Two different "you" in this policy. If you hold a Signl account, you're a data subject we have a direct relationship with, and normal account/billing rules apply. If you're a business contact whose details were surfaced by Signl for one of our customers, you're a data subject we process under legitimate interests, not consent. For some business contacts we also process signals about role changes and public professional activity, described below. This is a form of profiling, and it comes with its own rights. See "If you are a business contact" below for what that means and how to object.
Who we are
Signl is a product operated by AKY X GROUP LTD (company number: 14137444), a company registered in England and Wales with its registered office at 128 City Road, London, England, EC1V 2NX. In this policy, "Signl", "we", "us" and "our" mean AKY X GROUP LTD. We are the controller for account data (see below) and, for the business-contact data we surface to customers, we act as a controller in our own right for the enrichment and verification we perform, while our customers are independent controllers of what they do with exported data afterwards.
Our contact for privacy matters is vlad@akyx.digital.
What data we collect
About you, if you hold an account
- Account data: name, work email, and (if you sign in with Google) the profile information Google shares with us.
- Billing data: payments are processed by Stripe, our payment processor. Stripe collects your card or bank details, billing name and address, and any VAT number you enter; we never receive or store your full card number. We keep your Stripe customer and subscription identifiers, your plan, subscription status and payment history, which we need to run your account and to meet our tax and accounting obligations.
- ICP preferences: the industry, geography, headcount and technology criteria you optionally save during onboarding, used to personalise which signals rank highest for you.
- Usage data: searches you run, Loops you create, contacts you reveal, and API/CLI activity, needed to meter plan allowances and enforce the published fair-use limits.
- Connector data: if you connect an AI agent (Claude, or another MCP client) via OAuth or an API key, we hold a hashed credential to authenticate that connection, never the plaintext key or token.
About business contacts, surfaced through the product
Signl's core function is surfacing publicly-relevant business signals (funding rounds, hiring activity, technology adoption) and, on request, a verified decision-maker contact for that company. That contact data (name, job title, work email, sometimes a work phone or LinkedIn URL) comes from our data providers (see below), not from the individual directly, and not from you.
Professional activity and role changes
For some business contacts, Signl also processes two further kinds of signal, sourced from public professional-profile data:
- Role changes: that someone recently started a new role, was promoted, or has reached a tenure milestone at their current company, derived from employment history on their public professional profile.
- Public professional activity: that someone has posted publicly about a topic relevant to prospecting (for example, a technology or a competitor), and when. For the role-change and activity signals we use only the topic and date of a person's own post, not its content or URL. Engagement with watched posts, and posts found by a customer's topic search, are a separate source, described next.
Engagement with LinkedIn and X posts
Signl's customers can ask us to watch a public LinkedIn profile or post, an X (Twitter) account, or a search: public LinkedIn posts about some words, mentioning a company, or written by a company's people, or public X posts about some words. What is watched can be the customer's own, a competitor's, or another person's that their buyers follow. When someone engages publicly with a watched post, or writes a post a search finds, we collect:
- From a comment or reply: the person's name, headline (on X, their bio) and public profile URL, what they wrote, when, and the post they wrote it on (its text, author and link).
- From a reaction on LinkedIn, or a repost on X, when the customer has asked for these: the person's name, headline and public profile URL, the kind of reaction, and the post. No words are collected, because none were written.
- From a post a search found: the author's name, headline and public profile URL, the post's text, date and link.
- From enrichment, only for people on LinkedIn who pass our relevance check: a work email address, employer, seniority and country. People we know only from X are never enriched or matched to other identities.
- What we derive: a read of the intent and sentiment of what they wrote (for a reaction or repost, only how well their headline fits), how well the person fits the customer's stated target market, a confidence score, a one-line reason, which of the customer's offers is most relevant, and a suggested opening line. Comments with nothing to reply to, people looking for work and people selling their own services are set aside at this stage, before any contact details are looked up; a reaction alone has to clear a higher bar than a comment.
This is also profiling within the meaning of Article 4(4) UK GDPR, and it is not automated decision-making with legal or similarly significant effects: it produces a suggestion for a person at the customer to act on or ignore. We only read what is publicly visible, never private messages, protected accounts or connections-only content, and never by logging in as a member. On X we do not, and cannot, collect who liked a post.
