Privacy Policy

1. Introduction

Welcome to ReviewSignal.ai ("ReviewSignal", "we", "us", or "our"). We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the German Federal Data Protection Act (Bundesdatenschutzgesetz, "BDSG"), and all other applicable data protection legislation.

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website at reviewsignal.ai, use our API services, or interact with us through email or other communication channels.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please refrain from using our services and contact us to exercise your rights as described in Section 7.

2. Data Controller

The data controller responsible for the processing of your personal data is:

As the data controller, we determine the purposes and means of processing personal data and are responsible for ensuring that all processing activities comply with applicable data protection laws.

3. What Data We Collect

We collect and process personal data from several categories of individuals. The scope and type of data collected depends on your relationship with ReviewSignal.

3.1 Website Visitors

When you visit our website, we may collect the following data:

• Technical data: IP address (anonymized), browser type, operating system, screen resolution, and referring URL
• Usage data: Pages visited, time spent on pages, click events, and scroll depth
• Device data: Device type, language preference, and time zone

We do not use tracking cookies or third-party analytics services that profile individual users. See Section 9 (Cookies) for details.

3.2 API Clients and Subscribers

When you register for our services or subscribe to a plan, we collect:

• Identity data: Full name, job title, and company name
• Contact data: Business email address, phone number (optional), and business address
• Account data: Username, hashed password, API keys, and account preferences
• Billing data: Payment method details (processed and stored by Stripe; we do not store full card numbers), billing address, invoice history, and subscription tier
• Usage data: API call logs, endpoints accessed, request timestamps, data volume consumed, and feature usage patterns

3.3 Email Recipients (B2B Outreach)

As part of our business-to-business (B2B) sales and marketing activities, we may process the following data about professionals at prospective client organizations:

• Professional contact data: Business email address, full name, job title, company name, company size, and industry
• Professional profile data: LinkedIn profile URL (publicly available), seniority level, and department
• Engagement data: Email open/click events, reply status, and meeting bookings

This data is sourced from third-party business intelligence platforms (see Section 6) and is processed under our legitimate interest in B2B marketing. You may opt out of these communications at any time (see Section 7).

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Service Delivery

• Providing access to our API and dashboard
• Processing and fulfilling subscription orders
• Generating and delivering sentiment analysis reports
• Managing your account, authentication, and access permissions
• Providing technical support and troubleshooting

4.2 Analytics and Service Improvement

• Monitoring API performance, uptime, and error rates
• Understanding aggregate usage patterns to improve our products
• Detecting and preventing abuse, fraud, and security threats
• Conducting internal research and development

4.3 Communication

• Sending transactional emails (account confirmations, invoices, security alerts)
• Delivering product updates and service notifications
• Conducting B2B outreach to prospective clients at relevant organizations
• Responding to inquiries, support requests, and feedback

4.4 Legal and Compliance

• Complying with legal obligations (e.g., tax, accounting, anti-fraud regulations)
• Establishing, exercising, or defending legal claims
• Responding to lawful requests from public authorities

5. Legal Basis for Processing

Under Article 6 of the GDPR, we process personal data on the following legal bases:

Legitimate Interest Assessment (B2B Outreach)

We have conducted a Legitimate Interest Assessment (LIA) for our B2B outreach activities in accordance with Article 6(1)(f) of the GDPR and Recital 47. Our assessment concluded that:

• Purpose: We contact professionals at hedge funds, asset management firms, and financial institutions who may benefit from our alternative data services. This is a narrowly targeted, industry-specific outreach.
• Necessity: Direct B2B communication is an essential and standard means of introducing specialized financial data products to relevant decision-makers.
• Balancing test: We only process publicly available professional contact data. The outreach is relevant to the recipients' professional roles and responsibilities. We provide a clear and easy opt-out mechanism in every communication. We do not contact individuals who have opted out. The volume of our outreach is measured and non-intrusive.

If you believe our legitimate interest does not apply to your specific situation, you have the right to object at any time (see Section 7).

