Privacy Policy

Account details you give us: your email address and, if you create an account, a password we store only as a hash.

Order details: what you bought, when, and for how much. Card details are handled entirely by our payment processor and never reach our servers.

Your currency: Cloudflare tells us which country your connection comes from, and we use that to show and charge pounds, euros or US dollars. We keep the currency of an order, not the country.

Download activity: when you download a plug-in you own or are trying, we record which installer, when, and the network address and browser it was requested from, so we can support you and detect abuse. The network address and browser are deleted after 12 months; the record of which installer and when stays with your account. The free installers ask you to sign in, but we keep no record of who downloaded them: we only count how many times each installer is downloaded each day.

Signing in: while you are signed in, we keep the network address and browser of that sign-in, to protect your account. The record is deleted 30 days after the sign-in expires.

Release-email signups: if you ask for our occasional release email, we store that address, the date you asked, which form you used and the wording it showed you, and - as evidence that the request was real - a one-way hash of the network address it came from and the browser that sent it. We cannot recover the original address from that hash.

To keep automated signups out, the signup forms use Cloudflare Turnstile, which checks that a form is being used by a person rather than a script. It loads only when you start using one of those forms. To make the check, Cloudflare receives signals from your browser, such as your IP address and browser details, and uses them to detect automated traffic, as described in Cloudflare's Turnstile privacy addendum. We record only that the check was passed, not what it looked at.

Asking for it is enough - we do not send a confirmation message, and there is no second step. The address goes on the list when the form is submitted, and we record the date and the evidence described above.

Every message carries an unsubscribe link that never expires and needs no sign-in. One click stops it. Because there is no confirmation step, that link is the only thing standing between you and mail you did not ask for, so it is on every message without exception.

What it carries: news when something ships, and updates - and sales and discounts only to people whose sign-up form said it would include them. We keep the record of which of these emails was sent to your address, so that none is sent twice, for 90 days.

If you unsubscribe we keep the record of having done so, rather than deleting it - that is what stops the same address being added again by a later signup, including one made by somebody else. Signing up again from the form will not undo it; write to us and we will put you back on by hand. Ask us to erase it instead and we will remove the row entirely.

If you start a free trial from inside a plug-in, we email you twice: about three days before it ends, and the day after it ends. Each says which trial, when it ends or ended, what that means for the sessions that use it, and where to buy the plug-in. We send them to the address you signed in with inside the plug-in, and not if you have bought that plug-in since.

Why, and on what basis: so that a trial you started does not end without warning, and so that you know why a session that uses it then sounds different - our legitimate interest in telling you about the service you asked for (UK GDPR Article 6(1)(f)). They are not marketing: they carry no offer and name no other plug-in.

Every one has a link that stops them: one click, no sign-in, and it never expires. We keep the record that you asked, so that the choice holds, until you delete your account.

We keep the record that each was sent, so that none is sent twice, for 90 days.

If you choose Accept all, or switch Analytics on under Choose, we keep a random ID in your browser's local storage and record: the pages you visit on this site; the plug-ins and bundles you look at and add to your cart; when you start a checkout, create an account, sign in or click a download; and where your visit came from - the campaign or advert named in the link you followed, or the name of the website that sent you. If you sign in, we link that browser's record to your account; when you start a checkout - whether or not you go on to pay - we link it to that order. That is how we tell which adverts and pages lead to trials and purchases.

Why, and on what basis: to learn which of our adverts, posts and pages actually help people find a plug-in they want, and to improve the site - on the basis of your consent (UK GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for the local storage). Nothing is set and nothing is recorded until you choose; refusing changes nothing about how the site works for you.

How long: the page-by-page detail is deleted after 90 days. The record of where a visit came from is deleted after 13 months, counted from that visit - including the copy kept with an order. The link between this browser and your account is deleted after 13 months from the last time you were signed in here, and its link to an order after 13 months from that checkout. The record that you gave or withdrew consent (a random ID, whether you gave or withdrew it and for what, the version of the wording you saw, and the date - nothing else) is deleted after 25 months. We keep that record even after you withdraw, as evidence that we asked for your permission and honoured your choice: UK GDPR requires us to be able to show that consent was given, and our basis for keeping the record after a withdrawal is our legitimate interest in demonstrating that and in answering any complaint about it (UK GDPR Article 6(1)(f)). It is used for nothing else. Deletion is automatic, every day.

Changing your mind: choose Privacy choices at the foot of any page and switch Analytics off. That deletes this browser's ID and everything we recorded against it. If our server cannot be reached at that moment, your browser keeps only the ID, marked for deletion and used for nothing else, and asks again on every page until the deletion is done. Your orders are kept, as they must be, but are no longer linked to your visits. This works only from the browser that holds the ID: if its storage is cleared, or you use another browser or device, the website can no longer tell which records were yours. If you were signed in while browsing, write to support@signaturealgorithms.com from your account's address and we will delete the analytics linked to your account; otherwise the records are deleted automatically on the schedule above.

We do not share this analytics record with advertisers or social networks. It is held by us, on our hosting and database providers' systems, and used only for the purposes above. The separate Advertising choice, below, is how Meta measures our adverts; it does not use this record.