The second of these (inferring interest or relevance from what someone posts publicly) is profiling within the meaning of Article 4(4) UK GDPR: an automated evaluation of certain aspects of a person, used to assess likely business relevance. It is not automated decision-making that produces legal or similarly significant effects on you (no decision is made about you without a person involved), so Article 22 does not apply, but the profiling itself is real and we say so plainly here. We only ever access content a person has chosen to make public on their professional profile: never private, connections-only, or non-professional content, and never anything requiring us to log in as, or impersonate, a member of the platform it came from.
How we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Running your account, billing, support | Account, billing data | Performance of a contract with you |
| Metering plan allowances, enforcing fair use | Usage data | Performance of a contract; legitimate interest in preventing abuse |
| Personalising signal ranking | ICP preferences | Consent (you opt in during onboarding; you can clear this anytime) |
| Authenticating your connected agent | Connector data | Performance of a contract |
| Surfacing & verifying business contacts | Contact data (name, title, work email) | Legitimate interests: B2B prospecting, Art. 6(1)(f) UK GDPR |
| Detecting role changes (new job, promotion, tenure) | Name, job title, employer, role start date | Legitimate interests: B2B prospecting, Art. 6(1)(f) UK GDPR |
| Collecting and qualifying engagement with watched LinkedIn and X posts (comments, replies, reactions, reposts) and the authors of posts a customer's search finds | Name, headline or bio, profile URL, what they wrote or the kind of reaction, the post and its date; for qualified LinkedIn people, work email, employer, seniority and country; the intent and fit assessment, reason and suggested opening line | Legitimate interests, Art. 6(1)(f), following a documented Legitimate Interests Assessment. This is profiling (Art. 4(4)). It is not automated decision-making producing legal or similarly significant effects, so Art. 22 does not apply. |
| Analysing public professional content and engagement | Public post topic and date, engagement counts, professional profile URL | Legitimate interests, Art. 6(1)(f), following a documented Legitimate Interests Assessment. This is profiling (Art. 4(4)). It is not automated decision-making producing legal or similarly significant effects, so Art. 22 does not apply. |
| Security, fraud, and abuse prevention | Account, usage data | Legitimate interest |
If you are a business contact, not a Signl customer
If your work contact details were surfaced through Signl, you're very likely reading this because a company you're a contact of used Signl, or because you found this page independently. We rely on legitimate interests (Article 6(1)(f) UK GDPR) as our lawful basis for processing your business contact details for prospecting purposes. We do not ask for or rely on your consent for this, in the same way any B2B directory or CRM enrichment tool does not. The same basis, under separate assessments, covers the role-change, public-content and post-engagement processing described above.
If you commented on, reacted to or wrote a LinkedIn or X post
You may be reading this because someone contacted you after you engaged publicly with a LinkedIn or X post, or wrote one about a topic. Here is what happened, in the order Article 14 UK GDPR asks us to say it:
- Where your details came from: your public comment, reply, reaction or repost on a post that one of our customers asked Signl to watch, or a public post of yours that their topic search found. The post may have been theirs, or someone else's. Your work email, where we have one, came from a contact-data provider we query using your public LinkedIn profile URL (see "Who we share data with"); we never look up people we know only from X.
- What we hold: the items listed under "Engagement with LinkedIn and X posts" above.
- Why: so that customer can decide whether to start a business conversation with you about something you raised publicly.
- Who sees it: the customer who watched the post, and, if they choose, the tools they connect to Signl (their Instantly workspace, their Slack, or their AI assistant).
- How long: the comment and everything derived from it are deleted automatically 90 days after we first collect them. A verified work email found this way may be kept longer on the same terms as other business-contact data (see "How long we keep data").
- Your right to object: email us and we stop. An objection covers every way Signl might process you, not only the post you commented on: we keep a minimal record so no future comment of yours is collected for any customer.
You have the right to:
- Object to this processing at any time, for any reason relating to your particular situation (Article 21(1) UK GDPR). Once you object, we stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. If your objection concerns role-change or public-content signals, we stop that specific processing outright.
- Request access to what data we hold about you.