6. Data Sources

In accordance with Article 14 of the GDPR, we are transparent about the sources from which we obtain personal data, particularly when data is not collected directly from the data subject.

6.1 Apollo.io (B2B Lead Generation)

We use Apollo.io, a third-party business intelligence platform, to source professional contact information for our B2B outreach activities. Apollo.io aggregates publicly available business data from sources including:

• Public professional profiles (e.g., LinkedIn public data)
• Company websites and public directories
• Publicly filed corporate records
• Business information databases

The categories of data obtained from Apollo.io include: business email addresses, full names, job titles, company names, company size, industry classification, and professional social media profile URLs.

Apollo.io maintains its own GDPR compliance program. For more information, please refer to Apollo.io's Privacy Policy.

6.2 Directly from You

We collect data directly from you when you:

• Register for an account or subscribe to our services
• Contact us via email or other communication channels
• Fill out forms on our website
• Respond to our communications

6.3 Automated Collection

We automatically collect limited technical data when you visit our website through server logs and essential cookies (see Section 9).

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data. You may exercise any of these rights free of charge by contacting us at team@reviewsignal.ai.

7.1 Right of Access (Article 15)

You have the right to obtain confirmation as to whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed, the purposes of processing, the categories of data concerned, and the recipients or categories of recipients.

7.2 Right to Rectification (Article 16)

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data without undue delay.

7.3 Right to Erasure (Article 17)

You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, when you object to processing and there are no overriding legitimate grounds, or when the data has been unlawfully processed. We will comply with erasure requests within 30 days unless a legal obligation requires us to retain the data.

7.4 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV), and to transmit that data to another controller without hindrance.

7.5 Right to Restriction of Processing (Article 18)

You have the right to request the restriction of processing where you contest the accuracy of the data, where the processing is unlawful, where we no longer need the data but you require it for legal claims, or where you have objected to processing pending verification.

7.6 Right to Object (Article 21)

You have the right to object to the processing of your personal data at any time when processing is based on legitimate interests, including for direct marketing purposes. Upon receiving your objection, we will cease processing your data for those purposes unless we demonstrate compelling legitimate grounds that override your interests.

7.7 Right to Withdraw Consent (Article 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates the GDPR. See Section 8 for supervisory authority details.

8. GDPR Compliance

ReviewSignal is committed to full compliance with the General Data Protection Regulation (GDPR) and all applicable German data protection laws. Below we describe the technical and organizational measures we have implemented to safeguard your personal data.

8.1 Data Protection Measures

• Encryption in transit: All data transmitted between your browser or API client and our servers is encrypted using TLS 1.2 or higher.
• Encryption at rest: Personal data stored in our databases is encrypted at rest using AES-256 encryption provided by Google Cloud Platform.
• Access controls: We implement role-based access control (RBAC) with the principle of least privilege. Only authorized personnel with a legitimate business need may access personal data.
• Authentication: All API access is secured with API key authentication. Internal systems use JWT-based authentication with bcrypt password hashing.
• Pseudonymization: Where possible, we pseudonymize personal data to reduce privacy risk.
• Regular security audits: We conduct periodic security assessments of our infrastructure and code.
• Data minimization: We only collect personal data that is strictly necessary for the stated purposes.
• Incident response: We maintain a data breach notification process and will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, as required by Article 33 of the GDPR.

8.2 Data Protection Officer (DPO)

For all questions and requests relating to data protection and privacy, please contact our data protection team:

8.3 Supervisory Authority

As a Hessen-based entity, our competent supervisory authority is:

You have the right to lodge a complaint with the Hessische Beauftragte für Datenschutz und Informationsfreiheit or any other EU supervisory authority if you believe your data protection rights have been violated.

8.4 Records of Processing Activities

In compliance with Article 30 of the GDPR, we maintain comprehensive records of all processing activities, including the purposes of processing, categories of data subjects and personal data, categories of recipients, data transfers, retention periods, and technical and organizational security measures.

