Privacy Policy
Last updated: 6 November 2026
Controller: Ben Lev (sole trader), trading as SIGNAL (“SIGNAL”, “we”, “us”, “our”)
Registered / business address: available on request
Privacy contact: benbarlev.business@gmail.com
Service: SIGNAL at https://signal-founder-flow.base44.app — a B2B SaaS AI personal-branding assistant for SaaS founders.
This Privacy Policy explains how we collect, use, store, share, and delete personal data when you visit our website or use SIGNAL. It is written to align with the EU/UK GDPR and, for users in Israel, the Israeli Privacy Protection Law (and related regulations). Where those regimes differ, we apply the stricter obligation that applies to you.
Payment for subscriptions is processed by our online reseller Paddle.com, which is the Merchant of Record. Paddle’s processing of payment and billing data is also described in Paddle’s Privacy Notice.
1. Who is responsible
Ben Lev (sole trader), trading as SIGNAL, is the data controller for personal data processed to operate the SIGNAL product and website (account, workspace content you create, product analytics we configure, support emails).
Processors / subprocessors (acting on our instructions or as independent controllers where noted):
| Party | Role |
|---|---|
| Base44 (hosting / app platform) | Hosts the SIGNAL application, authentication, databases, file storage, background functions, and OAuth connector infrastructure. Processes data as a processor for us; also operates platform analytics / visitor tracking as described in our Cookie Notice. |
| Paddle.com (and its contracting entities) | Merchant of Record / reseller for paid subscriptions. Independent controller (and/or processor as applicable) for checkout, tax, invoices, payment methods, subscriptions, refunds, and buyer support. |
| AI model providers (DeepSeek; Base44's built-in AI as fallback) | Process founder content (your notes, evidence, drafts, prompts and workspace context) that we send server-side to generate drafts, research summaries and assistant replies. We minimise personal data sent to them: only the workspace content needed for the task, never payment data, passwords or OAuth tokens. API keys are never put in the browser. Providers may change; we will update this list. |
| Connected-account providers (e.g. LinkedIn, GitHub, Notion, and others you choose) | Independent controllers of your account on their platforms. When you connect them to SIGNAL, we receive tokens and profile (and, where implemented, content) according to the scopes you approve. |
| Professional advisers, hosting CDN/edge, email delivery, and competent authorities | Only as needed to run the business, comply with law, or defend legal claims. |
We do not sell your personal data.
2. Data we collect
2.1 Account & identity
- Name, email address, password or SSO identifiers, role (
admin/user), authentication and MFA-related data. - Workspace membership (owner / admin / member / viewer) and IDs linking you to workspaces.
2.2 Billing & subscription (via Paddle + our records)
- Plan selected (Builder / Founder / Studio), subscription status (
trialing,active,past_due,canceled, etc.), trial end, cancel-at-period-end flags, Paddle/customer/subscription identifiers we store inSubscriptionAccess/ checkout attempt records, and emails associated with the subscription. - Card and payment details are collected by Paddle, not by SIGNAL. We do not store full card numbers.
2.3 Workspace & product content you create or import
SIGNAL stores structured records in your private workspace, including (entity names as implemented):
- Workspace / WorkspaceSettings / WorkspaceMember — company name, website, industry, target customers, goals, memory toggles, membership.
- CompanyResearch / StrategyDocument — researched company facts, strategy docs, source URLs.
- WorkEvent / EvidenceSource / Story / Opportunity — work events, evidence URLs/titles, story angles, opportunity notes, confidentiality flags (
private/public). - ContentDraft / ApprovalRequest — draft posts (LinkedIn, X, article, email), digests, approval status and snapshots.
- VoiceProfile / UserMemory / WorkspaceMemory — voice presets and guidance; personal and workspace memories you save.
- Conversation / ChatMessage — chat titles and message content with the in-product assistant.
- BrandMetric / AgentEvent / AuditLog / UsageLedger — brand metrics you log, agent run messages, audit actions, AI usage/token cost ledgers.
- ModelRegistry (admin) — which AI models are enabled (not customer content).
2.4 Connected accounts (OAuth)
You may connect third-party accounts. Today the product implements live app-user OAuth for:
| Provider | What we access in practice today |
|---|---|
| Profile identity via LinkedIn userinfo (e.g. name / email display) and permission intended for posting to your own account. | |
| GitHub | Profile (/user) — e.g. login handle; intended use includes repository/release context for story discovery. |
| Notion | Bot/workspace identity (/users/me); access limited to pages you share during consent. |
Other catalogue entries (Gmail, Google Calendar, YouTube, Instagram, TikTok, Facebook Pages, etc.) may appear in the UI as setup cards; they require additional OAuth app configuration before they import data. Per-user X is not supported on the current Base44 connector mode.
OAuth access tokens are held by the Base44 connector layer (retrieved server-side as connection.accessToken for profile checks). Tokens are not meant to be exposed to the browser. You can disconnect a provider in-product.
2.5 AI processing inputs/outputs
When features run (chat, company research from a website, strategy generation, drafting, opportunity detection, brand director messages, etc.), we send workspace-scoped context and your prompts to AI providers server-side. Founder content is therefore processed by third-party AI providers, currently DeepSeek, with Base44's built-in AI as a fallback. We minimise the personal data we send: only the content needed for the task, never payment details, passwords or access tokens. Outputs (drafts, summaries, suggestions) are stored back in your workspace entities. AI outputs may be inaccurate; see Terms.
