Skip to content

Privacy policy

This policy explains how we collect, use and protect personal data when you visit this website or use our email signature management platform (the “Service”).

We collect only what the Service needs to work. We do not sell personal data and we do not use advertising cookies.

1. Our role

We act in two capacities, and the difference decides where your requests should go:

  • Controller for the data of visitors to this website, people who contact us or request a demo, and the login data of account holders.
  • Processor for the employee data our customers (organisations) manage in the Service. The customer organisation is then the controller: it decides what is processed and why. We act only on its instructions, under our agreement with it and, where applicable, a data processing agreement.

If you are an employee of a customer organisation, please send your request to your employer first. We will help them answer it.

2. Data we collect

  • Website forms: work email and, depending on the form, first name, last name, phone, company, job title, company size, number of seats and your message, plus the language and page the request came from.
  • Employee profiles: name, display name, work email, job title, department, team, phone numbers, photo, website and social links — the details that make up an email signature.
  • Account: role, status, last sign-in date and password, stored only in hashed form.
  • Directory sync: when your organisation connects Google Workspace or Microsoft 365, the technical identifiers needed to match accounts and the date of the last sync.
  • Campaign measurement: the number of banner impressions and clicks on links placed in signatures.
  • Technical data: server logs (IP address, browser, date and time of requests) used for security and troubleshooting.

We do not collect special-category data within the meaning of Article 9 GDPR, and we do not store payment card data.

3. Where the data comes from

  • from you directly, when you fill in a form or use the Service;
  • from your organisation’s administrator, who creates or edits your profile;
  • from your organisation’s directory (Google Workspace or Microsoft 365), when it turns on synchronisation.

We do not buy personal data or enrich it from outside sources.

  • Providing the Service — creating, updating and deploying email signatures: performance of the contract with the customer organisation.
  • Managing accounts and securing access: performance of the contract and our legitimate interest in protecting the Service.
  • Answering your requests for contact, a quote or a demo: steps taken at your request before entering into a contract.
  • Measuring a customer organisation’s campaigns: on its behalf and on its instructions.
  • Improving this website with aggregated, cookieless traffic statistics: legitimate interest.
  • Meeting our legal obligations and defending our rights: legal obligation and legitimate interest.

An email signature is meant to be seen by the people you write to. So that a mail client can display it without signing in, some elements — the rendered signature, the contact card (vCard) and the photo — are served through links that contain a random identifier, which cannot be guessed or enumerated.

Anyone who holds one of these links can therefore see the professional contact details it contains — that is how a signature works. When an employee is deleted, these links stop working.

6. Who receives the data

Your data is available only to the people who need it, and shared with:

  • our technical service providers (hosting, database, image storage, email delivery, job queues, website analytics), who act on our instructions and are bound by confidentiality;
  • Google and Microsoft, when your organisation connects its directory or deploys signatures through their services — their own terms then apply;
  • competent authorities, where the law requires it;
  • a successor, in the event of a merger, acquisition or sale of the business, with the same safeguards.

We do not sell or rent personal data.

7. Transfers outside the European Union

Some of our providers may process data outside the European Economic Area. When they do, the transfer is covered by appropriate safeguards, such as the European Commission’s standard contractual clauses or an adequacy decision.

8. How long we keep data

  • Employee data: for as long as the contract with the customer organisation runs, then deleted on its instructions or when the contract ends.
  • Deleting an employee: their identifying details are erased, their rendered signature and photos are removed and their public links stop working.
  • Contact and demo requests: no more than three years after our last exchange.
  • Technical logs: for a limited period, proportionate to security needs.

Some data may be kept longer where the law requires it.

9. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), hashed passwords, time-limited sessions, separation of each organisation’s data, and access restricted to authorised people.

No system is infallible. If a data breach is likely to affect you, we will inform you — and the competent authorities where the law requires it.

10. Your rights

Under the GDPR and applicable law, you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Where processing relies on your consent, you may withdraw it at any time.

To exercise these rights, write to contact@soniako.com. We reply within one month and may ask you to confirm your identity.

You may also lodge a complaint with the data protection authority in your country.

11. Cookies and local storage

This website uses no advertising cookies and no third-party trackers. Website analytics, when enabled, relies on a tool that works without cookies and collects nothing that identifies you.

The application uses only the storage it strictly needs: a session token to keep you signed in, and your language preference. These do not require prior consent.

12. Children

The Service is intended for organisations and their employees. It is not directed at people under 16, and we do not knowingly collect their data.

13. Changes to this policy

We may update this policy as the Service or the law changes. The date of the last update appears at the top of this page. For significant changes, we will notify account holders by email or in the Service.

14. Contact

For any question about this policy or your data, write to contact@soniako.com.