Privacy Policy

Last reviewed: 2026-10-13

Controller: Deniz Top

Liebigstraße 2A, 89257 Illertissen, Deutschland

Contact: info@changesignal.net

What we collect

Account data: your email address, the workspaces you belong to, your role in each and, if you choose to give one, a display name, which the other members of your workspaces see. You give us the email address to sign in; there is no password, because sign-in is by single-use link.

Watchlist data: the technologies you tell us you run, and the versions you choose to pin. This is business information about your estate rather than about you personally, and we treat it as the more sensitive of the two.

If somebody invites you to a workspace: the invitation record holds your email address because the person who invited you supplied it. That person, not you, is the source of the invitation. If you already have a ChangeSignal account we may also hold the same address independently, as account data you gave us yourself when you signed up; if you do not, the invitation may be the first time we receive it. Either way, the invitation itself came from whoever invited you.

We use it to let you join the workspace you were invited to, and to email you once to say that you were invited and that we hold your address. The legal basis is our legitimate interest under Article 6(1)(f) in letting a customer share their workspace with the people they work with, and in telling you we hold your address rather than holding it quietly.

If the invitation is never accepted it expires after 30 days, and your email address is removed from the invitation record — you do not have to do anything. That affects the invitation only: if you have an account with us, the address held as your own account data is not touched by it. Until then you have the same rights as anyone else described below, including the right to object and to ask us to erase it sooner.

Billing data, if you subscribe: our payment provider asks you for a billing address, the name your business contracts under, a billing email address and, where your country supports one, a VAT or business tax identification number. This is needed to bill you, to issue an invoice that meets the legal requirements for one, and to work out which VAT applies to you.

Those details are submitted directly to our payment provider and are not stored in the ChangeSignal application database. Our own records keep the provider’s customer and subscription identifiers, the subscription status, which plan you are on and when the period ends — not your address, your business name or your tax identification number. Using a provider does not make your data somebody else’s responsibility: we decide that it is collected and what for, and you can exercise every right below with us.

We do not collect: passwords, payment card numbers, IP-based location profiles, behavioural tracking, or anything read from your systems. Nothing is installed on your infrastructure and nothing scans it. Card details are entered directly with our payment provider and never reach us.

Why we are allowed to hold it

If you are the person who signed up, you are the customer we contract with, and your email address, your workspaces and your watchlist are processed to perform that contract — Article 6(1)(b) GDPR. Without an email address we cannot create an account or sign you in, so providing it is a requirement of using the service rather than an optional extra.

If you use ChangeSignal as part of a workspace somebody else set up, you are not personally party to that contract, so Article 6(1)(b) is not the basis for your data. We process your email address and your activity in that workspace on our legitimate interest under Article 6(1)(f) in delivering the service to the customer who asked for it, in letting you sign in as yourself rather than sharing one login, and in keeping each action in a workspace attributable to a person if that workspace is ever misused. Your interest in not being tracked beyond that is why we hold nothing about you except the address you sign in with and what you do inside the workspace.

The security audit record — sign-ins, membership changes, billing changes, exports — rests on our legitimate interest under Article 6(1)(f) in being able to reconstruct who did what to an account, which is what lets us answer a customer asking whether their workspace was accessed by someone else.

Error monitoring rests on the same basis, and the interest is keeping a service that people depend on working. No user identity is attached to an error report.

The list of addresses our email provider has rejected rests on our legitimate interest in not repeatedly sending mail to an address that bounces, which protects the reputation of the sending domain that everyone else’s sign-in links depend on.

Answering you when you write to us rests on our legitimate interest in replying to people who contact us, or on the contract where your message concerns one.

Billing and invoicing records are retained to comply with statutory tax and accounting obligations — Article 6(1)(c). Those retention periods are set by law rather than by us, so we cannot shorten them at request.

We rely on consent for nothing, so there is no consent to withdraw. Where we rely on a legitimate interest you may object under Article 21, and we will either stop or explain why the interest overrides.

