Privacy Policy

Information we collect

We collect the following categories of information:

• Account information — name and email address for anyone who signs up or is invited as an admin, and a password (stored as a salted hash, never in plain text) if you use password sign-in.
• Accounts we prepare for you — at a person's request (for example an early adopter), we may set up an account in their name, with their name and email address and their organization's branding, before they sign in. It stays unused and nothing is sent to them until we invite them; the first time they sign in with that email address, it is theirs. They can ask us to delete it at any time.
• Organization and brand information — your organization's name, logo, brand colors, font, company phone/website, and any compliance/disclaimer text you enter.
• Member (signature) information — for each person whose signature is managed, their name, title, phone number, email address, headshot photo, and any optional fields you or they enter (license number, professional designations, social media links, a personal email sign-off, a company address, a link to a mobile app, a team they cheer for, a handwritten-style signature image).
• Google Account information — see "Google user data" below.
• Free signature generator — the generator on our website runs in your browser and nothing you type is stored unless you choose "Email it to me." In that case we keep your email address and the signature details you entered (name, title, company and similar) so we can send you the signature. If you tick the box for tips and product updates we may email you those, and every message includes an unsubscribe link. We also count anonymous generator usage (which button and layout were used) without storing your IP address or any identifier.
• Usage information — basic technical logs (timestamps, IP address, error details) needed to operate and secure the Service.

Google user data

We request two Google data scopes, each only for the feature that needs it. (If you choose "Continue with Google" to sign in, we also receive your name and email address through the basic openid, email and profile scopes; that gives no access to any Google data.)

1. Gmail signature (members)

When a member connects their Gmail account, we request gmail.settings.basic. This lets us read and update the "send-as" signature setting on that Gmail account. It does not give us access to read email content, contacts, calendar, or any other Gmail data, and we never request or use broader Gmail access.

We use this access solely to:

• Confirm which Gmail address a member has connected.
• Write the branded signature your organization has configured to that account's settings.
• Keep that signature current when your organization's brand, template, or a scheduled offer changes.
• Check, a few times a day, that the connection still works. This asks Google to renew our access token and reads no data; it lets us tell the member and their administrator if access was removed in their Google Account.
• Read the signature Gmail currently holds for that address: once, when the account is first connected, to keep a copy of the signature that was there before ours (so it can be restored); and when the member presses "Check my Gmail", to tell them whether Gmail is holding the latest signature we sent. We read only that signature setting, never any message.

2. Google Workspace directory (organization admins, optional)

An organization admin may choose to connect their Google Workspace domain, for which we request admin.directory.user.readonly. This is read-only. We use it only to show the admin a list of the people in their own domain (name, email address, job title, department, organizational unit, and whether they are an administrator or suspended) so the admin can see who has and hasn't connected a signature and add or invite them in bulk. We do not modify the directory. If the admin turns on "Keep your team up to date automatically" (off unless they choose it), we also read the directory once a night to notice people who have joined (we add them as members and email them their connect link) and people who have left or been suspended (we archive them so their signature is no longer updated). To tell the two apart we keep a list of the email addresses we have seen in that directory, for as long as the option is on; turning it off, or disconnecting Google Workspace, deletes that list. Otherwise the list of people is held in memory for a couple of minutes to keep the page fast, and the only directory information we store is for the people added as members (name, email, and title). Disconnecting Google Workspace from the dashboard revokes this access.

OAuth access and refresh tokens for both scopes are encrypted at rest (AES-256-GCM) and are never logged or displayed in plain text. A member or an organization admin can disconnect a Gmail account or the Workspace connection at any time, which revokes our access to it. We retain a connection's tokens only for as long as the connection is active: when a connection ends (a member or administrator disconnects it, a member is removed, or access is withdrawn in Google), we delete the stored tokens for it.

Sharing of Google user data. The Google user data described above is not sold, is not used for advertising or lending decisions, and is not given to data brokers. It is stored with our hosting provider (Railway) so the Service can run, and the email addresses an administrator asks us to invite are used to send those invitations through our email delivery provider (Resend). It is not sent to any other party, except as required by law.

No AI or machine-learning use. We do not use Google user data to develop, improve or train AI or machine-learning models, and we do not send it to third-party AI services.

What we keep, and for how long. A copy of the signature a member had before ours is kept on that member's record, so it can be shown and restored, until their account is deleted. The directory information described above is kept as set out there. We do not store the content of anyone's email.

Microsoft Outlook add-in

If your organization installs our Outlook add-in, it uses Microsoft single sign-on only to learn the signed-in user's work email address, so we can return that person's signature. We do not read, send, or store any email content, contacts, or calendar data from Microsoft, and the add-in inserts the signature into the message being composed on the user's device. We record only when the add-in last requested a signature for a member.

Limited Use disclosure: Email Signature Magic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use information

We use the information above to:

• Provide, maintain, and improve the Service — rendering and pushing signatures, and keeping them in sync with your organization's brand.
• Authenticate admins and members and secure accounts.
• Send service-related email (login links, connection status, requested test sends, and optional reminders you switch on, such as a morning reminder to reload Gmail).
• Respond to support requests.
• Detect and prevent abuse, fraud, or security incidents.

We do not sell personal information, and we do not use Google user data for advertising.

Who we share information with

We share information only with service providers who help us operate the Service, under contractual confidentiality obligations:

• Railway — application hosting and our Postgres database.
• Resend — transactional email delivery (login links, test sends).
• Google — to connect and update a member's Gmail signature, as described above.
• Stripe — payments, when a plan is purchased. Card details go directly to Stripe; we never see or store them, only whether a plan is active.
• Anthropic — when you use "Pull from my website", the text of the web page you point us to is sent to Anthropic's API to pick out contact details. It is not used to train models.
• Postmark — the optional full spam check sends the text of a signature, inside a sample email, to Postmark's free SpamAssassin scoring service. Nothing is delivered to anyone.
• OpenWeatherMap and our MLS data provider — only if a member turns on the local weather line (their ZIP code is sent) or featured listings (we look up that member's own public listings).
• Microsoft, LinkedIn and GrowthZone — only if you choose to sign in with Microsoft, import a LinkedIn photo, or connect your organization's GrowthZone account. For GrowthZone we read only events and group lists with the read-only API key your organization supplies, which we store encrypted.

We do not otherwise share personal information with third parties, except when required by law or to protect our rights and users' safety.

Data retention and deletion

We retain account, organization, and member data for as long as your organization has an active account. You can disconnect a member's Gmail connection at any time from the dashboard, which immediately revokes our access to it and deletes the stored tokens for that connection. To request deletion of your organization's account and associated data, including any Google user data we hold, contact us at the address below; we will delete it once we have confirmed the request comes from the account owner.

Security

We use industry-standard safeguards, including encryption of OAuth tokens at rest, encrypted connections (HTTPS/TLS) in transit, and access controls limiting who within our team can access production data. No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect information from children.

Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above, and for material changes, we'll provide additional notice.

Contact us

Questions about this policy or your data? Contact us at support@emailsignaturemagic.com, or via our contact page.