Privacy Policy
Last updated 12 July 2026
This Privacy Policy explains how SignOff ("SignOff", "we", "us", "our") collects, uses, shares and protects personal data when you use the SignOff platform, our website, and related services (together, the "Service"). It is written to meet our transparency obligations under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
SignOff is a multi-tenant SaaS platform that tracks and streamlines the approval of creative assets. It serves two broad groups of people: internal users (members of a customer organisation who hold an account), and external reviewers / clients (people who are invited to review a single asset through a secure magic link and who do not hold an account).
1\. Who we are and how to contact us
Data controller: Slide Five Limited, company number 17305425.
UK ICO Registration: ZC184447
Privacy contact: privacy@signoff-app.com.
For most personal data processed inside a customer organisation's workspace, that customer organisation is the controller and SignOff acts as its processor. Where we decide why and how data is processed (for example, account administration, billing, security and platform operation), we act as controller. Section 11 explains this split in more detail.
2\. The personal data we collect
Depending on how you interact with the Service, we process the following categories of personal data:
| Category | Examples |
|---|---|
| Account & profile data | Name, email address, organisation, platform role and organisation role, authentication identifiers (password hashes are held by our authentication provider; Google or Microsoft sign-in identifiers where used). |
| Authentication & security data | Multi-factor authentication (TOTP) enrolment status, session policy snapshots, one-time passcodes for reviewer verification, per-device verification cookies, and IP address and device information used to protect accounts. |
| Asset & review data | Creative assets and their versions, comments and feedback (including threaded replies and resolutions), reviewer assignments, approval decisions, and optional voice notes and their transcripts. These may contain personal data chosen by the uploading organisation. |
| External reviewer data | The email address a reviewer is invited at, the single asset they are assigned to, their decision and comments, and verification events. External reviewers do not hold an account. |
| Usage, audit & log data | Audit events recording lifecycle actions on assets and accounts, administrative activity logs, feature and usage metering, and technical logs needed to run and secure the Service. |
| Communications data | Transactional emails we send (and inbound email replies where you approve an asset by email), plus support correspondence. |
| Billing data | Subscription, plan and seat information. Where card payment is introduced, payment details are handled by a third-party payment processor and not stored by us. |
Optional AI features. Some features use a third-party AI provider (Google Gemini) to assist with tasks such as style checks, review summaries, voice-note transcription and triage of inbound email replies. These features are optional, are switched off unless your organisation enables them, and any output is advisory only. AI features never make an approval decision on their own.
Special category data. The Service is not designed to collect special category data (such as health, ethnicity or biometric data). Please do not upload special category data into assets, comments or voice notes unless your organisation has a lawful basis and an Article 9 condition for doing so.
3\. How we use personal data and our lawful bases
Under the UK GDPR we must have a lawful basis for each processing purpose. Our purposes and bases are:
| Purpose | Examples | Lawful basis |
|---|---|---|
| Providing the Service | Creating and administering accounts, running the approval workflow, hosting assets and comments, sending review invitations. | Performance of a contract; legitimate interests (operating the platform). |
| Security & access control | Authentication, MFA, magic-link token validation, forwarding prevention, audit logging, fraud and abuse prevention. | Legitimate interests; legal obligation (data security); recognised legitimate interests where applicable (e.g. safeguarding security). |
| Communications | Transactional emails (invitations, decisions, password and security messages) and support. | Performance of a contract; legitimate interests. |
| Optional AI assists | Style checks, summaries, transcription, inbound triage where enabled by your organisation. | Legitimate interests; or the customer organisation's chosen basis where it is the controller. |
| Billing & administration | Managing subscriptions, plans, seats and usage. | Performance of a contract; legitimate interests. |
| Legal & compliance | Meeting legal obligations, exercising or defending legal claims, responding to lawful requests. | Legal obligation; legitimate interests. |
| Service improvement | Diagnosing faults, understanding usage at an aggregate level, improving features. | Legitimate interests (improving and securing the Service). |
Where we rely on legitimate interests, we have considered your interests, rights and freedoms and concluded our processing does not override them. You can ask us for more detail about any balancing assessment. Where we rely on a recognised legitimate interest introduced by the Data (Use and Access) Act 2025, we do so only within the conditions that basis permits.
4\. Marketing and electronic communications
Most messages we send are transactional (for example, a review invitation or a decision notification) and are necessary to deliver the Service. We do not send marketing emails without an appropriate lawful basis under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Where consent is required, you may withdraw it at any time, and every marketing message includes an unsubscribe option.
5\. Cookies and similar technologies
We use a small number of strictly necessary cookies to keep you signed in, to remember session and security policy state, and to support reviewer forwarding-prevention. These are essential to the Service and, under current PECR rules, do not require consent. If we introduce analytics or other non-essential cookies, we will request consent (or rely on a relevant PECR exception) and provide controls in a separate Cookie Notice. Note that certain low-risk analytics cookies no longer require prior consent following the Data (Use and Access) Act 2025, provided you are given clear information and a means to opt out.