2.6 Technical, security & usage data
- IP address, device/browser metadata, timestamps, error logs.
- Auth tokens in browser storage (see Cookie Notice).
- Platform analytics / referrer cookies when Base44 analytics or visitor tracking is on (see Cookie Notice).
- UsageLedger entries (task, model, token counts, estimated cost) for metering.
2.7 Communications
Support and privacy emails you send to benbarlev.business@gmail.com, and transactional messages about the product or (via Paddle) billing.
We do not knowingly collect data from children (see §11).
3. Purposes and legal bases
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide the service | Account, workspace, drafts, approvals, connections, AI features you invoke | Contract (Art. 6(1)(b)) |
| Security & abuse prevention | Auth, audit logs, rate limits, fraud checks | Legitimate interests (Art. 6(1)(f)); legal obligation where applicable |
| Billing & subscription access | Trial/subscription status, entitlements | Contract; Paddle processes payments under its terms |
| Product analytics & referral attribution | Base44 analytics / referrer cookies | Consent where required; otherwise legitimate interests for essential product metrics — we will move non-essential tracking behind consent where required |
| Improve SIGNAL | Aggregate feature reliability, model cost monitoring | Legitimate interests |
| Legal compliance | Tax, accounting, responding to lawful requests, Privacy Protection Law / GDPR rights | Legal obligation (Art. 6(1)(c)) |
| Support | Answering your emails | Contract / legitimate interests |
Where Israeli law requires consent or another basis for a processing activity, we will obtain or rely on that basis as applicable.
4. Sharing
We share personal data only with:
- Subprocessors listed in §1 (Base44, AI providers, infrastructure).
- Paddle for checkout, subscriptions, invoices, tax, refunds, and buyer support (Merchant of Record).
- Connected-account providers when you authorize a connection (to complete OAuth and API calls you initiate).
- Advisers / authorities when required by law or to protect rights, safety, and security.
Workspace data is isolated per workspace with server-checked membership / owner rules. We do not use your private founder content to train a public model for other customers.
5. International transfers
SIGNAL is offered globally. Data may be processed in countries outside your own (including where Base44, Paddle, or AI providers operate). For EEA/UK personal data transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs), the UK IDTA, and/or an adequacy decision, as provided by our processors’ terms. Contact us for a copy of relevant transfer mechanisms we can share.
6. Retention
| Category | Retention (current practice / target) |
|---|---|
| Account & workspace content | Kept while your account/workspace exists and as needed to provide the service |
| Subscription / billing records we store | Kept for the subscription lifecycle and for tax/accounting periods required by law |
| AuditLog / UsageLedger | Kept for security, metering, and dispute resolution; subject to future automated retention jobs (not yet implemented — see gaps) |
| Chat / memories | Until you delete individual items or request account/workspace deletion |
| OAuth tokens | Until you disconnect the provider or the token expires/is revoked |
| Marketing/analytics cookies | Per Cookie Notice (referrer cookies ≈ 30 days Max-Age) |
| Support emails | As long as needed to resolve the request and meet legal retention |
Automated retention, full workspace wipe, and self-serve account deletion are not yet fully implemented in-product. Until then, email benbarlev.business@gmail.com to request deletion or export (see §7). We will complete verified requests within one month (extendable as permitted by law).
7. Your rights
Depending on your location, you may have the right to:
- Access your personal data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”)
- Restriction of processing
- Portability (machine-readable copy of data you provided)
- Object to processing based on legitimate interests
- Withdraw consent where processing is consent-based (without affecting prior lawful processing)
- Complain to a supervisory authority (EEA/UK) or to the Israeli Privacy Protection Authority for Israeli law matters
How to request: email benbarlev.business@gmail.com from your account email with the subject “Privacy request”, stating which right you wish to exercise and enough detail to locate your account. We may need to verify your identity.
In-product today: you can edit company profile/voice settings, delete individual memories, export currently loaded memories as JSON, disconnect OAuth providers, and manage drafts/approvals. Full account export and one-click account deletion are not yet available (see our Settings → Data handling note).
We respond within one month of a verified request, unless law allows a further extension.
8. Security
We use industry-standard measures appropriate to a SaaS product: TLS in transit, platform access controls, row-level / membership checks on workspace data, server-side AI calls (no provider keys in the browser), and OAuth tokens retrieved server-side. No method of transmission or storage is 100% secure; please use a strong unique password and enable MFA when offered.
9. Cookies and local storage
See our separate Cookie Notice. Summary: essential auth storage is required; Base44 analytics / visitor-tracking cookies may be set and should be consent-gated where required by law.
10. AI-specific transparency
- AI is used to research public/company URLs you supply, draft personal-brand content, suggest opportunities, and chat about your workspace.
- Inputs can include your prompts plus workspace-scoped records (voice, memories, events, drafts, research).
- Outputs may be wrong, incomplete, or generic; you must review before publishing.
- Do not submit special-category data or third-party personal data unless you have a lawful basis and the third party expects it.
11. Children
SIGNAL is a B2B product for founders and professionals. It is not directed at children under 16 (or the higher age required in your country). We do not knowingly collect children’s data. Contact us to delete any such data if discovered.
12. Changes
We may update this Policy. Material changes will be posted on this page with a new “Last updated” date and, where required, notified by email or in-product notice.
13. Contact
Ben Lev (sole trader) · SIGNAL
Business address: available on request
benbarlev.business@gmail.com
Billing / payment privacy: Paddle — paddle.com/legal/privacy · buyer support paddle.net