Privacy Policy

Last updated: August 2026

Signals is a revenue-first, AI-native recruitment ATS and CRM for recruitment agencies. It connects to the tools a recruiter already works in, email and calendar, and turns that activity into organised candidate, client and role records, surfacing what to act on next.

This policy explains what data Signals collects, how we use it, who we share it with, and the rights you have over it. It covers both the Signals application and our website at recruitwithsignals.com. Signals is operated from Hong Kong SAR. If you connect a Google account to Signals, please read Google user data. That section governs how we handle information obtained from Google APIs.

Your agency and Signals

Signals is sold to recruitment agencies. If you use Signals through your agency, your agency decides what goes into its workspace and how it is used, and Signals processes that data on the agency's behalf under a data processing agreement. In practice this means requests to access, export or delete workspace records may be directed to your agency, and we act on your agency's instructions.

This does not affect the control you have over your own Google account. You can disconnect it at any time yourself, and you can ask us directly to delete the data we derived from your mailbox. See Your rights and deleting your data below.

What we collect

Demo booking form. When you submit our demo booking form, we collect your name, agency name, work email address, and optional WhatsApp number.

Account data. When you create a Signals account, we collect your name, work email address, the agency or workspace you belong to, and your role and permissions within it. If you sign in with Google, we receive your name, email address and Google account identifier.

Workspace content. The candidate, client, role and note records you and your colleagues create in Signals, together with any records Signals derives from a connected email or calendar account.

Google user data. If you connect a Google account, the Gmail and Calendar data described under Google user data below.

Technical and usage data. IP address, browser and device type, and logs of actions taken in the product. We use these to keep the service running, secure and debuggable.

We do not collect special category or sensitive personal data, and we do not ask you to provide it.

How we use your data

We use demo booking information solely to contact you about access to Signals. We use account, workspace and technical data to provide the product, support you, secure the service against abuse, and improve the features you use. We do not sell your data, and we do not use it for advertising. Use of data obtained from Google APIs is governed by Google user data and Limited Use below, which take precedence over this section wherever they are narrower.

Signals connects to your Google account with your explicit consent so that it can surface candidate and client signals from your email and calendar, and act on them when you ask it to. We request the following scopes, and only these:

openid, email and profile
Identity, to sign you in, identify your account, and show your name and profile picture in the app.

https://www.googleapis.com/auth/gmail.readonly
Read messages and metadata.

https://www.googleapis.com/auth/gmail.send
Send email as you.

https://www.googleapis.com/auth/calendar.events
Read, create, update and delete calendar events.

You can revoke access at any time from your Google Account permissions page or from within Signals.

What we access. From Gmail: message metadata (sender, recipient, subject, timestamp, thread ID) and message bodies from the mailbox you connect. From Google Calendar: events on your primary calendar. Signals can also send email on your behalf and create, update or delete calendar events, but only in response to an action you take in the product.

How we use it. Solely to provide and improve the features you see in Signals, extracting candidate, client and role information, generating the summaries and signals shown in your workspace, and sending the email or making the calendar changes you direct it to. We do not use Google user data for advertising, and we do not sell it.

AI processing. To produce the summaries, extractions and signals you see in Signals, message and event content is processed by third-party AI providers acting as our subprocessors under contract. This data is not used to develop, improve or train generalized artificial-intelligence or machine-learning models, whether ours or our providers'. Human review is limited to the circumstances described under "Human access" below.

How we store it. Encrypted at rest and in transit. Disconnecting your Google account revokes our access and deletes the stored credential immediately. Data already derived from your mailbox is retained while your account is active and deleted on request.

How we share it. We do not transfer Google user data to third parties except as necessary to provide or improve the Signals features you use, to comply with applicable law, or as part of a merger or acquisition. Any subprocessors are bound by contractual confidentiality and security obligations.

Human access. Signals staff do not read your Google user data except where you give explicit consent (for example, to resolve a support issue you have raised), where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.

Signals' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share data with

We share data only with subprocessors who help us run Signals: cloud hosting and database providers, the third-party AI providers described above, and error-monitoring and support tooling. Each is bound by contract to confidentiality, security and purpose-limitation obligations, and none is permitted to use your data for its own purposes. A current list of subprocessors is available on request from hello@recruitwithsignals.com.

We may also disclose data where required by law, to enforce our terms, or in connection with a merger or acquisition. We do not sell personal data to anyone.

International transfers

Signals is operated from Hong Kong SAR and serves agencies across Hong Kong, Singapore and Australia. Some of our subprocessors, including our cloud hosting and AI providers, process data outside your jurisdiction. Where data is transferred across borders, we rely on contractual safeguards requiring a standard of protection comparable to that of your home jurisdiction.

Data retention

We retain account and workspace data for as long as your account is active. When you close your account or ask us to delete your data, we delete it from our production systems and it ages out of encrypted backups on our normal backup cycle. Demo booking entries are kept until you ask us to remove them. Retention of Google user data is described under Google user data above.

Security

Data is encrypted in transit and at rest. Access to production systems is restricted to staff who need it, authentication credentials and OAuth tokens are stored encrypted, and access is logged. No system is perfectly secure, but we work to a standard appropriate to the sensitivity of recruitment data.

You have the right to access, correct, export or request deletion of your personal data at any time, and to withdraw consent for any connected account. To disconnect a Google account, use the connection settings in Signals or your Google Account permissions page. To request deletion of your Signals account and all associated data, including anything derived from a connected mailbox, email hello@recruitwithsignals.com. We respond to requests within 30 days.

Cookies

Our use of cookies is described in our Cookie Policy.

Children

Signals is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16.

Applicable law

This policy complies with the Personal Data (Privacy) Ordinance (Hong Kong), the Personal Data Protection Act (Singapore), and the Privacy Act 1988 (Australia).

Changes to this policy

We may update this policy as Signals develops. We will change the "last updated" date above, and where a change materially affects how we handle your data, including any change to the Google scopes we request, we will notify you before it takes effect.

Contact

Privacy questions and data requests: hello@recruitwithsignals.com
Anything else: hello@recruitwithsignals.com