How Signal & Story handles personal information.

Last updated

October 13, 2026. Platform policy version 2026-10-13.

Overview

Signal & Story Incorporated (“Signal & Story,” “we,” “us,” or “our”) provides an AI-assisted research, planning, character, voice, video creation, asset management, publishing, and analytics platform. This policy applies to platform.signalandstory.ai, signalandstory.ai, related forms, marketing pages, and experiences that link here.

We aim to handle personal information in a manner consistent with privacy principles used across North America, including meaningful consent, limiting collection and retention, reasonable safeguards, openness, access and correction, and clear choices. The platform records the policy and Terms versions accepted by each signed-in user.

Notice at collection

We may collect the following categories of personal information, depending on how you interact with the site:

• Account and workspace identifiers, such as name, email address, organization, role, authentication identifiers, membership, and preferences.
• Commercial or professional information, such as company website, role, business interest, podcast guest interest, and inquiry details.
• Internet or electronic network activity, such as pages visited, referring pages, campaign parameters, device identifiers, cookie identifiers, browser type, and interactions with forms or content.
• Approximate location information inferred from IP address or analytics tools.
• Inferences, such as likely interests in Signal & Story services, podcast topics, content themes, or marketing communications.
• Research and creative inputs, including URLs, briefs, prompts, uploaded documents, public-market sources, scripts, approvals, and editing instructions.
• Identity and media data, including optional reference images, recorded voice samples, voice profiles, consent records, generated images, audio, video, captions, and metadata.
• Connected-service data, including Instagram and other social account identifiers, usernames, profile details, granted permissions, selected publishing destinations, publishing status, CRM identifiers, and encrypted access credentials.
• Instagram research data from an account you authorize, including profile information, recent media, captions, media links, publication dates, available engagement counts, and analyses derived from audio or visuals, such as transcripts, translations, and summaries.
• Transaction and usage data, including plan, credit balance and ledger, generation costs, invoices, payment-customer identifiers, storage use, jobs, logs, and support activity. Complete payment-card data is handled by our payment processor, not stored by us.
• Communications content you choose to provide, such as support requests, messages, topic suggestions, or form responses.

Identity images and voice samples may be sensitive because they can identify a person. Only upload or record a person when you have authority and all required consent. Do not submit health records, financial-account credentials, government identifiers, children’s data, or unrelated confidential information unless we expressly support that use.

Sources of information

We collect information from:

• You, when you submit forms, join the podcast waitlist, email us, or request a Signal Session.
• Your browser or device, through cookies, pixels, tags, server logs, and similar technologies.
• Analytics, advertising, email, hosting, security, CRM, and form processing providers.
• Publicly available business sources, such as company websites, professional profiles, search results, and market research sources.
• Connected accounts you authorize, including Instagram, optional Facebook Pages, other social publishing services, and CRM providers.
• Team members or clients who add you to a workspace or supply authorized source material.

How we use information

• To respond to Signal Session and market audit inquiries.
• To manage podcast waitlist signups, guest interest, and launch updates.
• To provide, improve, personalize, and measure website content and user experience.
• To understand audience interest, marketing performance, referral sources, and campaign effectiveness.
• To build remarketing or lookalike audiences where allowed by law and your cookie choices.
• To manage email communications, newsletters, podcast updates, and business development outreach.
• To conduct market, audience, positioning, and content-strategy research.
• To analyze an authorized Instagram account's profile and recent media, including captions, audio, visuals, and available engagement information, and turn those sources into research findings and creative recommendations.
• To create characters and voices, generate and edit media, maintain continuity, render exports, and carry out approved publishing instructions.
• To authenticate users, operate workspaces, enforce plan limits, maintain credit ledgers, process payments, and prevent fraud or misuse.
• To connect and exchange requested data with social, CRM, storage, AI, voice, video, and publishing providers.
• To maintain legal acceptance, likeness and voice consent, quality-gate, security, and audit records.
• To protect the site from spam, abuse, or unauthorized activity.
• To comply with legal, security, and operational requirements.

