CSignal Platform Privacy & Data Policy

Applies to: every client and user of CSignal Data controller: Charle London Limited Version: 2.2 Last updated: 2 October 2026

1. About this policy

CSignal is the platform Charle London Limited ("Charle", "we", "us") uses to deliver its services to you. It is where your quotes, planner, tasks, projects, support tickets, messages and billing live, and it can also include two optional capabilities for search visibility and on-site conversion.

This is the umbrella policy. It sets out the terms for using CSignal (section 13), and explains what information we hold about you as a CSignal user, how we keep it secure, who helps us run the platform, and the rights you have. The other policies in the suite refer back to this one for those points, so the same standards apply everywhere.

Together with the Charle Privacy Notice (how Charle as a company handles personal data), the Charle Data Processing Agreement (our terms when we handle your customers' data on your behalf) and our Security Overview, these policies make up Charle's Privacy & Trust documents. Your Charle team can share the full set with you at any time.

2. Which policies apply to you

If Attract or Convert is not enabled for your account, that policy does not apply to you and we do not process the data it describes for you. Attract and Convert are optional. Unless your agreement with us expressly says otherwise, access to them is not included in your fees and is not guaranteed. Your agreement with us, and the modules enabled on your account, decide which policies apply. If you are unsure, contact us at hello@charle.co.uk.

3. Who we are

CSignal is operated by:

Charle London Limited, registered in England & Wales, company number 11863407. Registered office: G05 Vox Studios West, 1-45 Durham Street, London, England, SE11 5JH. Contact: hello@charle.co.uk.

For the data in this policy (your account and your use of CSignal), Charle London Limited is the data controller.

(Where we handle your customers' data on your behalf, for example visitor data from the CSignal pixel or customer records our team works with in your own systems, the roles are reversed: you are the controller and Charle is your processor. Those terms are set out in the Charle Data Processing Agreement, and for the pixel in the Convert Policy.)

4. The information we hold about you

As a CSignal user, we may process:

• Account and identity data: your name, work email address, the organisation you belong to, and your role and permissions in CSignal.
• Business attributes: information about your business rather than any person, such as its sector. We use this to tailor the service and, for Attract and Convert, to group stores for anonymised benchmarks.
• Sign-in data: CSignal signs you in with a one-time email link, so we do not hold a password for you. We keep the session information needed to keep you signed in securely.
• Connected-service authorisations: if you connect a third-party service (for example Google Analytics or Google Search Console for Attract), the access tokens that let CSignal read the data you authorised. We ask only for the access the feature needs, and you can disconnect at any time.
• Activity and diagnostic data: records of actions taken in CSignal (for example who approved a quote or raised a ticket) and technical logs used to keep the service running, secure and reliable.
• Communications: messages, files, support requests and feedback you send us through CSignal or by email, and our replies. If you send feedback from inside CSignal, it can include a screenshot of the page you were on. Emails between you and our team may be logged against your organisation's record in our systems.
• Email engagement: our emails can include tracking that tells us whether and when an email was opened or a link clicked, together with the approximate location (city and country) and IP address it was opened from.
• Phone calls: calls to our phone lines may be answered by an AI voice assistant, which records a transcript and summary of the call so our team can follow up.

We do not ask for special-category personal data (such as health, political or biometric data), and you should not enter it into CSignal.

5. Cookies and similar technologies

This section covers the CSignal application itself, the site you sign in to. It does not cover the CSignal pixel on your storefront, which is covered by the Convert Policy.

• Strictly necessary cookies: used to sign you in, keep your session secure and remember essential preferences. They cannot be switched off without breaking the platform.
• No usage analytics, advertising or tracking cookies: the CSignal application does not currently run product analytics, advertising cookies or third-party trackers. If we add first-party usage analytics in future, we will update this policy first.
• GIFs in messages: if you use GIF search in CSignal messages, your search term is sent to a GIF provider and the GIF you pick is loaded from that provider.

We do not sell your data.

6. AI features

Some CSignal features use an AI model provider to generate answers, drafts and analysis, for example assistants that answer questions about your project, drafting help for our team, and the recommendations in Attract and Convert. When you or our team use these features, the relevant information is sent to the provider to produce the response. The provider processes it on our behalf under terms that do not allow it to use that data to train its models. We do not use AI to make decisions that have legal or similarly significant effects on you.

