Roles
You (the agency or business with a 1Signal account) are the controller of the personal data you bring in: your clients’ contacts, the people who answer your ads, and the data in a Meta ad account or CRM you connect. FounderScale LLC, operating 1Signal, is your processor and acts only on your documented instructions, which are the terms, this addendum and what you do in the app.
What we process and why
- Account data: names, emails and sign in records of the people you invite.
- Client data: the answers you give about a client’s offer, and the client’s own answers.
- Campaign data: ad metrics read from the Meta ad account you connect, and the ads we create in it.
- Lead data: form answers, contact details and, where you turn it on, call transcripts of people who respond to a test.
We process it to run and report the tests you approve, to draft lines and images for you to review, and to keep the account working. We do not sell it, use it to market to your clients, or train models on it.
Security
The measures we apply, and the ones not in place yet, are listed on 1signal.io/security, which is kept current and forms part of this addendum. Access to customer data by our staff is limited to support and operations, is logged, and is visible to the client in their access log.
Subprocessors
The current list, with location and purpose, is the subprocessor section of 1signal.io/security. We add a new subprocessor to that page at least 14 days before it processes customer data. If you object on reasonable data protection grounds and we cannot resolve it, you may end the service and we refund any prepaid unused period.
International transfers
Customer data is stored in Germany. FounderScale LLC is in the United States, and some subprocessors (for example Anthropic, Meta, Stripe and Cloudflare) are US companies; transfers to them rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.
Helping you with requests
If a person asks you for access, correction or deletion of their data and the data is in 1Signal, we help within 10 business days. Deletion is described on data deletion.
Personal data breach
If we confirm a breach affecting your personal data, we notify you without undue delay and at the latest within 72 hours of confirming it, with what happened, what data, what we did and what we recommend, and we update you as we learn more.
When the service ends
When you close your account, or on request, we delete your personal data within 30 days, except what the law requires us to keep (for example invoices), and we ask subprocessors to delete their copies where their tools allow it. On request before deletion we export your data in a common format.
Audit
Once a year, on 30 days’ notice, you may ask us written questions about this addendum and we answer them. We have no independent audit report yet; when we do, we share it under this clause instead.
A signed copy
Email [email protected] with your legal entity name and address and we return a countersigned PDF of this addendum.