1. Who We Are
Signalbuy is a trading brand of Vantage Effect Limited, company number 16423690, registered office 92 High Street, Irthlingborough, NN9 5PX ("Signalbuy", "we", "us", "our").
Privacy Contact: rob.lucas@signalbuy.ai
2. Our Role in Data Processing
As Data Controller: We act as a Data Controller for personal data collected from visitors to our website, leads, and merchant account users (e.g., account registration details, billing contact details, and platform usage).
As Data Processor: When processing end-shopper information through a merchant's e-commerce store via our application or widget, the merchant acts as the Data Controller, and Signalbuy acts as the Data Processor. Shopper requests regarding store data should be directed to the relevant merchant.
3. Shopper Information We Process
When operating as a Data Processor on behalf of merchants, Signalbuy processes:
Session identifiers and Shopify visitor identifiers
Logged-in status
On-site navigation data: product views, search queries, cart updates, and checkout interactions
Selected intent signals and shopper query text submitted through the Service
Data Isolation & Profiling: Signalbuy does not perform cross-merchant shopper tracking, nor do we combine data across stores to create universal shopper profiles.
4. Lawful Basis for Processing (Controller Data)
Where Signalbuy acts as a Data Controller, we rely on the following lawful bases under UK GDPR:
Contractual Necessity: To provide, manage, and bill for subscriber accounts.
Legitimate Interests: To secure, improve, and optimize our platform, and to communicate with prospective merchant clients.
Legal Obligation: To comply with statutory accounting and tax obligations.
5. Local Storage and First-Party Identifiers
Signalbuy does not set third-party tracking cookies within the e-commerce widget. Signalbuy reads existing Shopify first-party identifiers and utilises limited browser local storage strictly necessary for the technical functionality and continuity of the active session.
6. AI Architecture & Security Boundaries
Infrastructure: Signalbuy utilizes Amazon Web Services (AWS) Bedrock for AI functionality.
Privacy by Design: Personal identifiers, shopper contact information, and payment details are strictly excluded from AI prompts and model inputs by design.
No Model Training: Neither merchant data nor shopper interactions are used to train external or general-purpose AI models.
7. Data Security and Storage
We implement robust technical and organizational measures to safeguard data, including:
Hosting on secure AWS cloud infrastructure
End-to-end encryption in transit (TLS) and at rest (AES-256)
Logical tenant separation ensuring merchant data isolation
Strict role-based access controls
8. International Data Transfers
Where personal data is transferred or accessed outside the UK or European Economic Area (EEA)—such as via cloud infrastructure providers—we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses.
9. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
Shopper Session & Behavioural Data: Retained for [e.g., 30–90 days / the duration of the active merchant subscription] to provide analytics, after which it is deleted or anonymised.
Merchant Account & Technical Records: Retained for the duration of the commercial agreement, plus up to 6 years for financial, legal, and audit compliance.
10. Your Rights
Under UK data protection law, individuals have rights regarding their personal data, including the right to:
Access, correct, or request erasure of personal data
Restrict or object to processing
Request data portability
To exercise these rights regarding Controller data, contact rob.lucas@signalbuy.ai. Where Signalbuy acts as a Processor for a merchant store, requests should be submitted directly to the merchant.
11. Complaints and Supervisory Authority
You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to address your concerns before you approach the ICO.