- Request deletion: we will remove your record from our database and instruct the source provider not to re-supply it where technically possible.
- Request correction of inaccurate data.
When you object or ask us to delete your data, we keep a minimal record (just enough to recognise you again, not the data itself) so that a future search or refresh doesn't silently reprocess someone who already told us to stop. Retaining that record is itself permitted under Article 17(3)(b) UK GDPR (and Recital 65): it exists solely to make your erasure or objection stick, not to process you further.
Contact vlad@akyx.digital with the email address or name you'd like us to look up, and we'll action it without requiring you to create an account.
Who we share data with
We use the following processors and data sources. We do not sell personal data.
| Party | Role |
|---|---|
| Supabase | Database, authentication, hosting of account and usage data |
| Stripe | Payment processing, subscriptions, invoicing and tax calculation |
| Optional sign-in (OAuth) if you choose "Continue with Google" | |
| Monid (gateway to Apollo, Hunter, Clay and similar) | Company and professional-profile data sourcing for discovery |
| Anysite | Sourcing publicly-visible professional profile and post data for role-change and engagement signals, and funding data via Crunchbase |
| Apollo (via Monid) | Decision-maker search and contact resolution |
| Prospeo, Dropcontact | Email finding and verification waterfall. Dropcontact (EU-hosted) is used first for EU-based subjects |
| SEC EDGAR, Companies House, employer job boards | Public funding, hiring and technology-adoption signal data |
| Monid (gateway to TikHub and ContactOut) | Collecting public comments on watched LinkedIn posts, public posts, replies and reposts on X, and finding a work email from a public LinkedIn profile URL |
| Monid (gateway to Apify / HarvestAPI) | Finding public LinkedIn posts that match a customer's search, and collecting who reacted to a watched LinkedIn post |
| OpenAI | Reading comments, replies and posts for relevance and drafting suggested opening lines. We send what was written, the post, the person's headline or bio and, for qualified people, their employer and role; under OpenAI's API terms this is not used to train their models by default |
| Slack (only if you connect it) | Posting alerts about new, qualified people to the channel you choose |
| Clay (only if you connect it) | Receiving the people you send, as rows in a table in your own Clay workspace; and, if you call Signl from Clay with your API key, answering what Signl holds about a person you already have |
| Instantly (only if you connect it) | Sending leads you export into your own outbound campaigns, and receiving reply outcomes back |
| Your connected AI agent | If you connect Claude (or another MCP client) as your agent, your prompts and our tool responses pass through that provider per your own arrangement with them. We're a data source they call, not the other way around |
International transfers
Some of the processors above are based outside the UK/EEA. Where that's the case, we rely on Standard Contractual Clauses (or an equivalent adequacy mechanism) as our transfer safeguard. Dropcontact is EU-hosted and is used first in the verification waterfall for EU-based subjects, so that path stays inside the EEA.
How long we keep data
- Account data: for as long as your account is active, plus a reasonable period afterwards for legal, tax and dispute purposes.
- Business-contact data: cached verified contacts are retained so we don't re-charge you or re-query a provider for the same person; deletion requests (see above) are actioned promptly.
- Public professional activity: retained for 90 days from the date of the post, then deleted automatically.
- Engagement with watched LinkedIn and X posts, and posts found by a search: retained for 90 days from when we first collect them, with everything derived from them, then deleted automatically.
- Role-change signals: retained for 180 days, then deleted automatically.
- Billing records: retained as required by UK tax law (typically 6 years).
Your rights (UK GDPR)
Whether you're an account holder or a business contact, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and the right to data portability where applicable. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
Cookies
The marketing site uses Google Analytics to understand which pages help people, only if you allow it: a small banner asks on your first visit, and until you accept, no analytics cookie is set (Google receives anonymous, cookieless counts). We set no advertising cookies and sell no data. You can change your choice at any time. The dashboard app uses only the strictly-necessary session cookie/token needed to keep you signed in.
Children
Signl is a B2B product not directed at, or intended for use by, anyone under 18.
Changes to this policy
If we make a material change, we'll update the date at the top of this page and, for account holders, notify you by email.
Contact
AKY X GROUP LTD · 128 City Road, London, England, EC1V 2NX
vlad@akyx.digital