Privacy Policy

Who we are

SIGNAL is a social media analytics product operated by Crypto Accountants ("we", "us"). Our main business site is https://cryptoaccountants.live. SIGNAL itself is served from https://signal-sync-live.netlify.app.

For the personal data described below, Crypto Accountants is the data controller. Where you connect a social account and we read analytics belonging to your organisation, we act as a processor on your instructions.

Questions, requests and complaints: hamza@cryptoaccountants.live.

What we collect

Account data. Your email address, your name, and a password hash. We never store your password itself.

Workspace data. The brands you create, their timezone, currency and industry, and the people you invite along with their role.

Connected account data. When you connect a social account we store the platform account identifier, the handle, the display name, the avatar URL and the follower count, plus access and refresh tokens.

Analytics data. For accounts you connect, we retrieve posts you have published and their performance metrics: impressions, reach, likes, comments, shares, saves, clicks, video views and watch time. We store these so you can see history and trends.

Operational data. Sync timestamps, API call counts and error messages, used to show you connection health and to diagnose failures.

What we do not collect

We do not read your private messages unless you explicitly connect the inbox feature, and then only conversations the platform API exposes for accounts you administer.

We do not collect data about other people's accounts beyond what is already public, and only for competitors you deliberately add to a watchlist.

We do not use your content to train machine learning models.

We do not sell personal data. We do not share it with advertisers. There is no advertising on SIGNAL.

Why we are allowed to process it

Contract. Account, workspace and connected-account data are necessary to provide the service you signed up for.

Consent. Connecting a social account is an explicit act with a platform consent screen listing exactly which permissions are requested. You can withdraw it at any time by disconnecting the account here, or by revoking access in the platform's own settings.

Legitimate interests. Operational logs, for keeping the service working and secure. We keep these minimal and short-lived.

How access tokens are stored

Access and refresh tokens are held in Supabase Vault, encrypted at rest. They are never returned by any API we expose, and there is deliberately no route that can hand a token back to a browser — including to you.

Tokens are used only to make the API calls needed for the features you have enabled. When you disconnect an account, its tokens are deleted from the vault rather than merely marked inactive.

Who else sees your data

Supabase — database, authentication and token storage. Data is held in the region selected for our project.

Netlify — application hosting and content delivery.

The social platforms you choose to connect — Meta (Instagram, Facebook, Threads), LinkedIn, TikTok, X, Pinterest, YouTube and Google Business Profile. Data flows from them to us, under their terms and the permissions you granted.

Nobody else. We use no advertising networks, no data brokers, and no third-party analytics that would receive your personal data.

How long we keep it

Account and workspace data: for as long as your account exists.

Analytics data: subject to the retention period of your plan. Where a plan sets a retention window, older rows are removed automatically.

Tokens: until you disconnect the account or delete your workspace, whichever comes first.

Operational logs: 90 days.

After account deletion, data is removed within 30 days except where we are legally required to retain records.

Your rights

Under UK and EU data protection law you can ask for a copy of your data, correction of anything inaccurate, deletion, restriction of processing, or portability, and you can object to processing based on legitimate interests.

Email hamza@cryptoaccountants.live and we will respond within one month.

You can also complain to the UK Information Commissioner's Office at ico.org.uk. We would rather you came to us first, but it is your right either way.

Cookies

We set a session cookie so you stay signed in, and a cookie remembering which brand you are viewing. Both are strictly necessary for the product to work.

We set no advertising or third-party tracking cookies. See the Cookie Policy for the full list.

International transfers

Our infrastructure providers may process data outside the UK. Where that happens, transfers rely on the UK International Data Transfer Addendum or Standard Contractual Clauses.

Children

SIGNAL is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

Changes

If we change this policy in a way that materially affects you, we will tell you by email before it takes effect rather than quietly updating the date at the top.