The contact form

What you send through the contact form — your message, the address you give and, if you choose to give it, your name — is transmitted by our email provider (Resend) and delivered to our business mailbox, which runs on Google Workspace. The legal basis is our legitimate interest in answering people who contact us, and where your message concerns a contract you already have with us, the performance of that contract — or, where you are asking about becoming a customer, the steps taken at your own request before entering into one (Article 6(1)(b) GDPR).

The message is NOT saved in the ChangeSignal application database. That is a statement about the product, not about the message: it is a real email, so it remains in the mailbox until we delete it, and both providers hold it briefly in their own operational logs. We do not claim it disappears.

How long we keep it: ordinary enquiries for up to 12 months, and sooner once they are resolved. Correspondence about your account is kept while you are a customer and deleted once you are not. Where a message must be kept for contractual, tax, accounting or legal-defence reasons, it is kept for the period that applies to it and no longer — and we review those periods once a year rather than keeping things indefinitely by default.

Our mailbox runs on Google Workspace. Google is a United States company, and on our current plan we cannot choose where mailbox data is stored — so we do not claim that it stays in the EU. Google LLC is certified under the EU–US Data Privacy Framework, and where that does not apply it relies on the European Commission’s Standard Contractual Clauses; both are part of the data-processing terms of our agreement with them.

Because this correspondence lives in a mailbox rather than in the product, the self-service export and deletion inside ChangeSignal do not reach it. Deleting your account does not delete emails you sent us. Ask us and we will search the mailbox, and provide, correct or delete what we hold. We answer without undue delay and in any event within one month of receiving the request. Where the GDPR allows it — because the request is complex, or because there are a number of them — that period can be extended by up to two further months, and we will tell you within the first month that we are extending it and why.

To limit abuse we keep a one-way, salted hash of the network address a submission came from, together with a count, for one hour. It holds no message, no name and no email address. We treat that hash as personal data in pseudonymised form rather than as anonymous, because the salt we hold would allow it to be linked back. The basis is our legitimate interest in keeping a public form usable, and it is deleted once the hour has passed.

A name is optional. We ask for it only because a reply reads better with one.

The demo and the feedback box

The demo needs no account and sets no cookie. Each time a demo page is opened we write one line to our application log saying so, with the date of the sample shown. To tell a person from the automatic previews that chat and social apps fetch when a link is shared, we look at the description your browser sends of itself and keep only the result — person, preview or unknown. We do not record your network address, your browser’s description or anything that could connect one visit to another.

What you write in the feedback box — on the demo or inside the app — is stored in our database with the time and where it was written, and, only if you fill it in, the name, profile link or email address you give us. It is not linked to an account, a workspace or your device, including when you are signed in. The legal basis is our legitimate interest in learning what the product lacks and, where you give a way to reach you, in answering you (Article 6(1)(f) GDPR).

We keep feedback for 12 months, after which it is deleted automatically. Because it is not linked to an account, deleting your account does not find it; ask us and we will search for what you name and delete it.

Neither what you wrote nor your contact details are written to our logs. The log records only that feedback arrived, how long it was and whether a contact detail was given. Against abuse, the same one-hour, salted hash of the network address applies as for the contact form, counted separately.

Analytics and cookies

There is no third-party analytics, no advertising pixel and no session replay. Product metrics come from our own database, which we already hold in order to run the service.

The only cookie we set is the one that keeps you signed in. It holds a session identifier, nothing else, and it is marked so that scripts in your browser cannot read it and it is only sent back to us. You cannot use an account without being signed in, so this cookie is strictly necessary to provide the service you asked for — which is why storing it needs no consent under §25(2) no. 2 TDDDG.

Because we set no tracking, analytics or advertising cookie, there is no consent banner to dismiss. That is a consequence of not collecting the data, rather than a banner we decided to leave out.

