Privacy policy
1. Who we are and what this policy covers
Signals is a recruitment platform operated by Recruit With Signals Limited, a company registered in Hong Kong with its registered office in Causeway Bay, Hong Kong SAR. In this policy, Signals, we and us mean Recruit With Signals Limited.
We handle personal data in two distinct roles, and the difference decides which document applies to you.
As a controller, we decide why and how personal data is used. This covers people who visit our website, sign up for an account, use Signals as a named user, contact us, or hear from us about the product. This policy describes that data, and only that data.
As a processor, we hold data on behalf of a recruitment agency that uses Signals. Candidate records, client contacts, notes, messages, documents and anything else an agency puts into its workspace belong to that agency. The agency is the controller of that data and decides what happens to it. We act on its instructions under our Data Processing Agreement, which governs that relationship in full. If you are a candidate or a client contact asking about data an agency holds about you, the agency is who to ask, and our Data Processing Agreement sets out the terms we work to.
2. The data we hold as controller
We collect the following categories of personal data about our own users, prospects and website visitors.
- Account data. Name, work email address, phone number, job title, employer and the workspace you belong to.
- Authentication data. Login credentials, single sign-on identifiers and session tokens.
- Billing data. Billing contact, billing address, plan, invoices and payment status. Card details are handled by our payment provider and are not stored by us.
- Usage and device data. Pages and features used, actions taken in the product, IP address, browser and device type, and approximate location derived from IP address.
- Support and correspondence. Messages you send us, support tickets, and notes from calls and meetings with our team.
- Marketing data. Contact details you give us, event and webinar registrations, and your communication preferences.
If you connect a Google account, we also hold the Gmail and Calendar data described under Google user data below. If you connect a Microsoft 365 account, we also hold the Outlook mail and calendar data described under Microsoft user data below.
We do not ask for special category data about our own users, and Signals is not intended for anyone under 18.
3. How we use your data
We use demo booking information solely to contact you about access to Signals. We use account, workspace and technical data to provide the product, support you, secure the service against abuse, and improve the features you use. We do not sell your data, and we do not use it for advertising. Use of data obtained from Google APIs is governed by Google user data and Limited Use below, which take precedence over this section wherever they are narrower. Use of data obtained from Microsoft Graph is governed by Microsoft user data below, on the same terms.
4. Your rights
Depending on where you live, you have some or all of the following rights over the data we hold as controller: access to a copy of it, correction of it, deletion of it, restriction of how we use it, portability of it in a machine readable form, objection to processing based on legitimate interests, objection to direct marketing at any time, and withdrawal of consent where our use rests on consent.
To exercise any of these, write to privacy@recruitwithsignals.com. We will respond within the period set by the law that applies to you, and within one month where the UK GDPR or EU GDPR applies. We may ask for enough information to confirm who you are. We do not charge for this, and we will not treat you differently for asking.
Where an individual whose data is held in an agency's workspace wishes to exercise a right over it, the agency is the controller and the request should be directed to them. If a request reaches us directly, we will pass it to the relevant agency and tell the individual we have done so.
5. Recording and capturing conversations
Signals can record, transcribe and summarise calls and meetings when an agency turns those features on. Recordings, transcripts and summaries created inside a workspace are the agency's data, and we hold them as a processor under the Data Processing Agreement.
Rules on recording and capturing conversations differ by jurisdiction, and in some countries by state. The agency is responsible for meeting the requirements that apply where it operates, including obtaining consent where consent is required.
Where a recording or a candidate profile is captured using the Signals browser extension, section 16 sets out exactly what that extension reads, what it sends, and when.
Google user data
Signals connects to your Google account with your explicit consent so that it can surface candidate and client signals from your email and calendar, and act on them when you ask it to. We request the following scopes, and only these:
openid, email and profile
Identity, to sign you in, identify your account, and show your name and profile
picture in the app.
https://www.googleapis.com/auth/gmail.readonly
Read messages and metadata.
https://www.googleapis.com/auth/gmail.send
Send email as you.
https://www.googleapis.com/auth/calendar.events
Read, create, update and delete calendar events.
You can revoke access at any time from your Google Account permissions page or from within Signals.
What we access. From Gmail: message metadata (sender, recipient, subject, timestamp, thread ID) and message bodies from the mailbox you connect. From Google Calendar: events on your primary calendar. Signals can also send email on your behalf and create, update or delete calendar events, but only in response to an action you take in the product.
How we use it. Solely to provide and improve the features you see in Signals, extracting candidate, client and role information, generating the summaries and signals shown in your workspace, and sending the email or making the calendar changes you direct it to. We do not use Google user data for advertising, and we do not sell it.
