Privacy Policy
Last updated: April 29, 2026
1. Who We Are
Nicolas Lupu (SignalLens AI) operates the website signallensai.com and the SignalLens AI platform — an AI-powered SEO and growth automation service for websites.
Contact for privacy matters: [email protected]
2. Data We Collect
We collect the following categories of personal data:
- Account data: email address, name, password (hashed), subscription plan.
- Usage data: analyzed website URLs, audit results, keyword reports, IP address, browser type, session timestamps.
- Payment data: Stripe processes payments. We do not store card numbers. We store subscription status and Stripe customer ID only.
- Social media tokens (OAuth): when you connect a social media account, we store the OAuth access token and refresh token required to post content on your behalf. See section 5 for details per platform.
- Website content: articles, SEO metadata, cover images generated for your connected websites.
3. How We Use Your Data
- To provide, maintain, and improve the SignalLens AI service.
- To generate SEO content and publish it to your connected websites and social channels.
- To send service-related emails (billing, alerts, weekly reports).
- To detect and prevent fraud or abuse.
- To comply with legal obligations (GDPR, tax law).
We do not sell your personal data. We do not use your data to train AI models without explicit consent.
4. Legal Basis (GDPR)
- Contract performance (Art. 6(1)(b)): processing necessary to provide the service you signed up for.
- Legitimate interest (Art. 6(1)(f)): analytics, fraud prevention, service improvement.
- Consent (Art. 6(1)(a)): social media API access — you explicitly authorize each connection via OAuth.
- Legal obligation (Art. 6(1)(c)): accounting and tax records.
5. Third-Party Social Media APIs
SignalLens AI integrates with the following platforms via official OAuth APIs. In each case, you explicitly authorize the connection and may revoke it at any time from your account settings or from the platform directly.
TikTok
We use the TikTok Content Posting API to publish video content to your TikTok account on your behalf.
- Data collected from TikTok: TikTok user ID, display name, OAuth access token and refresh token.
- Data we send to TikTok: video files and captions that you or the platform generated.
- Purpose: automated social media marketing for your connected website.
- Storage: access tokens are encrypted at rest in our EU-hosted database. We do not store TikTok video content after upload.
- Retention: tokens are deleted when you disconnect TikTok from your account.
- Revocation: disconnect at any time via SignalLens AI Settings → Connections, or via TikTok Settings → Security → Connected Apps.
TikTok's own privacy policy: tiktok.com/legal/privacy-policy
We use the LinkedIn Marketing API to publish posts to your LinkedIn profile or company page.
- Data collected: LinkedIn member ID, OAuth access token.
- Purpose: automated content distribution.
- Revocation: via SignalLens AI Settings, or LinkedIn Settings → Data privacy → Third-party apps.
X (Twitter)
We use the X API v2 to publish posts on your behalf.
- Data collected: X user ID, username, OAuth 2.0 access and refresh tokens.
- Purpose: automated content distribution.
- Revocation: via SignalLens AI Settings, or X Settings → Security → Connected Apps.
YouTube / Google
SignalLens AI uses YouTube API Services (YouTube Data API v3) to publish video content to a YouTube channel you connect, and Google APIs to read Search Console and Analytics data for the websites you connect. Each capability is a separate authorisation: you are asked only for the permissions the feature you are using actually needs, and you may grant one without granting the others.
Permissions we request, and why each one is needed:
youtube.upload— to upload the promotional video to your channel. This is the narrowest scope that can publish a video; it cannot read, modify or delete anything else on your channel.youtube.readonly— to identify which channel the upload will go to and to confirm afterwards that the video actually arrived. Without it we could upload into an account you did not intend and could not verify the result.webmasters— to read your Search Console performance data and to submit your sitemap for the sites you connect.analytics.readonly— to read traffic metrics for those sites. Read only; we never write to Analytics.openid,email,profile— to sign you in.
Google user data we obtain: your Google account identifier and email, your YouTube channel ID and title, OAuth access and refresh tokens, and the Search Console / Analytics metrics for the sites you connect.
Who we share, transfer or disclose Google user data with: we do not sell, rent or trade Google user data, and we do not share it with any third party for their own purposes. It is disclosed only to the infrastructure providers listed in section 6 that are strictly necessary to operate the service on our behalf — in practice this is Hetzner Online GmbH (EU-hosted database and servers where the encrypted tokens and metrics are stored) and, for a video file awaiting upload, Cloudflare R2 (EU object storage). These providers act solely as processors under contract, may not use the data for their own purposes, and never receive it for advertising. Google user data is never sent to our AI content-generation providers and is never used to train any AI or machine-learning model. We disclose it otherwise only where we are legally compelled to.
Limited Use: SignalLens AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- Storage: OAuth tokens are encrypted at rest in our EU-hosted database. Uploaded video files are deleted from our storage once YouTube confirms the upload.
- Retention: tokens are deleted immediately when you disconnect the Google or YouTube connection, or when you delete your account.
- Revocation: disconnect at any time in SignalLens AI Settings → Connections, or from Google Account → Security → Third-party apps. Revoking removes our access immediately.
By connecting a YouTube channel you also agree to the YouTube Terms of Service. Google's own privacy policy applies to data held by Google: policies.google.com/privacy.
6. Data Processors & Sub-processors
| Service | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting & database | Germany (EU) |
| Stripe Inc. | Payment processing | USA (SCCs) |
| Mailgun (Sinch) | Transactional email | USA (SCCs) |
| Cloudflare R2 | Media file storage | EU |
| Sentry | Error monitoring (no PII logged) | Germany (EU) |
| Plausible Analytics | Cookie-free analytics | Germany (EU) |
| Google Gemini / DeepSeek / Groq | AI content generation (article text only, no user PII) | Varies |
Which of these receive Google user data. Only Hetzner Online GmbH (database and servers, where encrypted OAuth tokens and the Search Console / Analytics metrics are stored) and Cloudflare R2 (a video file while it awaits upload to YouTube). Both are in the EU and act only as processors on our instructions. None of the other providers listed above receive Google user data — in particular, the AI content-generation providers never do, and no Google user data is used to train any model. We do not sell, rent or trade Google user data, and we share it with no third party for that party's own purposes.
7. Data Retention
- Account data: retained for the duration of your account + 6 months after deletion.
- Audit and SEO reports: 24 months.
- OAuth tokens: deleted immediately upon disconnection.
- Payment records: 10 years (French tax law).
- Server logs: 30 days.
8. Your Rights (GDPR)
As a data subject under GDPR, you have the right to:
- Access: request a copy of your personal data.
- Rectification: correct inaccurate data.
- Erasure: request deletion of your account and all associated data.
- Portability: receive your data in a structured, machine-readable format.
- Restriction: limit processing in certain circumstances.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: disconnect any social media integration at any time without affecting other services.
To exercise any right, email [email protected]. We respond within 30 days. You may also lodge a complaint with the CNIL (cnil.fr).
9. Security
We implement technical and organizational measures to protect your data: HTTPS everywhere, AES-256 encryption at rest for OAuth tokens, regular security audits, principle of least privilege for internal access, and automated vulnerability scanning.
10. Cookies
We use Plausible Analytics — a cookie-free, GDPR-compliant tool that does not track individual users. One session cookie is used for authentication. No advertising cookies or cross-site tracking.
11. Changes to This Policy
We may update this policy. Material changes will be notified via email to registered users at least 14 days before taking effect. The current version is always available at signallensai.com/privacy-policy.
12. Contact
Nicolas Lupu (SignalLens AI)
8 rue Laurier Fleuri
44120 Vertou
France
06 86 64 84 54
Email: [email protected]