Who else processes it

Application hosting and the database: Render. Our services and database run in Frankfurt. Render is a United States company, so administrative access from outside the EU cannot be excluded; those transfers rest on Render’s EU–US Data Privacy Framework certification and on the Standard Contractual Clauses in their data-processing agreement.

Email — sign-in links and notifications: Resend. Email is stored in the United States; that provider offers no EU storage option, and the transfer relies on the Standard Contractual Clauses in their data-processing agreement. This is the largest international transfer in the service and we state it rather than bury it.

The business mailbox behind our contact address: Google Workspace. Google LLC is a United States company; on our edition we cannot choose where mailbox data is stored, so we make no EU-residency claim. Google LLC is certified under the EU–US Data Privacy Framework, and where that does not apply it relies on the Standard Contractual Clauses in the Cloud Data Processing Addendum.

Payment: Stripe, which runs the checkout and the subscription. It receives the billing address, the name your business contracts under, the billing email address, a VAT or business tax identification number where you give one, and our own identifier for the workspace. It uses them to take payment, to issue invoices and to determine the VAT that applies to you. Stripe processes data in the United States, the European Union and India, and relies on the Standard Contractual Clauses and on its EU–US Data Privacy Framework certification for transfers out of the European Economic Area.

Error monitoring: Sentry, in the EU (Frankfurt). Some account-level data about us — not about you — is held in the United States whichever region is chosen. No user identity is ever attached to an error report: only a message, a stack trace and a phase name.

Off-provider backups: Scaleway, in Paris. The nightly archive contains the database, so it contains your data, and it stays in the European Union.

Availability monitoring: healthchecks.io, which receives counts and phase names and no customer data at all.

The AI summary that answers "why does this matter" is generated from public vendor advisory text and a technology name. No workspace, no watchlist and no person is ever sent to it — a test enforces that, rather than an intention.

Where a transfer outside the European Economic Area relies on the Standard Contractual Clauses or on a Data Privacy Framework certification, you can ask us for details of the safeguard that applies and we will provide a copy. Write to the address in the legal notice.

How long we keep it

Account and watchlist data: for as long as the account exists.

Notification content: 90 days. The record that a message was sent outlives its text.

Notification history: 12 months. Raw source payloads no longer backing a claim: 90 days. Job history: 30 days.

Security audit records: 12 months.

An invitation that is not accepted expires after 30 days, and the address is removed from the invitation record. Accepted and withdrawn invitations go on the same schedule: the membership itself and the record of who invited whom survive without needing to keep the address. None of this touches an address held as account data, which follows the line above.

These periods are executed by a scheduled job rather than promised by this page.

Your rights

Access and portability: every workspace can export its own data at any time, without asking us.

Deleting your account — the product feature: you can ask for deletion from inside ChangeSignal. The account is then restricted rather than removed, for 30 days, and you can cancel the request during that time. This is a product convenience and a guard against a deletion nobody meant; it is not the statutory right below, and the two are not the same thing.

Erasure — the statutory right: separately, you can ask us to erase your personal data under Article 17. That right is not subject to our 30-day window, and it is not exercised through the button in the product. Write to the address in the legal notice.

Restriction: under Article 18 you can ask us to restrict processing — for example while you contest whether data we hold is accurate, or while an objection under Article 21 is being considered. Restricted data is kept but not otherwise used.

When an account is erased we also instruct our email provider to remove the suppression record it holds for that address, and we retry until it confirms. That removal is checked against production rather than assumed.

Some records survive an erasure in redacted form: the ledger that stops a duplicated payment webhook being processed twice keeps its identifier, with the workspace, the recipient reference and the free text removed. Payment records that tax law requires our payment provider to keep are kept by them.

Where a request reaches data held by a provider rather than by us — for example mail our email provider transmitted — we pass the request on to them as well, rather than waiting for their retention period to expire. Expiry is not the same as having acted.

Rectification and objection: write to the address in the legal notice. Your display name you can change or remove yourself, on your profile page.

You may complain to the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, which supervises the non-public sector in Bavaria.