8.5 Data Protection Impact Assessments

Where a type of processing is likely to result in a high risk to the rights and freedoms of individuals, we conduct Data Protection Impact Assessments (DPIAs) in accordance with Article 35 of the GDPR prior to commencing such processing.

9. Cookies

ReviewSignal takes a privacy-first approach to cookies. We use only strictly essential cookies that are necessary for the technical operation of our website and services.

9.1 Essential Cookies

Essential cookies are required for core website functionality and cannot be disabled. These include:

9.2 What We Do Not Use

• We do not use third-party tracking cookies (e.g., Google Analytics, Facebook Pixel)
• We do not use advertising or retargeting cookies
• We do not engage in cross-site behavioral tracking
• We do not share cookie data with any third parties

Because we only use strictly essential cookies, a cookie consent banner is not required under GDPR Article 5(3) of the ePrivacy Directive and the German TTDSG (Telekommunikation-Telemedien-Datenschutz-Gesetz).

10. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention periods are:

After the applicable retention period expires, personal data is securely deleted or irreversibly anonymized. You may request earlier deletion at any time by exercising your Right to Erasure (see Section 7.3).

11. International Data Transfers

ReviewSignal is committed to keeping your data within the European Union. Our infrastructure is designed to ensure that personal data does not leave the EU/EEA.

Specifically:

• Database servers: PostgreSQL databases are hosted in GCP europe-west3 (Frankfurt)
• Application servers: All API and application workloads run in GCP europe-west3 (Frankfurt)
• Cache layer: Redis instances are co-located in the same region
• Backups: Database backups are stored within the EU

In the limited case where a third-party service provider processes data outside the EU/EEA (e.g., Stripe for payment processing), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the service provider's certification under an adequacy decision.

12. Subscription Cancellation & Refund Policy

We believe in transparent and fair subscription management. Below is our complete cancellation and refund policy.

12.1 How to Cancel

• Self-service: Cancel anytime with one click from your account dashboard under Settings > Subscription > Cancel Plan.
• Email: Send a cancellation request to team@reviewsignal.ai from the email address associated with your account. We will process your request within one (1) business day.

No questions asked. No hidden retention flows. No phone calls required.

12.2 Effective Date of Cancellation

Cancellation takes effect at the end of your current billing period. You will retain full access to all features and data until the end of the period you have already paid for.

12.3 Refund Policy

• No partial refunds are issued for unused days remaining in a billing period.
• If you cancel mid-cycle, your subscription remains active until the end of the billing period.
• In exceptional circumstances (e.g., prolonged service outages attributable to ReviewSignal), we may issue pro-rata credits at our discretion.

12.4 Free Trial

We offer a 14-day free trial for eligible new accounts. If you cancel within the trial period, you will not be charged. No credit card is required to start a trial. If you do not cancel before the trial expires, your selected subscription plan will activate and billing will commence.

12.5 Data After Cancellation

• Data export: You may export your data (reports, API usage history, and account information) for 30 days after cancellation. Data is available in JSON and CSV formats via the dashboard or by request.
• Data deletion: After the 30-day export window, your account data is scheduled for deletion in accordance with our standard retention periods (see Section 10).
• Immediate deletion: You may request full and immediate deletion of all your personal data at any time under GDPR Article 17 (Right to Erasure) by emailing team@reviewsignal.ai. We will process deletion requests within 30 days.

12.6 Reactivation

If you wish to reactivate your account within 30 days of cancellation, your data and settings may be restored upon request. After 30 days, you will need to create a new account.

13. Third-Party Services

We use a limited number of third-party service providers to operate our platform. Each provider is contractually bound to process data only on our instructions and in compliance with GDPR requirements (Article 28 - Data Processing Agreements).

We regularly review our third-party providers to ensure ongoing compliance with GDPR and our data protection standards. We do not sell, rent, or trade personal data to any third party.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or regulatory guidance. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post the revised policy on our website
• Notify active clients and subscribers via email if the changes materially affect how we process their personal data

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes your acknowledgment of the updated policy. If you do not agree with the revised policy, you may discontinue use of our services and request deletion of your data.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact us: