Two different "you" in this policy. If you hold a Signl account, you're a data subject we have a direct relationship with, and normal account/billing rules apply. If you're a business contact whose details were surfaced by Signl for one of our customers, you're a data subject we process under legitimate interests, not consent. For some business contacts we also process signals about role changes and public professional activity, described below. This is a form of profiling, and it comes with its own rights. See "If you are a business contact" below for what that means and how to object.
Who we are
Signl is a product operated by AKY X GROUP LTD (company number: 14137444), a company registered in England and Wales with its registered office at 128 City Road, London, England, EC1V 2NX. In this policy, "Signl", "we", "us" and "our" mean AKY X GROUP LTD. We are the controller for account data (see below) and, for the business-contact data we surface to customers, we act as a controller in our own right for the enrichment and verification we perform, while our customers are independent controllers of what they do with exported data afterwards.
Our contact for privacy matters is vlad@akyx.digital.
What data we collect
About you, if you hold an account
- Account data: name, work email, and (if you sign in with Google) the profile information Google shares with us.
- Billing data: handled by Polar, which acts as the merchant of record for purchases and is the seller you contract with for the transaction. Polar collects payment details and any applicable VAT or sales tax; we never receive or store your card number. Polar passes us your plan, subscription status, and order history only.
- ICP preferences: the industry, geography, headcount and technology criteria you optionally save during onboarding, used to personalise which signals rank highest for you.
- Usage data: searches you run, Loops you create, contacts you reveal, and API/CLI activity, needed to meter credits and enforce the published fair-use limits.
- Connector data: if you connect an AI agent (Claude, or another MCP client) via OAuth or an API key, we hold a hashed credential to authenticate that connection, never the plaintext key or token.
About business contacts, surfaced through the product
Signl's core function is surfacing publicly-relevant business signals (funding rounds, hiring activity, technology adoption) and, on request, a verified decision-maker contact for that company. That contact data (name, job title, work email, sometimes a work phone or LinkedIn URL) comes from our data providers (see below), not from the individual directly, and not from you.
Professional activity and role changes
For some business contacts, Signl also processes two further kinds of signal, sourced from public professional-profile data:
- Role changes: that someone recently started a new role, was promoted, or has reached a tenure milestone at their current company, derived from employment history on their public professional profile.
- Public professional activity: that someone has posted publicly about a topic relevant to prospecting (for example, a technology or a competitor), and when. We use only the topic and date, not the post's content, its URL, or who reacted to it.
The second of these (inferring interest or relevance from what someone posts publicly) is profiling within the meaning of Article 4(4) UK GDPR: an automated evaluation of certain aspects of a person, used to assess likely business relevance. It is not automated decision-making that produces legal or similarly significant effects on you (no decision is made about you without a person involved), so Article 22 does not apply, but the profiling itself is real and we say so plainly here. We only ever access content a person has chosen to make public on their professional profile: never private, connections-only, or non-professional content, and never anything requiring us to log in as, or impersonate, a member of the platform it came from.
How we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account, billing, support | Account, billing data | Performance of a contract with you |
| Metering credits, enforcing fair use | Usage data | Performance of a contract; legitimate interest in preventing abuse |
| Personalising signal ranking | ICP preferences | Consent (you opt in during onboarding; you can clear this anytime) |
| Authenticating your connected agent | Connector data | Performance of a contract |
| Surfacing & verifying business contacts | Contact data (name, title, work email) | Legitimate interests: B2B prospecting, Art. 6(1)(f) UK GDPR |
| Detecting role changes (new job, promotion, tenure) | Name, job title, employer, role start date | Legitimate interests: B2B prospecting, Art. 6(1)(f) UK GDPR |
| Analysing public professional content and engagement | Public post topic and date, engagement counts, professional profile URL | Legitimate interests, Art. 6(1)(f), following a documented Legitimate Interests Assessment. This is profiling (Art. 4(4)). It is not automated decision-making producing legal or similarly significant effects, so Art. 22 does not apply. |
| Security, fraud, and abuse prevention | Account, usage data | Legitimate interest |
If you are a business contact, not a Signl customer
If your work contact details were surfaced through Signl, you're very likely reading this because a company you're a contact of used Signl, or because you found this page independently. We rely on legitimate interests (Article 6(1)(f) UK GDPR) as our lawful basis for processing your business contact details for prospecting purposes. We do not ask for or rely on your consent for this, in the same way any B2B directory or CRM enrichment tool does not. The same basis, under a separate assessment, covers the role-change and public-content signals described above.