Cookies and similar technologies

Cookies, pixels, tags, local storage, SDKs, and similar technologies may be used to operate the website, remember preferences, measure site performance, understand visitor behavior, attribute campaigns, and support future advertising or remarketing programs.

We may use the following types of technologies:

• Essential technologies required for site operation, security, form protection, and remembering privacy choices.
• Analytics technologies that help us understand visits, page views, traffic sources, content performance, and audience behavior.
• Marketing and advertising technologies that may help us measure campaigns, build audiences, limit ad frequency, and show relevant content on other platforms.
• Functional technologies that remember preferences or improve the site experience.

You can accept or decline non-essential cookies through the cookie banner. Declining non-essential cookies should not prevent access to the main website. You can also clear your browser storage to reset your choice.

Analytics and advertising providers

We may use analytics and marketing tools such as web analytics platforms, tag managers, search advertising platforms, social media pixels, CRM systems, email marketing tools, heat mapping tools, conversion tracking tools, and similar services. For example, the site may use Google Tag Manager and Google Analytics to measure traffic, engagement, events, referrals, and campaign performance.

These providers may collect or receive identifiers, internet activity, device information, approximate location, referral information, and interaction data. Some U.S. state privacy laws may treat certain advertising, remarketing, or cross-context behavioral advertising activities as a “sale,” “sharing,” or “targeted advertising” even when no money is exchanged.

Where required, we will provide a way to opt out of sale, sharing, targeted advertising, or profiling. Until a dedicated preference center is available, you can decline non-essential cookies in the banner or email privacy@signalandstory.ai with the subject line “Privacy Choices.”

How we disclose information

We may disclose personal information to:

• Service providers that provide authentication, cloud hosting and storage, databases, AI inference, image/video/voice generation, transcription, rendering, payment processing, email, analytics, security, CRM, support, and platform operations.
• Social and CRM services you connect or instruct us to publish to. Their independent handling of information is governed by their own terms and privacy policies.
• Analytics and advertising partners, if non-essential cookies or marketing technologies are enabled.
• Professional advisors, such as legal, accounting, security, or business advisors.
• Authorities, regulators, courts, or third parties where required by law or necessary to protect rights, safety, security, or enforce agreements.
• Successors or counterparties in a business transaction, such as a merger, acquisition, financing, reorganization, or sale of assets.

We do not sell personal information for money. We may use advertising or analytics technologies in ways that some laws define as “sharing,” “targeted advertising,” or a “sale” of personal information. You may opt out as described in this policy.

Service providers

We use service providers for authentication (including WorkOS and configured identity providers), cloud infrastructure and storage (including AWS), payments (Stripe), AI planning and inference (which may include OpenAI and DeepInfra), image and video generation (which may include fal.ai), voice generation and cloning (which may include ElevenLabs), media processing, email, analytics, security, and support. We also exchange data with social and CRM services you choose to connect, including Meta's Instagram and Facebook services. The provider used depends on the feature and configuration; providers and models may change as we improve quality, price, availability, or safety. They may process information in Canada, the United States, or other jurisdictions.

We expect service providers to process information for the services they provide to us and to use appropriate contractual, administrative, technical, and organizational safeguards.

AI-assisted workflows

The platform sends the inputs needed for a requested task—such as prompts, scripts, reference media, audio, or public-source excerpts—to configured AI and media providers. For Instagram research, this may include authorized captions, media, audio, or excerpts so providers can transcribe speech, analyze visuals and language, and help prepare research findings or creative work. We retain resulting source excerpts and analyses in the customer's workspace for the platform features the customer uses. Outputs can be inaccurate, synthetic, or inconsistent and require human review. We do not use customer content to train our own general-purpose foundation model, and we do not authorize service providers to use customer content to train general-purpose models where processor controls are available. Provider-specific retention may still apply.

We do not intend the platform to make decisions about individuals that produce legal or similarly significant effects. Signal analysis, quality gates, moderation, confidence scores, and recommendations are assistive and may be reviewed or overridden by people.

