Privacy policy

Data controller

• Owner: ACubero People Group, S.L.U.
• Tax ID (NIF): B93995322
• Registered office: Carrer des Figueral, 8, 07800 Eivissa (Illes Balears), España
• Registration: Registro Mercantil de Ibiza, sección 8, hoja IB-23626, inscripción 1.ª
• Email: hello@signaflow.example

Two different roles

SignaFlow processes personal data in two roles:

• As controller, for the people who subscribe to SignaFlow and use the dashboard (name, work email, billing details) and for anyone who writes to us.
• As processor, for the data each customer company uploads to its directory to build its signatures (its team’s names, job titles, departments, phones, emails and social profiles) and for the clicks on its banners. The customer company is the controller of that data, and we process it only to provide the service, following its instructions.

What we process and why

• Account and sign-in: the email you sign in with and, if you give it, your name. Used to send you the sign-in link (there are no passwords) and keep your session. Legal basis: the contract.
• Billing: payments are handled by Stripe. You enter your card details on Stripe’s page and they never reach SignaFlow; we keep the customer and subscription identifiers, the email and the subscription status. Legal basis: the contract and tax obligations.
• Service emails: welcome, sign-in links, invitations and notices about your account. Legal basis: the contract. We do not send advertising.
• Security: to stop abuse we limit attempts per IP address. The IP is not stored as such, but as an encrypted code that changes every day and is deleted shortly after. Legal basis: legitimate interest in protecting the service.
• Banner clicks: we store the campaign, the person whose signature it was, the date and time, and whether the click looks automated (a robot or a mail filter). We do not store the IP address or browser of whoever clicks.

How long we keep it

Account and directory data, while the subscription is active and afterwards for as long as needed to deal with possible liabilities. Billing data, for the period required by tax and commercial law (generally six years). You can ask us at any time to delete your company’s data by writing to hello@signaflow.example.

Who helps us provide the service

These providers process data on SignaFlow’s behalf, under contract and only as needed:

• OVHcloud: hosting of the server and database, in the European Union.
• Stripe: subscription payments and invoices.
• Resend: sending service emails, from servers in the European Union (Ireland).
• Google: only if the customer company connects its Google Workspace, to read its directory and publish signatures to its own Gmail accounts.

Stripe, Resend and Google are based in the United States. When data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Your rights

You can ask for access to your data, its rectification or erasure, object to or restrict its processing, or ask for its portability by writing to hello@signaflow.example. If your data was uploaded by your company to its directory, we will refer you to it, as it decides on that data.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Cookies

We use only one cookie, for the dashboard session. More in the cookie policy (/en/cookies).