AI processing. To produce the summaries, extractions and signals you see in Signals, message and event content is processed by third-party AI providers acting as our subprocessors under contract. This data is not used to develop, improve or train generalized artificial-intelligence or machine-learning models, whether ours or our providers'. Human review is limited to the circumstances described under "Human access" below.
How we store it. Encrypted at rest and in transit. Disconnecting your Google account revokes our access and deletes the stored credential immediately. Data already derived from your mailbox is retained while your account is active and deleted on request.
How we share it. We do not transfer Google user data to third parties except as necessary to provide or improve the Signals features you use, to comply with applicable law, or as part of a merger or acquisition. Any subprocessors are bound by contractual confidentiality and security obligations.
Human access. Signals staff do not read your Google user data except where you give explicit consent (for example, to resolve a support issue you have raised), where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.
Limited Use
Signals' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft user data
Signals connects to your Microsoft 365 account with your explicit consent so that it can surface candidate and client signals from your email and calendar, and act on them when you ask it to. We request the following Microsoft Graph permissions, and only these:
openid, email and profile
Identity, to sign you in, identify your account, and show your name and profile picture
in the app.
offline_access
Keep your connection active so Signals can keep your inbox and calendar up to date
without asking you to sign in again.
User.Read
Read your basic Microsoft 365 profile.
Mail.Read
Read messages and metadata.
Mail.Send
Send email as you.
Calendars.ReadWrite
Read, create, update and delete calendar events.
MailboxSettings.Read
Read your time zone and working hours, so times show correctly. Read only; Signals
cannot change mailbox settings.
Tasks.ReadWrite
Reserved for a later Microsoft To Do integration. Signals does not read or write your
tasks today. We ask now so your administrator only needs to approve Signals once.
You can revoke access at any time from the My Apps page of your Microsoft account or from within Signals. If you use a work or school account, your organisation's Microsoft 365 administrator may need to approve Signals before you can connect it, and can also remove its access for everyone in your organisation.
What we access. From Outlook mail: message metadata (sender, recipient, subject, timestamp, conversation ID) and message bodies from the mailbox you connect. From Outlook calendar: events on your default calendar. Signals can also send email on your behalf and create, update or delete calendar events, but only in response to an action you take in the product.
How we use it. Solely to provide and improve the features you see in Signals, extracting candidate, client and role information, generating the summaries and signals shown in your workspace, and sending the email or making the calendar changes you direct it to. We do not use Microsoft user data for advertising, and we do not sell it.
AI processing. To produce the summaries, extractions and signals you see in Signals, message and event content is processed by third-party AI providers acting as our subprocessors under contract. This data is not used to develop, improve or train generalized artificial-intelligence or machine-learning models, whether ours or our providers'. Human review is limited to the circumstances described under "Human access" below.
How we store it. Encrypted at rest and in transit. Disconnecting your Microsoft account deletes the credential Signals holds for you and stops its access to your mailbox and calendar. That applies to your own account; to remove Signals for everyone in your organisation, your IT administrator removes it in Microsoft, under Entra, Enterprise applications. Data already derived from your mailbox is retained while your account is active and deleted on request.
How we share it. We do not transfer Microsoft user data to third parties except as necessary to provide or improve the Signals features you use, to comply with applicable law, or as part of a merger or acquisition. Any subprocessors are bound by contractual confidentiality and security obligations.
Human access. Signals staff do not read your Microsoft user data except where you give explicit consent (for example, to resolve a support issue you have raised), where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymised.
Microsoft APIs Terms of Use. Signals' use of information received from Microsoft Graph adheres to the Microsoft APIs Terms of Use.
7. Service providers and sub-processors
We use a small number of providers to run Signals: cloud hosting and storage, email delivery, payment processing, product analytics, customer support tooling, and AI model providers. They act on our instructions, may use the data only to provide their service to us, and are bound by written terms.
We do not sell personal data, and we do not share it for cross context behavioural advertising. We may disclose data where we are required to by law, to enforce our agreements, or in connection with a merger, acquisition or sale of assets, in which case we will tell affected customers.
The current list of sub-processors used for workspace data is maintained with the Data Processing Agreement, and is available on request from privacy@recruitwithsignals.com.
8. International transfers
Signals is operated from Hong Kong and our providers operate in several regions, so personal data may be transferred to and stored in countries other than your own.
Where data leaves the EEA or the UK, we rely on appropriate safeguards, including Standard Contractual Clauses where they apply, together with encryption and access controls. For other transfers we rely on contractual safeguards requiring a standard of protection comparable to that of your home jurisdiction.
9. How long we keep data
We retain account data for as long as your account is active. When you close your account or ask us to delete your data, we remove it from production systems within 30 days, after which it ages out of encrypted backups on our normal backup cycle.
