Privacy Policy

1. Information we collect

• Account and organization data: name, work email, organization, role, authentication identifiers, plan, and billing status.
• Recruiting workflow data: target markets, search niches, signal recipes, companies, leads, notes, feedback, outreach drafts, results, and team activity.
• Candidate data: professional profile, role history, preferences, and related material submitted by an authorized user with an appropriate legal basis.
• Billing data: customer and subscription identifiers, plan, payment status, and transaction metadata. Stripe processes full payment-card details; MandateSignal does not store them.
• Usage and device data: IP address, browser, device, timestamps, pages viewed, feature activity, errors, and diagnostic logs.
• Public and licensed business data: company announcements, filings, hiring activity, leadership changes, and other professional information from public or contracted sources.
• Communications: support requests, pilot submissions, survey responses, and other messages you send us.

2. How we use information

We use information to provide, secure, support, and improve the Service; authenticate users; generate and explain business signals; personalize recipes and digests; process payments; enforce plan limits; communicate about the Service; prevent fraud and abuse; comply with law; and measure product quality.

Where required, we rely on consent. We may also process information to perform a contract, comply with legal obligations, and pursue legitimate interests such as securing and improving a business service.

3. AI-assisted features

MandateSignal may use third-party AI providers to classify signals, summarize source material, draft outreach, and produce recommendations. We send only the information reasonably needed for the requested function and configure providers for business use where available. Outputs can be incomplete or inaccurate and must be reviewed by a person before use.

We do not sell customer or candidate data, and we do not make it available as a public candidate database. We do not use customer content to train general-purpose models unless we clearly disclose that use and obtain any consent required by law or contract.

4. How we disclose information

We disclose information to infrastructure, authentication, database, email, payment, analytics, enrichment, monitoring, and AI service providers that process it for us under contractual restrictions. Current core providers include Supabase, Railway, Stripe, Resend, Anthropic, and business-data or enrichment providers enabled for your workflow.

We may also disclose information when directed by an authorized customer administrator; to complete a corporate transaction; to protect rights, safety, and security; or when required by law. We do not sell personal information or share it for cross-context behavioral advertising.

5. Customer and candidate responsibilities

Business customers determine what candidate and recruiting data they submit. Customers must provide required notices, obtain required consent or another lawful basis, honor restrictions and deletion requests, and avoid uploading unnecessary sensitive information. If you believe your information was submitted without authorization, contact us so we can investigate.

6. Retention and deletion

We retain account and customer content while an account is active and as reasonably needed to provide the Service, meet legal and financial obligations, resolve disputes, enforce agreements, maintain security records, and support backups. Retention periods vary by data type and contractual requirements. We delete or de-identify information when it is no longer needed, subject to legal holds and backup cycles.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, managed infrastructure, authentication, tenant-scoped access controls, secret management, logging, and operational monitoring. No system is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; or appeal a decision. You may also unsubscribe from marketing communications while continuing to receive necessary service messages. We may verify your identity and may direct organization-managed requests to your organization.

9. International use, children, and changes

Information may be processed in the United States and other countries where our providers operate, with legally required transfer safeguards. The Service is a business product and is not directed to children under 18. We may update this policy and will post the revised date; material changes may also be communicated through the Service or email.

10. Contact

For privacy questions or rights requests, email privacy@mandatesignal.com. For customer support, email support@mandatesignal.com.