Privacy Policy

Your account

When you create an account we collect your email address, your name, and your workspace name. If you sign in with Google, Google gives us your name and email address. We use these to sign you in, run your account and send you emails about it, such as sign-in links and important changes. Legal basis: providing the service you signed up for (contract).

We also send product emails, such as help getting started and news about SignalBox, including founder pricing, through MailerLite. MailerLite receives your name and email address. Every email has an unsubscribe link. Legal basis: our legitimate interest in helping you get the most from SignalBox.

Your contacts and what you record about them

You choose what to keep about the people in your network: names, email addresses, phone numbers, LinkedIn and Instagram profile links, profile photos, companies and job titles, circles, follow-up dates, notes, logged interactions, deals, products and referrals. This is stored in your workspace and only used to provide SignalBox to you. We process it on your behalf; we do not use it for our own purposes, sell it or share it with anyone except the service providers listed below.

Email

If you connect your Gmail account, we store your Gmail address and a Gmail app password, encrypted, so SignalBox can send the emails you write from it and check for replies. Once a day, and when you ask, SignalBox reads the headers of new messages in your inbox to find replies to emails sent from SignalBox in the last 60 days. Only those replies are saved, on the contact's timeline; everything else in your inbox is ignored and not stored. The emails you send from SignalBox, and replies to them, are kept on the contact's timeline, and their message text is deleted after 12 months. You can disconnect Gmail in Settings at any time, which deletes the stored password. Legal basis: contract.

Integrations you choose to connect

SignalBox only exchanges data with other services you connect yourself. Each one can be disconnected in Settings.

• MailerLite: we store your MailerLite API key and add people from the groups you choose to your SignalBox contacts.
• Book Like a Boss: when someone books with you, their name, email and booking type are sent to SignalBox and added to the circle you chose.
• Dropbox: we store access to your Dropbox and save a copy of your contacts, circles, notes and logged interactions there on the schedule you choose.
• Zapier, the SignalBox API and AI assistants (MCP): anything you connect with an API key can read and change your workspace's data, as you set it up to. What happens to that data in those services is governed by their own terms.
• SignalFeed (earlier connections only): custom feeds are now part of the SignalBox extension. Workspaces that connected our sister product SignalFeed before then keep sharing the names and LinkedIn profiles of the people due a follow-up with it, so it can show their posts, until they disconnect it in Settings, under Integrations.

Requests to join the beta

When you ask for access, we collect your name, email address, any note you add and any invite code you use, and we email ourselves to let us know. We use this to review your request and invite you. Legal basis: taking steps at your request before an agreement (contract) and our legitimate interest in running the beta.

Support chat

The app includes a support chat run by Heyo. So we know who we're talking to, it receives your name and email address when you're signed in, and it stores the messages you send us. We use these only to help you. Legal basis: contract, and our legitimate interest in supporting the people who use SignalBox.

How SignalBox is used

We use PostHog to understand how SignalBox and our site are used, such as the pages viewed, the features used, and errors. In the app these events are linked to your account email, so we can help when something goes wrong and see which features are worth improving. On the marketing site they are anonymous. PostHog runs without cookies (see below). Legal basis: our legitimate interest in running and improving SignalBox.

Keeping SignalBox secure

Our hosting provider keeps request logs, which include IP addresses, for a short period for security and troubleshooting. API keys, including the one the Chrome extension uses, are stored as a one-way hash (SHA-256), so we cannot recover or display a key once issued. Legal basis: our legitimate interest in keeping SignalBox and your data secure.

Connecting your account

When you connect the extension, signalboxcrm.com creates an API key for your organisation and hands it to the extension, or you paste one in yourself. The key is kept in Chrome's extension storage (chrome.storage.sync), which Chrome may sync between your own browsers when you are signed in to Chrome. It is sent only to signalboxcrm.com, with each request the extension makes.