You have the right to:
- Object to this processing at any time, for any reason relating to your particular situation (Article 21(1) UK GDPR). Once you object, we stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. If your objection concerns role-change or public-content signals, we stop that specific processing outright.
- Request access to what data we hold about you.
- Request deletion: we will remove your record from our database and instruct the source provider not to re-supply it where technically possible.
- Request correction of inaccurate data.
When you object or ask us to delete your data, we keep a minimal record (just enough to recognise you again, not the data itself) so that a future search or refresh doesn't silently reprocess someone who already told us to stop. Retaining that record is itself permitted under Article 17(3)(b) UK GDPR (and Recital 65): it exists solely to make your erasure or objection stick, not to process you further.
Contact vlad@akyx.digital with the email address or name you'd like us to look up, and we'll action it without requiring you to create an account.
Who we share data with
We use the following processors and data sources. We do not sell personal data.
| Party | Role |
|---|---|
| Supabase | Database, authentication, hosting of account and usage data |
| Polar | Merchant of record: payment processing, billing, invoicing and sales-tax collection |
| Optional sign-in (OAuth) if you choose "Continue with Google" | |
| Monid (gateway to Apollo, Hunter, Clay and similar) | Company and professional-profile data sourcing for discovery |
| Anysite | Sourcing publicly-visible professional profile and post data for role-change and engagement signals, and funding data via Crunchbase |
| Apollo (via Monid) | Decision-maker search and contact resolution |
| Prospeo, Dropcontact | Email finding and verification waterfall. Dropcontact (EU-hosted) is used first for EU-based subjects |
| SEC EDGAR, Companies House, employer job boards | Public funding, hiring and technology-adoption signal data |
| Instantly (only if you connect it) | Sending leads you export into your own outbound campaigns, and receiving reply outcomes back |
| Your connected AI agent | If you connect Claude (or another MCP client) as your agent, your prompts and our tool responses pass through that provider per your own arrangement with them. We're a data source they call, not the other way around |
International transfers
Some of the processors above are based outside the UK/EEA. Where that's the case, we rely on Standard Contractual Clauses (or an equivalent adequacy mechanism) as our transfer safeguard. Dropcontact is EU-hosted and is used first in the verification waterfall for EU-based subjects, so that path stays inside the EEA.
How long we keep data
- Account data: for as long as your account is active, plus a reasonable period afterwards for legal, tax and dispute purposes.
- Business-contact data: cached verified contacts are retained so we don't re-charge you or re-query a provider for the same person; deletion requests (see above) are actioned promptly.
- Public professional activity: retained for 90 days from the date of the post, then deleted automatically.
- Role-change signals: retained for 180 days, then deleted automatically.
- Billing records: retained as required by UK tax law (typically 6 years).
Your rights (UK GDPR)
Whether you're an account holder or a business contact, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability where applicable. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
Cookies
The marketing site does not set analytics or advertising cookies. The dashboard app uses only the strictly-necessary session cookie/token needed to keep you signed in.
Children
Signl is a B2B product not directed at, or intended for use by, anyone under 18.
Changes to this policy
If we make a material change, we'll update the date at the top of this page and, for account holders, notify you by email.
Contact
AKY X GROUP LTD · 128 City Road, London, England, EC1V 2NX
vlad@akyx.digital