7. Why we are allowed to process your data (lawful bases)

Under UK GDPR we rely on:

• Performance of a contract: to provide CSignal and our services to you and your organisation.
• Legitimate interests: to secure, maintain and improve the platform, prevent abuse, communicate with you about the service, and send business-to-business marketing about our services (you can opt out at any time). We balance these against your rights.
• Consent: where we need it, for example for non-essential cookies. You can withdraw consent at any time.
• Legal obligation: where we must process data to meet a legal or regulatory requirement.

8. How we keep your data secure

We apply measures appropriate to the risk, including:

• Encryption in transit using industry-standard TLS, and encryption at rest for stored data.
• Access controls: access to production data is limited to authorised personnel on a least-privilege basis. To support you, authorised Charle staff can view CSignal as a specific user sees it.
• Isolation: each client's data is logically separated, and access is enforced by row-level security so one client cannot see another's data.
• Established infrastructure: we host with cloud providers that run their own security and compliance programmes (see section 9).
• Data minimisation: we avoid collecting data we do not need.

No system can be guaranteed perfectly secure, but we work to protect your data and to detect and respond to issues promptly.

9. Where your data is stored, and who helps us process it

Your CSignal data is stored in the United Kingdom (London). Some processing happens outside the UK, as shown below, under the safeguards in section 12.

We use a small number of trusted sub-processors to run the platform. Each is bound by contract to protect your data and to process it only on our instructions:

The Delivery, Attract and Convert policies list any additional sub-processors specific to those areas. We name sub-processors by category here. A list of the named providers is available to clients on request from hello@charle.co.uk.

10. How long we keep your data

We keep your account and platform data for as long as your account is active, and for a limited period afterwards to meet legal, security and record-keeping needs, after which it is deleted or anonymised. The Delivery, Attract and Convert policies set out any specific retention periods for their data.

11. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data ("right to erasure"), where applicable;
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent at any time, where we rely on it.

To exercise any of these, contact us at hello@charle.co.uk. We will respond within the time the law requires (normally one month). You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve your concern first.

12. International transfers

Where data is transferred outside the UK (for example to a sub-processor operating in the US), we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or Addendum, the UK Extension to the EU-US Data Privacy Framework, or another approved mechanism.

13. Using CSignal: acceptable use and your account

CSignal is provided to you as part of your agreement with Charle. Where this section and your agreement differ, your agreement wins. By signing in, you agree to the following.

Your account

• Your sign-in is personal to you. Do not share it or forward your sign-in links.
• Keep your email account secure, because it is how you sign in.
• Tell us straight away at hello@charle.co.uk if you think someone else has used your account.
• Your organisation's admins decide who on your team has access, and should remove people who leave.

Acceptable use. You must not:

• access, or try to access, data or areas you are not authorised to see, including other clients' data;
• try to probe, test, reverse engineer, copy or disrupt CSignal or its security;
• upload anything unlawful, harmful or infringing, or any malicious code;
• use CSignal to collect special category data, or more personal data than you need;
• use CSignal to harass anyone or break any law.

Your content. You keep all rights to the content and data you bring into CSignal. You give us permission to use it only to provide our services to you, as described in these policies.

Our platform. CSignal, including its design, software, methods and recommendations, belongs to Charle. We may improve, change or withdraw features over time. Optional modules (Attract and Convert) are not guaranteed unless your agreement says so.

Availability. We work hard to keep CSignal running, but it relies on third-party services and we cannot promise it will always be available or error-free. Liability is as set out in your agreement with us.

Suspension. We may suspend access that breaks these terms or puts CSignal, our clients or their data at risk, and we will tell you why.

Law. These terms are governed by the laws of England and Wales.

14. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the version and date above and, where appropriate, tell you in CSignal. The current version is always available in CSignal under Settings, Privacy & Data.

15. Contact us

Charle London Limited hello@charle.co.uk G05 Vox Studios West, 1-45 Durham Street, London, England, SE11 5JH