6\. How we share personal data
We do not sell personal data. We share it only as needed to run the Service:
- Within your organisation's workspace, with users who are entitled to see an asset (its uploader, assigned reviewers, and members of the relevant project), under strict access controls.
- Service providers (processors) who help us operate the platform, listed in Section 7.
- External reviewers, who receive access to the single asset they are invited to review and to comments marked as shared. Internal-only notes are never exposed to external reviewers.
- Professional advisers, auditors, regulators or authorities, where we are required or permitted by law.
- A buyer or successor in the event of a sale, merger or reorganisation of our business, subject to this Policy.
7\. Our sub-processors
We use a limited set of trusted providers to deliver the Service. The core providers are:
| Provider | Purpose | Notes |
|---|---|---|
| Supabase | Database (Postgres), authentication, file storage and realtime services - the system of record. | Asset files are held in a private storage area; downloads use short-lived signed links. Hosting region is currently Stockholm (EU). |
| Resend | Transactional email delivery and inbound email handling. | Used to send invitations, decisions and security messages. |
| Render | Application hosting (and a private document-conversion service for slide previews). | Hosting region is currently Frankfurt (EU). |
| Google (Gemini) | Optional AI assists, only where enabled. | Used only when your organisation switches the feature on. |
We put a written data processing agreement in place with each processor as required by Article 28 of the UK GDPR. We may add or change providers; an up-to-date list is available on request.
If you enable your own AI provider (BYO-AI) we will send data to your provider. By entering your API key for your AI provider you acknowkedge that you are responsible for assessing your AI provider's data handling.
8\. International data transfers
Our hosting and primary data storage are currently located in the European Union (Frankfurt & Stockholm). Some providers (for example, email and AI services) may process data outside the UK. Where personal data is transferred outside the UK, we rely on an appropriate safeguard - such as UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses - and we assess that the destination provides protection that is not materially lower than under UK law. You can ask us for details of the safeguard used for a particular transfer.
9\. How long we keep personal data
We keep personal data only as long as necessary for the purposes set out above:
- Account data is kept for the life of the account and for a reasonable period afterwards.
- Assets and versions are retained as a history while the account is active; we operate scheduled clean-up of certain deliverables. Soft-deleted items may be retained for a limited recovery window before permanent removal.
- Review tokens expire according to the link-validity settings configured by your organisation and are stored only in hashed form.
- Audit and administrative logs are retained for a defined period under our retention routines, then removed or anonymised.
Where you ask us to delete data, or where a customer organisation ends its contract, we will delete or anonymise personal data within a reasonable period, subject to any legal obligation to retain it.
10\. Your rights
Under the UK GDPR you have the right to: be informed; access your data; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing (including to processing based on legitimate interests); and rights relating to automated decision-making and profiling.
SignOff does not make solely automated decisions that produce legal or similarly significant effects about you. AI features are advisory and a person remains responsible for every approval decision.
To exercise your rights, contact us at privacy@signoff-app.com. If your personal data sits inside a customer organisation's workspace and that organisation is the controller, we will refer your request to them or assist them in responding. We will respond within one month, as required by law.
Complaints. If you have a concern we would like the chance to resolve it, so please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. In line with the Data (Use and Access) Act 2025, we operate a clear internal complaint-handling procedure for data protection concerns.
11\. Controller and processor roles
Because SignOff is multi-tenant, the same platform handles data under two different roles:
- SignOff as processor. For assets, comments, reviewer details and other content that a customer organisation puts into its workspace, the customer organisation is the controller and decides why and how that data is processed. SignOff processes it on the organisation's instructions under a data processing agreement.
- SignOff as controller. For account administration, authentication and security, billing, platform operation and improvement, and our own legal compliance, SignOff is the controller and this Policy governs that processing.
12\. How we protect personal data
Security is central to how SignOff is built. Our measures include:
- Database-enforced access controls, so that access to data is restricted at the data layer and not by application code alone.
- Tenant isolation, so each organisation's data is separated and access is scoped to that organisation.
- Private file storage with no public links; every file download is a short-lived, server-issued signed link granted only after an access check.
- Account-less external review: clients reach exactly one asset through a secure, single-purpose magic link, which is stored only as a hashed value.
- Optional forwarding prevention (a one-time passcode plus a per-device check) and domain restriction for review links.
- Optional multi-factor authentication and configurable session limits set by your organisation.
- Tamper-resistant, append-only audit logging of sensitive activity.
No system can be guaranteed completely secure, but we take appropriate technical and organisational measures and keep them under review. We will notify the ICO and affected individuals of a personal data breach where the law requires.
13\. Children
The Service is a business tool intended for use by organisations and their professional contacts. It is not directed at children, and we do not knowingly collect personal data from children. Where a service is likely to be accessed by children, we will apply age-appropriate measures consistent with ICO guidance.
14\. Changes to this Policy
We may update this Policy from time to time. When we make material changes we will update the effective date and, where appropriate, notify you. Continued use of the Service after an update means you have read the revised Policy.