Privacy Policy

We collect the following types of information:

• Account Information: Name, email address, phone number, company name, job title, and business type provided during registration.
• Usage Data: Information about how you interact with the Service, including EDI transaction logs, file processing records, and feature usage.
• Technical Data: IP address, browser type, device information, and access timestamps collected automatically.
• Payment Information: Billing details processed securely through Stripe. We do not store full credit card numbers on our servers.
• Mobile capture (SignalEDI Capture app): Photos and camera captures you submit through our mobile app, plus workspace API credentials stored with the device secure-storage facility, are processed to extract EDI-ready data.
• Cookies & Analytics: Session cookies required for authentication. Optional product analytics events (PostHog) describing feature usage load only after you consent. With marketing consent, public pages may store campaign parameters locally and use a random first-party visitor cookie for up to 365 days to deduplicate pricing, marketplace-interest, and conversion events. This release keeps browser marketing measurement first-party and limited to public pages; third-party advertising tags are not loaded. Withdrawal clears browser attribution and expires the visitor cookie.

• To provide, maintain, and improve the Service;
• To process transactions and send related notifications;
• To respond to support requests and communicate with you;
• To detect, prevent, and address technical issues and security threats;
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We may share information with:

• Service providers who assist in operating the platform (hosting, payment processing, email delivery);
• Law enforcement or regulatory authorities when required by law;
• Professional advisors (legal, accounting) as necessary for business operations.

For a complete list of our sub-processors, see Section 9 below or our Data Processing Agreement.

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest for databases and file storage, role-based access controls, and continuous automated compliance and security scanning with internal security exposure assessments. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

We retain your data for as long as your account is active or as needed to provide the Service. Uploaded EDI files and related blobs are automatically deleted when they exceed your plan’s retention window (14 to 365 days by default; optional archival vault add-ons extend retention of archived documents to 2, 5, or 7 years at your election). You may also delete individual uploaded files from the dashboard before the retention window expires.

If you delete your account or workspace, operational and personal data are deleted or anonymized after a 30-day grace window (during which you can cancel the request). We retain a minimal administrative record after deletion: workspace identifier, company name, plan, billing and invoice history (held by our payment processor, Stripe), contract dates, and the audit trail of the deletion itself — kept to satisfy legal, tax, accounting, and security obligations. Immutable audit logs are retained for up to 7 years with personal references anonymized.

You have the right to:

• Access & export: Download a machine-readable copy of your personal data any time from the Billing page (self-serve JSON bundle). Workspace administrators can additionally export the complete workspace — members, trading partners, EDI documents and transactions, mappings, configuration, and audit trail — from the same page.
• Correction: Update your profile and company information directly in account settings, or ask us to correct anything you cannot edit yourself.
• Deletion: Request deletion of your account — or, for workspace owners, the entire workspace and its customer data — self-serve from the app. Deletion executes after a 30-day grace window (cancellable until then), subject to the administrative-records retention described in Section 5.
• Objection / restriction: Object to or restrict certain processing of your data.

You can also exercise any of these rights by email at privacy@signaledi.com or support@signaledi.com.

• SignalEDI uses AI models (powered by OpenAI) to provide automated support drafting, mapping suggestions, error explanations, and internal operations.
• Before any prompt is sent to an external AI provider, SignalEDI applies pattern-based de-identification (including HIPAA Safe Harbor-style redaction for common PHI identifiers). Raw EDI payload bodies and full transaction content are not intentionally sent to external AI providers.
• AI features may operate on operational metadata (e.g. redacted error text, partner names, ticket subjects). Healthcare customers must execute a BAA before transmitting PHI-bearing transaction sets (837, 835, 270, 271, and related sets).
• For eligible OpenAI chat requests, SignalEDI sets store: false to avoid optional application-state storage. OpenAI states that API data is not used to train its models by default; provider abuse-monitoring systems may retain limited request data for up to 30 days unless separate zero-data-retention terms apply. SignalEDI does not opt customer content into third-party model training.
• AI-assisted chat is not a mental-health or crisis service. If you are in crisis, call or text 988 (U.S.) or your local emergency number.
• Operational logs of AI interactions are stored in SignalEDI’s database for audit and quality purposes, governed by the retention policy in Section 5.
• Client can request deletion of AI conversation history by contacting support@signaledi.com.

• Data is primarily stored and processed in the United States on Amazon Web Services (AWS) infrastructure (application hosting, PostgreSQL database, and object storage in the US East region). Vercel and Neon do not host the current production application; limited legacy records may remain with those prior providers only under documented retention or compatibility controls.
• For EU, UK, and Swiss data subjects, international transfers are protected by Standard Contractual Clauses (EU Commission Decision 2021/914).
• Clients may request execution of Standard Contractual Clauses by contacting support@signaledi.com.

SignalEDI uses the following sub-processors, each bound by data processing agreements:

• Amazon Web Services (AWS) — Application hosting, PostgreSQL database, and object storage (US East)
• Vercel — Connectable marketplace installation flow and limited legacy object storage; not application hosting
• Neon — Limited legacy PostgreSQL retention during migration; Amazon RDS is the production database
• Stripe — Payment processing
• Resend — Email delivery
• Upstash — Redis caching and rate limiting
• PostHog — Product analytics (feature-usage events; no customer EDI payload data)
• OpenAI — AI processing (support drafting and mapping assistance) with data minimization and pattern-based redaction; 42 CFR Part 2 records are technically prohibited
• Anthropic — Optional AI processing and failover with data minimization and pattern-based redaction; corrective sub-processor notice announced and 42 CFR Part 2 records technically prohibited
• Sentry — Error and performance monitoring
• Svix — Outbound webhook delivery
• Google (Ads and Analytics APIs) — Marketing attribution and ad-account reporting (no customer EDI payload data)
• Twilio — SMS notifications (operational alerts only)
• LinkedIn — OAuth and marketing post publishing (no customer EDI data)
• Microsoft Graph — Teams notifications and calendar integrations (optional)
• Instantly.ai — Sales outreach orchestration (no customer EDI data)
• Intuit QuickBooks Online — ERP connector sync when customer connects QuickBooks
• Google Search Console and YouTube APIs — SEO rank tracking and marketing video publishing (no customer EDI data)
• Slack — Internal operational alerts and inbound webhook notifications
• Inngest — Durable workflow and cron orchestration — events carry only references (gateway/job/run ids); customer EDI payloads are fetched and processed server-side and never transit Inngest

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request information about what personal information we collect, use, disclose, and sell.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information. Optional advertising-related disclosures may be treated as sharing; you can disable marketing consent or use a Global Privacy Control signal. See our Do Not Sell or Share page.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, email support@signaledi.com.

We may update this Privacy Policy from time to time. We will notify registered users of material changes. Your continued use of the Service after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy, contact us at support@signaledi.com.