🔒 Privacy & Data Security

How we handle your data — honestly, transparently, and with respect.

📋 What Data We Collect

From you (our customers)

• Account information: Your name, email address, and billing details (processed securely via Stripe — we never see or store your full credit card number).
• Portfolio companies: The names of companies you ask us to monitor. This is the core of the service.
• Industry tags: Optional industry classifications you set for your portfolio companies (used to improve signal relevance).
• Usage data: Login timestamps and session activity to maintain your account.

From public sources (on your behalf)

• News & press releases: Publicly available articles mentioning your portfolio companies.
• SEC filings & regulatory data: Public government filings.
• Job postings: Publicly listed job openings at your portfolio companies.
• Other public signals: Funding announcements, partnership news, executive changes, and other publicly available information.

We do not access private data, internal company systems, or non-public information. Everything we surface is information you could find yourself — we just find it first and put it in context.

🚫 What We Don't Collect

• ❌ No passwords (we use magic-link login — no password database to leak)
• ❌ No credit card numbers (handled entirely by Stripe)
• ❌ No private messages, emails, or internal documents
• ❌ No location data, device fingerprints, or behavioral tracking
• ❌ No customer lists, CRM exports, or proprietary data

🛡️ How We Protect Your Data

Encryption

• All traffic is encrypted in transit via TLS 1.3 (HTTPS).
• Login tokens are SHA-256 hashed before storage — even we can't reverse them.
• API credentials (HubSpot tokens, etc.) are stored in server-side configuration, never exposed to the browser.

Access Controls

• Every user sees only their own portfolio and data.
• Admin access is restricted to authorized account holders only.
• Session tokens expire automatically and cannot be reused.

Third-Party Integrations

• When you connect HubSpot, we use API tokens scoped to the minimum permissions needed.
• We never store HubSpot data beyond what's necessary for signal processing.
• You can revoke API access at any time from your HubSpot account settings.

Human-in-the-Loop

No outreach — email, LinkedIn messages, or meeting requests — is ever sent automatically. Every action requires your explicit approval before execution. This isn't just a feature; it's a safeguard built into the core of the platform.

🗑️ Data Retention & Deletion

• We retain your account data for as long as your subscription is active.
• Upon cancellation, your portfolio data and signals are retained for 30 days in case you reactivate.
• After 30 days, all customer data is permanently deleted from our servers.
• You can request immediate data deletion at any time by emailing contact@unlocksignals.com.

🤝 Data Sharing

• We never sell your data. Period.
• We never share your portfolio with other customers or third parties.
• We don't use your data to train AI models or for any purpose beyond delivering the service to you.
• We may share anonymized, aggregated metrics (e.g., "our platform tracks 45 industries") that cannot identify you or your companies.

⚖️ Compliance

While Unlock Signals is built for US-based businesses, we respect global privacy standards:

• GDPR: European users can request data export, correction, or deletion at any time.
• CCPA: California residents have the right to know what data we hold and request its deletion.
• SOC 2: Our infrastructure provider (Hostinger) maintains industry-standard physical and network security.

For any privacy-related requests, contact contact@unlocksignals.com. We respond within 48 hours.

🔐 Our Security Practices (Behind the Scenes)

We believe in transparency about how we operate:

• No password storage. Magic-link authentication means there's no password database to compromise.
• Minimal data footprint. We store only what's required to run the service — company names, email addresses, and industry tags.
• Regular backups. Customer data is backed up nightly with point-in-time recovery.
• Access logging. Admin actions are logged for audit purposes.
• Dependency hygiene. We keep our dependencies updated and scan for known vulnerabilities.

---

In Plain English

Unlock Signals reads public information about your portfolio companies and tells you what matters. The only private data we hold is your email and company list. We don't sell it, share it, or use it for anything except delivering your daily briefings. And nothing — absolutely nothing — gets sent to your customers without you clicking "approve."

Last updated: July 4, 2026 · Questions? contact@unlocksignals.com