We keep billing and tax records for as long as accounting and tax law requires, and we keep limited records needed to establish or defend legal claims. Workspace data is retained on the agency's instructions under the Data Processing Agreement. Retention of Google user data is described under Google user data above, and retention of Microsoft user data under Microsoft user data above.
10. Security
We protect personal data with encryption in transit and at rest, role based access control, least privilege for staff accounts, audit logging, environment separation, and regular review of our providers and our own code.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities without undue delay and as required by applicable law. Where we act as processor, we will notify the affected agency so it can meet its own obligations.
11. Cookies and similar technologies
We use strictly necessary cookies to keep you signed in and to keep the service secure, and analytics cookies to understand how the website and product are used. Analytics cookies are set only with your consent where consent is required.
You can change your choices at any time in your browser settings or through our cookie preferences. Our Cookie Policy lists the cookies we set and what each one does.
12. Marketing communications
We send product news and occasional research to business contacts who have asked to hear from us, or who work at agencies that fit the product. Every message carries an unsubscribe link, and you can opt out at any time by using it or by writing to privacy@recruitwithsignals.com. Opting out of marketing does not stop service messages about your account, billing or security.
13. Applicable law
This policy is written to meet the Personal Data (Privacy) Ordinance in Hong Kong, the Personal Data Protection Act in Singapore, the Privacy Act and Australian Privacy Principles in Australia, the UK GDPR and Data Protection Act in the United Kingdom, the EU GDPR in the European Economic Area, and applicable United States state privacy laws.
Where a law that applies to you gives you stronger rights than this policy describes, that law prevails and we will honour it.
14. Changes to this policy
We update this policy when the product or the law changes. The date at the top of the page shows when it last changed. If a change materially affects how we use your personal data, including any change to the Google scopes or the Microsoft Graph permissions we request, we will tell account holders by email or in the product before it takes effect.
15. How to contact us
Recruit With Signals Limited, Causeway Bay, Hong Kong SAR.
For privacy questions and data requests, write to privacy@recruitwithsignals.com. For anything else, write to hello@recruitwithsignals.com. If your question concerns data held in an agency's workspace, contact that agency, and the terms we work to are set out in our Data Processing Agreement.
16. The Signals browser extension
Signals offers an optional Chrome extension. It is installed by the recruiter, and it does two things: it records a call happening in a browser tab, and it captures a candidate profile you are looking at. Both are started by you, and neither runs on its own.
The extension does not collect data in the background. It does not browse, visit profiles, send connection requests or messages on your behalf, export lists in bulk, track your browsing history, or read pages you have not invoked it on. Nothing leaves your browser except what you asked it to send.
Recording a call. Clicking the Signals icon in the toolbar starts a recording of that tab. It captures the tab's audio together with your microphone, mixes them, and uploads the result to your workspace library, where it is transcribed by an AI provider and summarised. Nothing is captured before you click, and nothing is captured from any other tab. Recordings, transcripts and summaries are the agency's data, held by us as a processor. The responsibility for obtaining consent where the law requires it is set out in section 5, and it does not change because the recording was started from a browser extension.
Capturing a profile. On a LinkedIn profile page, the extension shows a panel with the person's name and headline so you can see what would be saved. That reading happens on your screen only. Nothing is stored or transmitted until you press save. When you do, it sends the profile's public URL and identifier, the name, headline, location, current company, current title, About text and profile picture address, along with the address, title and text of the page you saved it from.
A saved profile is private to you. It is written to your own records, not to the agency's shared workspace, and is visible to the agency only if you later promote it into the workspace CRM. We do not request or capture anything behind a login that you cannot already see yourself, and we do not gather data from LinkedIn other than the page you are on when you press save.
What the extension keeps on your device. Your Signals sign-in session, so you are not asked to sign in on every page, and the state of a recording in progress. Both are held in the browser's extension storage, are not readable by the websites you visit, and are removed when you sign out or uninstall.
The permissions it asks for, in plain terms. To capture the audio of the tab you invoked it on, and to place the recorder panel on that page. To show the capture panel on LinkedIn profile pages. To sign you in to Signals. To keep the session and the recording state described above. To show recording time on the toolbar icon. It asks for no access to any other site.
Signing in. You can sign in to the extension in two ways. Either with your email address and password, typed into the extension's own settings page and sent to our authentication service to be checked — the extension does not keep your password, only the session described above — or with Google sign-in, in which case the Google user data involved is described in section 6, on the same terms.
The providers who process recordings and transcripts are covered by section 7. Your rights over this data, and how to exercise them, are unchanged and set out in section 4.