
Within your workspace: account and activity information is visible to other members of your workspace according to their role.
Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, property, or safety of Dotco Technologies, our users, or the public.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy or notice of any change.

5. International transfers

We and our subprocessors are located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. Where required, transfers of personal data out of the EEA, UK, or Switzerland are made under the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

6. Data retention

Account data: kept while your account is active and for up to 90 days after closure, then deleted or anonymized, except where a longer period is required by law.
Customer Data: kept for the subscription term. After termination you may request an export within 30 days; we then delete it, subject to routine backup cycles which are overwritten within 90 days.
Billing records: retained as required by tax and accounting law (generally up to 7 years).
Analytics data: retained per the Google Analytics retention setting (14 months) and then automatically deleted.

7. Security

We use encryption in transit (TLS), access controls, tenant isolation at the application layer, managed infrastructure with regular patching, and least- privilege access for our personnel. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. To report a vulnerability, email security@signalstrm.com.

8. Your rights

Everyone

You can access and update most account information in the Service, or by emailing privacy@signalstrm.com. You can withdraw analytics-cookie consent at any time via "Cookie preferences" in the footer.

EEA / UK

You have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to lodge a complaint with your supervisory authority. Where processing is based on consent, you may withdraw it without affecting prior processing.

California (CCPA/CPRA)

California residents have the right to know what personal information we collect, use, and disclose; to request deletion or correction; and to be free from discrimination for exercising these rights. In the preceding 12 months we collected the categories described in Section 1 (identifiers, commercial information, internet activity, and inferences) for the business purposes in Section 2, and disclosed them to the service providers in Section 4. We do not sell or "share" personal information as those terms are defined under the CPRA, and we do not knowingly process the personal information of anyone under 16. To exercise a right, email privacy@signalstrm.com. We will verify your request against information we hold and respond within the statutory period. You may use an authorized agent.

We aim to respond to all rights requests within 30 days (or 45 days for CCPA, extendable as permitted). We may need to verify your identity first.

9. Children

The Service is for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact privacy@signalstrm.com.

10. Changes to this policy

We may update this policy. If a change is material we will notify account holders by email or an in-Service notice before it takes effect. The "last updated" date above always reflects the current version.

11. Contact us

Privacy questions and requests: privacy@signalstrm.com
Dotco Technologies LLC · to be completed