Signal and your data

What Signal collects

Signal watches your website, not your visitors as people. It collects four things.

• Page views. Which page, when, on a phone or a desktop, and which site sent them (search, a link, an ad, or typed directly).
• Enquiries. The four actions that mean somebody reached you: a contact form sent, a booking link clicked, a phone number tapped, an email address tapped. Signal counts that these happened. The contents of your forms are handled by whatever plugin sends them, and never pass through Signal.
• A small sample of session recordings. A replay of how a visit moved through the pages: scrolls, clicks, and which fields were reached. See the two sections below for what is stripped out of these and how few are kept.
• Changes to your own site. When a page's content changes, Signal logs that a change happened and to which page, so later numbers can be read against it. This comes from your WordPress install, not from a visitor.

There is no advertising tag, no cross-site tracking, and no attempt to work out who a visitor is.

What it never collects

• Anything typed. Recordings mask every input on the page. What a visitor types into a form is replaced before the recording leaves their browser, so it never reaches us to begin with. Passwords, email addresses and phone numbers are masked a second time on top of that.
• Private pages. Recording is refused outright on any address beginning with a sign-in, account, profile, cart, checkout, order, payment, billing, invoice, password reset or membership path. The list is matched broadly on purpose: a false match costs one unrecorded page, and a miss records a stranger's address.
• Anything you mark. Any element carrying the bf-no-record class is left out, and so is anything matching the selector list in the plugin's settings, which you can edit yourself without a developer.
• Payment details. They live on the pages above, which are never recorded, and they are inputs, which are masked.

Where it is kept

All of it is processed and stored in the United States, in Amazon Web Services' Northern Virginia region (us-east-1). If your work requires that data stay in Canada, tell us before we switch Signal on, because today it does not.

Those three are the whole list. Nobody else is given access, and no fourth party is added without telling you first.

How long it is kept

• Recordings: at most 36 per site, and nothing older than a year. Signal keeps the ten most recent visits that ended in an enquiry, the six that show somebody struggling, and twenty ordinary ones. When a newer one arrives the oldest of its kind is dropped and its recording is destroyed. PostHog's own copy is deleted after 30 days, so ours is the only archive and it is deliberately small.
• Counts and totals: kept. Visits, enquiries and value figures are numbers, not people, and they are what makes a year-on-year comparison possible.
• Your change log: kept for as long as we look after the site, because the point of it is reading this month against last year.

Six good recordings are more use than six hundred. The limits above are the product working as intended, not a storage saving.

Who can see it

Your own team, on accounts we create for the people you name, and Bloomify. Nobody else has an account on your site's data.

Accounts are tied to one site. The separation is enforced by the database itself rather than by application code remembering to filter: a request carrying no identity returns nothing at all. One client cannot see another client's numbers, and neither can a bug.

Sign-in is handled by Amazon Cognito. Your password is never stored by us and never passes through our servers.

What to put in your own policy

If Signal is running on your site with recordings switched on, your privacy policy should say so. This wording is accurate for how it is configured, and you are welcome to paste it:

We measure how this website is used, including how many people contact us and which pages they came from. A small sample of visits is recorded as a replay of scrolling and clicking, so we can find pages that are hard to use. Anything typed into a form is hidden before the recording leaves your browser, and pages such as sign-in, account and checkout are never recorded. Recordings are kept for up to a year and are seen only by us and our web studio. To ask for a recording of your visit to be deleted, contact us.

If recordings are switched off on your site, drop the middle three sentences. Ask us and we will tell you which applies to you.

Turning it off, and deletion

Recording can be switched off for your site in one setting, and takes effect on the next page load. Counting continues, so you keep the enquiry numbers without the replays.

If a visitor asks you to delete a recording of their visit, send us the date and the page and we will remove it. If you leave, we delete your recordings and send you your counts first. Neither costs anything.

If your site asks visitors for consent before measurement, Signal can be wired to that consent and will collect nothing until it is given. Tell us which consent tool you use.

What we do not do

• We do not sell your data, or anyone's.
• We do not feed it to advertising networks, and Signal sets no advertising cookies.
• We do not mix one client's numbers into another's, including in anything we publish. Screenshots in our own marketing use a demo account with invented figures.
• We do not use your visitors' data to train anything.
• We do not read your recordings for any purpose other than finding what to fix on your site.

This page is written by the people who built the software, not by a lawyer. It describes what the system does today. If you need this as a signed data processing agreement, ask and we will put one in front of you.