Privacy notice
How [YOUR COMPANY] handles personal data in SignatureSync.
Last updated [DATE]
This is a template. Replace every highlighted placeholder and have it reviewed by a lawyer before you rely on it.
Who we are
SignatureSync is operated by [YOUR COMPANY], [ADDRESS]. For privacy questions, contact [PRIVACY CONTACT EMAIL].
For the directory data of your staff, your organization is the controller and we process it on your behalf to provide the service. For the admins who sign in to SignatureSync, we are the controller of their sign-in and audit records.
What we collect
- Directory profile fields from Microsoft Entra ID that signatures use, including profile photos.
- Fields people choose to add in the self-service portal.
- Admin sign-ins, roles and an audit log of changes, including IP addresses.
- A record of each signature request from the Outlook add-in: sender, time, outcome and size. Never the message, its subject or its recipients.
The full list, and what we never collect, is on the Security page.
Why we use it
- To build and apply each person’s email signature (performing our contract with your organization).
- To keep the service secure and show admins what changed (legitimate interests).
- To contact admins about the service, such as outages or changes to these terms.
We don’t sell personal data, use it for advertising, or use it to train AI models.
Who we share it with
- Our hosting provider, [HOSTING PROVIDER], which stores the data in [REGION].
- Microsoft, as part of signing in and reading your directory with the permissions you approve.
- Authorities, only when the law requires it.
How long we keep it
- Directory data: while your organization stays connected. Users removed in Entra ID stop being shown.
- Audit log: 365 days.
- After your organization disconnects, we delete its data within [NUMBER] days of a written request, or [NUMBER] days after the subscription ends.
Your rights
Depending on where you live, you can ask to see, correct, delete or export your personal data, or object to how we use it. Staff should usually ask their own IT team first, since most fields come from your organization’s directory. Otherwise email [PRIVACY CONTACT EMAIL]. You can also complain to your data protection authority.
Changes
We’ll post changes here and tell admins by email before significant changes take effect.