Privacy Policy

SigSent is an email testing tool. Three different groups are described below: account holders, who sign up and create tests; reviewers, who are sent a link and give feedback on an email without creating an account; and access requesters, who ask for access to SigSent but do not yet have an account.

• Your email address and display name, via Google sign-in, Microsoft sign-in, or email sign-up.
• Content you create: campaigns, audience segments, tests, and email copy.
• Results and analyses generated from that content.
• An audit log of significant actions in your workspace.
• If you enable them: two-factor authentication secrets and email-platform credentials. Both are encrypted at rest with AES-256-GCM.

If you were sent a review link, you do not have an account and we do not ask for your name or email. While you review the email we record:

• Your browser's user-agent string, and whether you are on mobile, tablet, or desktop.
• The page that referred you, if your browser sends one.
• How you interact with the email being reviewed: how far you scroll, which sections you dwell on or hover over, whether you click the call to action, and whether you complete the review.
• Any answers you give in the survey.

We do not ask reviewers for a name or email, and review activity is associated with the review session/link rather than a named reviewer profile. SigSent does not store reviewer IP addresses or derive reviewer location in the application; our hosting providers (Vercel, Render) process IP addresses only as part of standard request handling and security. We do not use your camera or microphone.

If you fill out the Request Access form, you do not yet have an account. We collect:

• Your name and work email address.
• Your company or team name, if you provide it — this field is optional.
• What you told us you want to test.
• Your IP address and browser user-agent, for abuse prevention.

We use this only to evaluate and respond to your request. Submitting this form does not add you to a marketing list.

• We do not sell or rent personal data.
• We do not use advertising or cross-site tracking cookies.
• We do not perform facial or camera analysis on reviewers. Account holders may optionally use their own webcam on their own screen while testing their own content; that video is processed in the browser and is never uploaded.

We use browser storage to keep you signed in and to remember interface preferences such as theme, language, and your active workspace.

With your consent — asked the first time you visit, via a banner linking to this page — we also use Google Analytics (delivered through Firebase) to understand product usage: pages viewed, session duration, and general device/browser information. Google Analytics sets its own cookies to do this. We do not send it your name, email, or any content you create. You can decline when asked, and no analytics cookies are set if you do, or change your choice later using the cookie preferences link in the footer. There are no advertising or cross-site tracking cookies either way.

• Google Firebase — authentication, including Google and Microsoft sign-in.
• MongoDB Atlas — data storage.
• Google Gemini — AI analysis of the email content you submit.
• Google Analytics — product-usage analytics, only if you consent.
• Vercel and Render — application hosting.
• Stripe — payments, if and when you subscribe.

Email content you analyse is sent to Google Gemini to produce the analysis. Do not put information in a test that you are not comfortable sending to that service.

Account content is kept until you delete it or close your account. Reviewer sessions and their events are kept as part of the test results they belong to, and are removed when that test is deleted. Review links expire on the date set when they were created, up to 30 days. Access requests are kept until the request is resolved or you ask us to delete it.

Account holders can edit or delete their content at any time from within the app, and can request deletion of their account and its data. Reviewers who want their responses removed should contact the person who sent them the link, or us using the address below — please include the review link so we can find the session. Access requesters who want their submission deleted can also contact us at the address below.

Depending on where you live you may have rights to access, correct, export, or delete personal data, and to object to processing. We honour these requests regardless of where you live.

Questions or requests: privacy@sigsent.com.