Cross-border processing

Because many website, analytics, hosting, form, CRM, email, security, and AI providers operate internationally, personal information may be processed or stored outside your province, state, or country, including in Canada and the United States. Information processed in another jurisdiction may be accessible to courts, law enforcement, or regulators in that jurisdiction according to local law.

How long we keep information

We keep personal information only as long as reasonably needed to provide the platform, maintain continuity and user-requested assets, process transactions, meet legal or security obligations, resolve disputes, and enforce agreements. Active workspace data normally remains until the customer deletes it or closes the account.

Account-deletion requests target completion within 30 days after verification and may be cancelled before processing begins. Deletion removes or de-identifies platform data from active systems, subject to records we must retain for billing, tax, fraud prevention, security, legal claims, or consent evidence. Provider and encrypted-backup deletion may occur on their normal rotation schedules. Legal acceptance and consent evidence may be retained in a minimized form to demonstrate compliance.

Your privacy choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, information about disclosure practices, withdrawal of consent, restriction of certain processing, or appeal of a privacy decision.

Residents of certain U.S. states may also have the right to opt out of sale, sharing, targeted advertising, or certain profiling. Canadian residents may request access to their personal information, correction of inaccurate information, and information about how personal information is used or disclosed, subject to legal limits.

Signed-in users can download a portable JSON copy of workspace data and request or cancel account deletion from Account & Billing. You may also ask us to explain use and disclosures, correct inaccurate personal information, withdraw optional consent, disconnect a service, object to or restrict eligible processing, or challenge our compliance by emailing privacy@signalandstory.ai. We may verify identity, authority, and workspace ownership before fulfilling a request. Legal exceptions may apply, and we will explain a refusal where required.

Connected accounts and publishing

You can authorize an Instagram Business or Creator account for account research and approved publishing. If you choose to connect a Facebook Page, we may also use its linked Instagram Professional account or the Page as a publishing destination. Access is limited by the permissions you grant and the features you use. We use the connection to retrieve the account profile and recent media for research, and to publish content you approve. We may retain source excerpts, transcripts, visual and language analyses, generated recommendations, and publishing records in the workspace.

Connections are segregated by workspace and user authorization. We encrypt provider credentials at rest and exclude them from user data exports. You can disconnect a provider in platform settings or revoke its access through the provider. Disconnecting stops new platform-initiated access but does not delete content already published or data independently retained by that provider. If Instagram sends us a deauthorization or data-deletion request, we remove the stored Instagram connection and associated Instagram import, monitoring, and signal-feed records. Customer-created projects and finished creative assets remain subject to the workspace deletion options described above. For help deleting those assets, contact privacy@signalandstory.ai.

Customer content and human control

Customers control their submitted and generated content subject to the Terms of Use. Stage approvals, consent records, and provider safety checks are designed to reduce misuse, but customers remain responsible for rights, accuracy, disclosures, and final publication. We may preserve limited audit information when needed to investigate abuse, respond to a safety incident, or establish consent and authorization.

Marketing choices

You can unsubscribe from marketing emails by using the unsubscribe link in the message or by contacting us. We may still send transactional or relationship communications, such as responses to inquiries or service-related messages.

Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including authenticated workspace access, tenant-scoped data operations, encryption in transit, encrypted connected-account credentials, restricted cloud roles, audit records, and service monitoring. No network, transmission, AI provider, or storage system can be guaranteed completely secure. If you believe your account or data is at risk, contact us promptly.

Children’s privacy

The platform is for adults and business users and is not directed to anyone under 18. Customers must not create characters from or upload voice or likeness data of minors. The public website is not directed to children under 13 or the equivalent minimum age under applicable law. Contact us if you believe a child’s information was submitted.

Changes to this policy

We may update this policy as the platform, providers, practices, or law changes. The “Last updated” date and version identify the current document. For material changes, we will provide appropriate notice and, where required, ask signed-in users to accept the new version before continuing.

Contact

Signal & Story Incorporated is accountable for the personal information described here. For privacy questions, access or correction requests, deletion, consent withdrawal, or complaints, contact our Privacy Officer at privacy@signalandstory.ai. You may also contact the applicable privacy regulator if you are not satisfied with our response.