Privacy Policy

1. Introduction & Data Controller

This Privacy Policy explains how SignOff Pilot (“we”, “us”, “our”), a commercial brand operated by an individual software creator and operator established in Romania, collects, processes, stores, and protects personal data when you visit https://www.signoffpilot.com, create an account, or use our visual feedback and sign-off platform. SignOff Pilot is a trading name, not a separate legal entity. The data controller is the individual operator identified in Section 9.

We act as the Data Controller for account registration, workspace profile data, and direct customer support communications. With respect to the website content, client feedback comments, and staging pages reviewed using the Service, the agency is the Data Controller, and the individual operator behind SignOff Pilot acts as a Data Processor.

2. Information We Collect

We collect only the minimum personal and operational data necessary to deliver the Service:

3. Financial & Payment Information

4. How We Use Your Information

Under GDPR Article 6, we rely on the following legal bases: performance of a contract (Article 6(1)(b)) for account creation, delivery of the Service, support, and certificates; legitimate interests (Article 6(1)(f)) for security, abuse prevention, service improvement, and legal claims; compliance with a legal obligation (Article 6(1)(c)) for tax, accounting, and record-keeping; and consent (Article 6(1)(a)) where we specifically ask for it, which you may withdraw at any time.

We process personal data for the following purposes:

• Providing the Service: Enabling review toolbar functionality, storing visual feedback pins, managing project revision rounds, and generating verifiable PDF sign-off certificates;
• Authentication & Account Administration: Delivering secure Magic Link login tokens and managing agency workspace preferences;
• Transactional Notifications: Sending automated email updates when feedback is submitted or when a project has been officially approved;
• Security & Abuse Prevention: Enforcing API rate limits, detecting unauthorized access, and maintaining server availability;
• Legal Compliance: Retaining proof of client acceptance and satisfying legal or tax record-keeping requirements.

We never sell, rent, or trade your personal data or your clients’ feedback data to third parties for advertising or commercial marketing purposes.

5. Third-Party Service Providers

We partner with trusted third-party cloud infrastructure providers to operate the Platform. Paddle acts as Merchant of Record and as an independent controller for payment and billing data, not as our processor. The other providers listed below act as processors on our behalf under Article 28 GDPR.

6. Cookies & Local Storage

SignOff Pilot utilizes strictly necessary session cookies to maintain secure authentication state across dashboard sessions. We do not use third-party behavioral advertising cookies, tracking pixels, or cross-site tracking technologies.

The feedback toolbar uses browser local storage strictly to remember the reviewer name entered in the comment form on the user’s device, so the reviewer does not have to re-enter it during an active review session. It is not used for tracking or advertising.

7. Data Retention & Security Measures

Data Retention: Account data is retained while your account is active and for any additional period required by tax, accounting, or legal-claims obligations. Project feedback data, comments, and approval certificates are retained for as long as your agency maintains the project or account. If an agency deletes a project or requests account closure, associated project data is removed from active database tables, subject to backup and legal-retention requirements. Cryptographic hash records of completed sign-off certificates may be retained in read-only audit tables for auditability. Security logs are retained only for the period necessary to detect and investigate security incidents.

Security: All communication between your browser and our servers is encrypted in transit using Transport Layer Security (TLS/HTTPS). Database tables have Row Level Security enabled, and application access is restricted to server-side credentials.

International transfers: Some providers may process personal data outside the European Economic Area. Where GDPR Chapter V applies, transfers are covered by an appropriate safeguard, such as an adequacy decision or the Standard Contractual Clauses made available by the provider. You can request more information using the contact details in Section 9.

8. Your Rights (GDPR & Global Privacy)

Under applicable privacy laws (including GDPR and European regulations), you have the right to:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or incomplete personal data;
• Request erasure of your personal data (“right to be forgotten”);
• Request restriction of or object to data processing;
• Request data portability in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with the Romanian supervisory authority (ANSPDCP) at https://www.dataprotection.ro.

To exercise any of these rights, please contact us at support@signoffpilot.com. We respond to verifiable requests within one month, extendable by up to two further months where necessary. If your request concerns feedback data submitted to an agency, please contact that agency first; we will assist it as processor.

9. Contact Information

We may update this Privacy Policy to reflect changes in the Service or legal requirements. The “Last updated” date at the top shows the current version. Material changes will be notified through the Service.