If you choose Accept all, or switch Advertising on under Choose, your browser loads Meta's pixel from Meta's servers. From our public pages - not the account, checkout, download, newsletter or password pages - it tells Meta: the page you are on and the page before it, including the campaign or advert named in the link you followed; the plug-ins and bundles you look at and add to your cart; and when you start a checkout or create an account. Like any website your browser contacts, Meta also receives your IP address and your browser's details, and it sets and reads its own cookies on our domain, _fbp and _fbc (90 days each). If you are logged in to Facebook or Instagram in the same browser, Meta can link this to your account. Your purchases are not reported to Meta.

Why, and on what basis: to learn which of our adverts on Facebook and Instagram bring people to our plug-ins, so that we stop paying for the ones that do not - on the basis of your consent (UK GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for the pixel and its cookies). Nothing is loaded from Meta until you choose; refusing changes nothing about how the site works for you.

Who is responsible: for collecting this on our site and sending it to Meta, we and Meta are jointly responsible (joint controllers), under Meta's Business Tools Terms. What Meta does with it afterwards, including for its own purposes, Meta decides alone, as an independent controller, under its own privacy policy; Meta may process it outside the UK, including in the United States. We keep no copy of what the pixel sends.

Changing your mind: choose Privacy choices at the foot of any page and switch Advertising off. The pixel stops at once and we delete Meta's cookies from our domain. We cannot recall what Meta has already received: to see or delete what Meta holds about you, use the privacy settings of your Facebook or Instagram account, or contact Meta. You can also write to support@signaturealgorithms.com and we will pass your request on.

If you choose Accept all, or switch Advertising on under Choose, our site loads Google's ads tag from Google's servers on two occasions only: when you arrive from one of our Google adverts, so that Google can remember which advert it was (Google receives the address of the page you arrive on, which names the advert), and on the thank-you page after a payment that Stripe has confirmed. From the thank-you page Google receives the order's number, the amount you paid and its currency - not what you bought, and never the page's private address. On both occasions Google receives your IP address and your browser's details, and it sets and reads its own cookies on our domain, _gcl_au and _gcl_aw (90 days each). If you are logged in to Google in the same browser, Google can link this to your account. We do not use Google for personalised advertising, and we do not use Google Analytics.

Why, and on what basis: to learn which of our Google adverts lead to purchases, so that we stop paying for the ones that do not - on the basis of your consent (UK GDPR Article 6(1)(a), and the Privacy and Electronic Communications Regulations for the tag and its cookies). Nothing is loaded from Google, and no Google cookie is set, until you choose; refusing changes nothing about how the site works for you.

Who is responsible: for collecting this on our site and sending it to Google, we and Google are jointly responsible (joint controllers). What Google does with it afterwards Google decides alone, as an independent controller, under the Google Ads Controller-Controller Data Protection Terms and its own privacy policy; Google may process it outside the UK, including in the United States. We keep no copy of what the tag sends, only, in your browser, the order numbers it has already reported (sa.ads.purchases), so that none is reported twice.

Changing your mind: choose Privacy choices at the foot of any page and switch Advertising off. Google's tag stops at once, and we delete Google's cookies and sa.ads.purchases from our domain. We cannot recall what Google has already received: to see or delete what Google holds about you, use the privacy settings of your Google account, or contact Google. You can also write to support@signaturealgorithms.com and we will pass your request on.

Cloudflare runs this website, delivers our emails, provides the Turnstile bot check and stores the installers. Neon (part of Databricks) hosts our database, in its London region. Stripe takes payments: your card details go to Stripe and never reach us. Cloudflare and Neon process data for us on our instructions, under their data processing terms. Cloudflare also uses information about network traffic, such as IP addresses, to run and protect its network, under its own privacy policy; Stripe handles payments under its own terms and privacy policy. We do not control those uses.

These providers, their support teams and their sub-processors may process data outside the UK, including in the United States. Cloudflare and Neon protect such transfers with the UK's International Data Transfer Addendum to the EU standard contractual clauses, and with the UK Extension to the EU–US Data Privacy Framework, as their terms set out.

Product videos: if you press play on a plug-in's walkthrough, your browser fetches it from YouTube (Google), which receives your request, including your IP address, and handles it as its own controller under Google's privacy policy. Nothing reaches YouTube unless you press play.

We do not sell personal data.

We run no advertising tracker unless you switch Advertising on, and our own analytics record is never sent to Meta or any other advertiser. If you open our site inside Instagram's or Facebook's own in-app browser, that browser is Meta's software and may collect information under Meta's own policies, which we do not control, whatever you choose here; opening the link in your usual browser avoids it.

We do not fingerprint your device, record your sessions, or work around your browser's privacy protections.

We do not email you marketing unless someone asked us to using your address. We do not sell or share that list.

Under UK GDPR you may request a copy of your data, ask us to correct it, or ask us to delete it. Deleting your account removes the licences attached to it, so the plug-ins you paid for would stop being authorised. The installer itself stays free to download either way.

To make any of those requests, write to support@signaturealgorithms.com from the address on your account.

If you allowed Analytics without an account, open Privacy choices at the foot of any page: it shows a reference for this browser's analytics record, beginning "SA-". Send it to support@signaturealgorithms.com to see or delete what we hold. The reference lets us find the record; it cannot be used on the website to change or delete it. Where the record is linked to an account or an order, we reply only to that account's email address.