Profiles you open

When you open a LinkedIn or Instagram profile, the extension sends that profile's address to SignalBox to check whether the person is already in your CRM, so it can show their status, circles and follow-up date. We do not keep a record of the profiles you view. Our hosting provider's request logs, which can include the address, are kept for a short period for security and troubleshooting. Nothing is sent from any other page.

When you save someone

The extension reads the person's name, headline, profile photo and profile address from the page to fill in the form. Only when you click Add or Update is anything saved: the name, company and email as shown in the form, the circles, stages and note you choose, the profile address, LinkedIn's identifier for the profile, and the profile photo. SignalBox stores a small copy of the photo, because LinkedIn and Instagram photo links stop working after a while.

The sidebar and your feed

On LinkedIn the extension adds a sidebar. To fill it, it asks SignalBox for the circles you have chosen to show as feeds and the people in them, and for the people due a follow-up (“Reach out today”), with their saved photos. Opening a feed loads LinkedIn's own content search, filtered to those people; the extension does not read the posts. From the sidebar you can log a note or an action against someone, move them between circles, take them out of a circle, or show or hide a circle, and each of these is saved to your SignalBox account.

In your LinkedIn feed the extension adds a small button beside each post author's photo. To show whether the author is already in one of your circles, it compares their profile address and LinkedIn identifier with the people it already has from SignalBox, in your browser; nothing is sent for posts you only scroll past. When you click the button, it reads the author's name, profile address and photo from the page to fill in the same form as on their profile, and saves only what you choose, as described above. On “Reach out today”, marking someone as engaged records that in SignalBox.

Filling in missing photos and identifiers

Contacts imported into SignalBox often have a LinkedIn profile address but no photo, or no LinkedIn identifier, which a feed needs. While a LinkedIn tab is open and in view, the extension asks SignalBox for contacts in your account that have a LinkedIn address and are missing either, looks each one up on LinkedIn, and sends the profile photo address and LinkedIn's identifier for that profile back to SignalBox, which stores a small copy of the photo. It only looks up people who are already in your CRM, one at a time and at most 60 a day, and it stops for the day if LinkedIn declines a request. The lookups use your existing LinkedIn session in the browser, the same way LinkedIn's own pages load a profile, including the anti-forgery token LinkedIn requires on these requests. That token and your LinkedIn session are never sent to SignalBox.

Stored in your browser

• Your SignalBox API key and the SignalBox address it belongs to
• For the photo fill: which contacts have been looked up in the last 14 days, and how many today
• Your sidebar settings: appearance, layout and which features are on
• A copy of your feeds from SignalBox, refreshed every few minutes, so the sidebar opens instantly, and where each large feed's rotation is up to

All of it is removed when you remove the extension.

What the extension does not do

• Does not read your LinkedIn or Instagram messages or connections, or the posts in your feed and searches; in your feed it only reads a post author's name, profile address and photo, and only sends them when you choose to save that person
• Does not run on, or send anything from, any other website
• Does not keep your browsing history
• Does not contain advertising, analytics or any third-party code
• Does not load code from the internet; everything it runs ships with the extension
• Does not sell or share data, or use it for anything other than your SignalBox account

Permissions used

• storage: to keep your API key, sidebar settings, a copy of your feeds and the photo-fill progress described above
• activeTab: so the toolbar popup can read the profile open in the current tab
• scripting: to load the extension's own bundled script into a LinkedIn or Instagram tab that was open before it was installed
• linkedin.com and instagram.com: to show the SignalBox bar on profiles, and on LinkedIn the sidebar and the buttons beside posts, and read the details described above
• signalboxcrm.com: to save contacts to your account, check whether someone is already saved, load your feeds, and record what you log or change in the sidebar

Transfers outside the UK

Some of these providers are based in, or may access data from, the United States. Where that happens, the transfer is covered by the UK–US Data Bridge, or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in the provider's data processing agreement.

If someone keeps your details in SignalBox

The SignalBox user who added you decides what is kept about you, so please contact them first. If you can't, email us and we will help where we can.

Disconnecting the Chrome extension

Revoke its key in Settings or remove the extension from Chrome, which also clears everything it stored in your browser.