This policy explains what HISO does with the personal data of people who sign up for and use Signaaal. We do not sell personal data.
Who we are
HISO ("we"), CVR 40992790, Horsvangen 9, 7120 Vejle Øst, Denmark, is the data controller for the data described here. Contact us at support@hiso.io.
Two roles
We are the controller of data about people who use the Signaaal dashboard, such as your account and billing details. This policy covers that data.
We are a processor of data our customers put into Signaaal about their own users. Each customer decides how that data is used, and our Data Processing Agreement applies. If you use a page a Signaaal customer runs, read that customer's privacy policy and contact them first.
What we collect and why
| Data | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|
| Name, email address, hashed password, profile picture | To run your account | Contract | Until you delete your account, then anonymized |
| Preferences: theme, language, time zone, notification choices | To apply your settings | Contract | Until you delete your account |
| Two-factor secret and backup codes | To protect your account | Contract | Until you turn two-factor off or delete your account |
| Organizations, roles, and invitations, including an invited person's email address | To run organizations and let people join them | Contract; legitimate interests | Until the organization or invitation is removed |
| Which version of the Terms you accepted, and when | To show what you agreed to | Legitimate interests | Kept after deletion, on your anonymized record |
| Sessions: IP address, browser, last used | To show your sessions and let you end them | Contract; legitimate interests | Until the session ends |
| Sign-in attempts: email address, IP address, browser, result | To protect accounts and stop password guessing | Legitimate interests | 90 days |
| Records of API requests: who acted, the action, IP address, browser, and the request's content | To investigate security issues, abuse and faults | Legitimate interests | 12 months |
| Plan, subscription status and Stripe references | To take payment and apply your plan | Contract | While the organization exists |
| Invoices and bookkeeping records | To meet accounting rules | Legal obligation | 5 years from the end of the financial year |
| Support requests | To help you | Contract; legitimate interests | As long as we need them to help you |
| Error reports and logs | To find and fix faults | Legitimate interests | Our error-tracking provider's standard retention period |
| Queued messages, which can hold your name and email address | To send you the emails below | Contract | 90 days |
We never see your full card number. Stripe collects it, along with your billing address and any VAT number.
"Legitimate interests" here means keeping Signaaal secure, preventing abuse and fixing faults.
Emails we send
Service emails are needed to run your account: invitations, password resets, and security and billing notices. You cannot switch these off, except where your notification settings offer it.
News emails cover new features, updates and guides, and are sent through an email marketing provider. You can turn them off in your notification settings or through the link in each email. Our basis is our legitimate interest in telling existing customers about our own similar services.
Who we share data with
We share personal data with the providers who run Signaaal for us, under contracts that protect it. Those that hold customer data are listed on our Subprocessors page. Other people in your organization can see your name, email address and role.
We disclose data when the law requires it, or to establish or defend a legal claim. If our business moves to a new owner or company, your data moves with it, and we will tell you.
Transfers outside the EU
Some of our providers are based outside the EU or EEA. When data leaves the EU or EEA, we rely on an adequacy decision, such as the EU-US Data Privacy Framework, or on the European Commission's Standard Contractual Clauses.
Cookies
We use only the cookies the dashboard needs. We use no analytics or advertising cookies, and the signaaal.com website sets none.
| Cookie | Purpose | Lasts |
|---|---|---|
| Session cookies | Keep you signed in | 7 days, renewed while you use Signaaal |
sidebar_state | Remember whether you collapsed the sidebar | 7 days |
last_organization | Return you to the organization you last used | 1 year |
Deleting your account
You can delete your account from your profile. We then erase your name, email address, picture and login, and sign you out everywhere.
An anonymized record stays so that records pointing to it still make sense, and it no longer identifies you. Security records and bookkeeping records follow the periods in the table above.
Your rights
You have the right to:
- see the data we hold about you and get a copy;
- correct it;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent, where we rely on it.
Write to support@hiso.io. We reply within one month.
You can also complain to the Danish Data Protection Agency, Datatilsynet.
We make no decisions about you by automated means alone that have legal or similarly significant effects.
Children
Signaaal is for businesses, and you must be at least 18 to use it.
Changes to this policy
Each version is dated and published at signaaal.com/legal/privacy, and earlier versions stay readable there. We will email you about any significant change before it takes effect.