Privacy Policy

Effective date: 8 October 2026

Signal Studio ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information, in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) ("PDPL") and oversight by the UAE Data Office.

Legal Basis for Processing

We process your personal data on the basis of your consent, the performance of our contract with you (providing the service and billing), our legitimate business interests (such as preventing fraud and abuse), and compliance with legal obligations.

Information We Collect

We collect information you provide directly: company name, email address, and payment information. We collect the brand materials you submit: your website address, uploaded logos, brand books, fonts and product images, and the campaign text you write. We also collect usage data such as banners generated and sessions created, the marketing source you arrived from, your device type, your IP address at sign-up, and a browser identifier used to prevent repeated free trials.

How We Use Your Information

We use your information to provide and improve our services, process payments, send service-related emails, and respond to your requests.

Data Storage

Your data is stored securely using Supabase (EU region). Payment information is processed by Armitage Labs OÜ (trading as Creem), our Merchant of Record, and is never stored on our servers. Creem handles card details, billing, invoicing and applicable VAT/sales tax. See Creem's Terms of Service and Privacy Policy at creem.io for details.

Cross-Border Data Transfer

As permitted under the PDPL, some of your data is stored or processed outside the UAE (for example, Supabase in the EU and Creem for payments). We only transfer data to jurisdictions and providers that offer an adequate level of protection or under appropriate contractual safeguards.

Brand Assets

Logos, brand books, product images and website content you provide are stored securely and used solely to produce the creative you ask for. We do not sell your assets, do not publish them, and do not use them to train any AI model.

Producing a banner is not possible without sending your brand assets and campaign text to the AI providers that generate the image and write the creative brief. We therefore share them only with the service providers listed below, only to the extent needed to deliver what you requested, and subject to those providers' data-processing terms.

Service Providers

We use the following processors. Each receives only the data needed for its function:

• Supabase (EU) — account data, brand kits, generated banners, uploaded files.
• Anthropic (Claude) — your brand description, campaign text and website content, to write the creative brief and analyse your brand.
• fal.ai — the brief plus your product photo and logo, to render the banner image. The image model used is operated by Google through fal.ai.
• Armitage Labs OÜ, trading as Creem — payment, billing and tax. Card details go to Creem directly and never reach our servers.
• Resend — sending transactional email (for example, your demo banner).
• Telegram — internal operator notifications about new sign-ups and orders. These can include your email address and brand name.
• PostHog (EU), Google Analytics, Meta Pixel, Sentry — product analytics and error reporting, described below.

Analytics, Session Recording and Cookies

We use PostHog (EU region) to understand how the product is used: page views, feature events such as starting a demo or generating a banner, the marketing source you arrived from, your device type, and an anonymous identifier stored in your browser. After you create an account, these events are linked to your account identifier.

PostHog also records session replays — a reconstruction of your clicks, scrolling and navigation on our site, used to find where the product is confusing or broken. All text you type into any field is masked before it leaves your browser, so passwords, email addresses and website URLs are not captured in recordings.

We also use Google Analytics (traffic measurement), the Meta Pixel (measuring the results of advertising on Facebook and Instagram, which may involve Meta matching the event to your Meta account), and Sentry (collecting technical details of errors, including browser, page and error message). These tools set cookies or similar browser storage. You can block them with your browser settings or an ad blocker; the product continues to work.

Your Rights

Under the PDPL you have the right to access your personal data, request its correction or deletion, restrict or object to processing, withdraw consent, and request that your data be transferred. To exercise these rights, or to complain about how we handle your data, contact us at hello@signal-studio.app. You may also lodge a complaint with the UAE Data Office.

Data Retention & Deletion

We keep your data only as long as needed to provide the service and meet legal obligations. You may request deletion of your account and all associated data at any time by contacting us at hello@signal-studio.app. Data is deleted within 7 days of account cancellation, except where we must retain limited records (e.g. invoices) to comply with UAE law.

Contact

For privacy questions, contact us at hello@signal-studio.app