CSignal Platform Privacy & Data Policy

Applies to: the CSignal platform and your account Data controller: Charle London Limited Version: 1.0 Last updated: 1 July 2026

1. About this policy

This is the overarching privacy and data policy for CSignal, the conversion and search-visibility platform operated by Charle London Limited ("Charle", "we", "us"). It explains, in plain terms, what CSignal is, what information we hold about you as a user of the platform, how we keep it secure, and the rights you have over it.

CSignal is made up of several capabilities, and three of them process data in more specific ways. Those are covered by their own policies, which sit alongside this one:

• CSignal Attract: how we process search-visibility data (organic search, AI search and related signals).
• CSignal Convert: how we process on-site visitor behaviour from stores that install the CSignal pixel, and what you need to tell your own visitors.
• CharleOS: how we process the operational and account data used to run and support your engagement.

Not every capability applies to every customer. Depending on the services you use with us, some of the policies above may not be relevant to you. For example, some customers use only CharleOS and Convert. Your agreement and account with us determine which apply.

This document is the umbrella. Where the other three policies refer to "who we are", "how we secure data", "your rights", "international transfers" or "how to contact us", they mean the sections in this policy, so the same standards apply everywhere.

2. Who we are

CSignal is operated by:

Charle London Limited, registered in England & Wales, company number 11863407. Registered office: G05 Vox Studios West, 1-45 Durham Street, London, England, SE11 5JH. Contact: hello@charle.co.uk.

For the purposes of UK data protection law, Charle London Limited is the data controller for the personal data described in this policy, that is, the data relating to you as a CSignal account holder and user.

(Note: for visitor data collected on your storefront through the CSignal pixel, the roles are different, you are the controller and Charle is your processor. That relationship is explained in the CSignal Convert policy.)

3. What CSignal is

CSignal is a software platform that helps online stores understand and improve how they attract and convert customers. It brings together search-visibility insights and on-site behavioural insights, and turns them into prioritised recommendations.

The methods, models and scoring that produce those recommendations are proprietary to Charle. This policy describes what data we handle and why: it does not describe how our analysis works.

4. The information we hold about you

As a user of the CSignal platform, we may process:

• Account and identity data: your name, work email address, the organisation or store you belong to, and your role or permissions within CSignal.
• Business attributes: information that describes your store or organisation rather than any individual, such as its industry or sector (for example "fashion"). We use this to tailor the service and to group stores when producing anonymised, network-level benchmarks. This is information about a business, not personal data about a person.
• Authentication data: the credentials and session information needed to sign you in and keep your account secure. We do not store passwords in readable form.
• Connected-service authorisations: where you choose to connect third-party services (for example Google Analytics or Google Search Console), the access tokens that let CSignal read the data you have authorised. We request only the access needed to provide the feature, and you can disconnect at any time.
• Usage and diagnostic data: records of how you use the platform (pages viewed, features used, actions taken) and technical logs used to keep the service running, secure and reliable.
• Communications: messages, support requests and feedback you send us, and our replies.

We do not ask you for special-category personal data (such as health, political or biometric data) to use CSignal, and you should not enter it into the platform.

5. Cookies and similar technologies

This section covers cookies set by the CSignal application itself: the site you log in to. It does not cover the CSignal pixel that runs on your storefront; that is a separate matter described in the CSignal Convert policy.

The CSignal application uses:

• Strictly necessary cookies: required to sign you in, keep your session secure, and remember essential preferences. These cannot be switched off without breaking the platform.
• Product analytics: we measure how the platform is used so we can improve it. This is done using CSignal's own first-party analytics: the same pixel technology CSignal provides to customers, not a third-party analytics service. Where this is not strictly necessary we rely on your consent, and you can decline it.

The CSignal platform carries no third-party trackers, uses no advertising cookies, and we do not sell your data.

6. Why we are allowed to process your data (lawful bases)

Under UK GDPR we rely on:

• Performance of a contract: to provide the CSignal service to you and your organisation.
• Legitimate interests: to secure, maintain and improve the platform, prevent abuse, and communicate with you about the service. We balance these against your rights.
• Consent: for any non-essential cookies or optional communications. You can withdraw consent at any time.
• Legal obligation: where we must process data to meet a legal or regulatory requirement.

7. How we keep your data secure

We take the security of your data seriously and apply measures appropriate to the risk, including:

• Encryption in transit using industry-standard TLS, and encryption at rest for stored data.
• Access controls: access to production data is restricted to authorised personnel on a least-privilege basis, and is logged.
• Isolation: each customer's data is logically separated, and access is governed by row-level security so that one customer cannot see another's data.
• Reputable infrastructure: we host on established cloud providers with their own strong security and compliance programmes (see section 8).
• Data minimisation: we avoid collecting data we do not need, and where a piece of data is only needed momentarily we avoid retaining it in identifiable form.

No system can be guaranteed perfectly secure, but we work to protect your data and to detect and respond to issues promptly.

8. Where your data is stored, and who helps us process it

CSignal is operated from the United Kingdom / European Union, and your platform data is primarily stored in the EU.

We use a small number of trusted sub-processors to run the service. Each is bound by contract to protect your data and to process it only on our instructions:

(This is the platform-level list. The Attract, Convert and CharleOS policies list any additional sub-processors specific to those features.)

9. How long we keep your data

We keep your account and platform data for as long as your account is active, and for a limited period afterwards to meet legal, security and record-keeping needs, after which it is deleted or anonymised.

Feature-specific data has its own retention periods, set out in the relevant policy. For example, raw on-site visitor data handled by CSignal Convert is retained for no longer than 12 months before deletion.

10. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data ("right to erasure"), where applicable;
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent at any time, where we rely on it.

To exercise any of these, contact us at hello@charle.co.uk. We will respond within the timeframes required by law (normally one month). You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to resolve your concern first.

11. International transfers

Where data is transferred outside the UK or EU (for example to a sub-processor operating in the US), we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an approved adequacy mechanism.

12. The CSignal policy suite

This policy should be read together with:

• CSignal Attract Privacy Policy
• CSignal Convert Privacy Policy (including guidance on what to add to your own store's privacy policy)
• CharleOS Data Policy

Together these describe the full picture of how CSignal handles data.

13. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the version and date above and, where appropriate, notify you within the platform. Continued use of CSignal after an update means the updated policy applies.

14. Contact us

Questions about this policy or your data can be sent to:

Charle London Limited hello@charle.co.uk G05 Vox Studios West, 1-45 Durham Street, London, England, SE11 5JH