Privacy Policy

Two roles

For visitors to 1sygnal.app and customers who hold a dashboard account, we are the data controller. For survey respondents and app users whose data our customers collect through the 1Sygnal SDKs, the customer is the controller and we process that data on their behalf. Respondents should read the privacy policy of the app they were surveyed in.

Data we collect

• Account data: name, email address, password hash, team membership and the projects you create.
• Billing data: plan, billing currency, invoices and payment status. Card and bank details are entered with our payment gateways and are not stored by us.
• SDK data (collected for customers): an automatically generated anonymous ID, an identified user ID and attributes if the app calls identify, device, app, network and screen information, events the app tracks, and survey responses and dismissals.
• Operational data: server logs and error reports, including IP address and user agent.

How we use it

To provide and secure the service, evaluate survey targeting rules, show surveys, produce analytics, deliver webhooks, send transactional and billing emails, process payments, provide AI-assisted survey creation and response analysis, and diagnose errors.

Consent controls

Customers can start the SDK with surveys disabled until their own consent flow completes (consentRequired), and can add a consent screen to any survey. Compliance with GDPR, CCPA, NDPR or similar laws for data collected in their apps remains the customer's responsibility.

Subprocessors

• Cloudflare: Hosting, content delivery, DNS, security and object storage.
• Resend: Transactional email delivery.
• Stripe, Paystack and Bachs: Payment processing, depending on plan and region.
• AI provider (OpenAI-compatible): Generating surveys and analysing free-text responses; the provider does not train on this data.
• Sentry and New Relic: Error and performance monitoring, where enabled.

Where data is stored and transfers

Our primary database is hosted in Europe. We are based in Nigeria, so personal data is transferred between Nigeria and Europe, and to subprocessors that may process it in other countries. Where required, we rely on appropriate safeguards such as contractual clauses with those providers.

AI features

When a customer uses AI features, survey text and response content is sent to an AI provider to generate the result. The provider does not train its models on this data. AI output can be inaccurate or incomplete and should be reviewed by a person before you rely on it.

Retention

• Survey data (responses, events, user profiles): there is no fixed retention period. The customer controls it and can delete data at any time. After the customer deletes it or closes their account, we remove it from live systems within 30 days, and copies in backups are overwritten within 12 months.
• Account data: kept from account creation until the account is deleted, and afterwards only as needed to establish or defend legal claims and for accounting.
• Invoices and financial transactions: kept indefinitely, as accounting and tax records.
• Support requests and complaints: kept for 12 months from resolution, longer if needed to defend a legal claim.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, and to complain to your data protection authority (in Nigeria, the Nigeria Data Protection Commission). Survey respondents should send requests to the app that surveyed them; we will help the customer fulfil them. Customers who need a data processing agreement can read ours at our DPA.

Contact

Gamang Labs Ltd, 2 Igbobi College Access Road, Shomolu, Lagos, Nigeria. Email [email protected].