Last updated: October 27, 2026
1. Who we are and what this statement covers
SignalSitter is a service of Flow XO LLC, 4711 Muirfield Ct, Santa Rosa, CA, United States (“SignalSitter”, “we”, “us”). This statement explains how we handle personal data when you visit signalsitter.com, create or use a SignalSitter account, send monitoring data to the service, configure a delivery destination, pay for a plan, or contact us. For account, billing, website, security, and support data, Flow XO LLC decides why and how the data is used and acts as controller or business. For monitoring data that a customer submits about its own systems or people, the customer decides the purpose and means of processing and Flow XO LLC acts as its processor or service provider. If you are represented in monitoring data by a SignalSitter customer, direct your request to that customer first; we assist the customer with requests we are required to support.
2. Data we collect
We collect the following categories: Account and membership data: name, email address, avatar, organization, membership, role, authentication session, and provider-issued identifiers. Clerk is authoritative for names, email addresses, avatars, and sessions. SignalSitter's control plane stores pseudonymous Clerk identifiers and roles, not members' names or email addresses. If you choose to sign in with Google, Google processes that sign-in and shares your name, email address, profile image, and Google account ID with Clerk, which holds them for us with your other account details. Google sign-in is optional; you can use an email address and password instead. Account notices: when SignalSitter warns an organization about abuse limits, suspends it, or reactivates it, it reads each administrator's email address from Clerk at that moment and passes it, with the notice, to the provider that delivers the email. SignalSitter keeps an opaque recipient identifier and the delivery outcome, not the address. Each notice includes a link to stop further notices. Monitoring and service data: monitor names and keys, configuration, observation payloads and numeric measurements, incidents, incident timelines, delivery attempts, anomaly feedback, usage, and timestamps. Destination and credential data: callback URLs, encrypted or derived signing material, credential labels, public prefixes, and derived credential verifiers. Secret values are shown once where the product says they are and are not readable back from the service. Billing data: organization and plan identifiers, subscription state, and Stripe customer and subscription identifiers. Stripe, not SignalSitter, stores payment methods, invoices, and refund details. Security and operational data: request and correlation identifiers, public actor and organization identifiers, operation names, problem codes, bounded diagnostic reasons, audit records, refusal counts, and ephemeral IP rate-limit keys. Service performance telemetry includes operation and outcome categories, background-duty labels, timings, counts, database row totals, database statement-shape fingerprints, fixed network-provider and method categories, trace and span identifiers and parent relationships, timestamps, pseudonymous organization and project identifiers, and service, environment, cost-component and instrumentation-scope labels. We do not put authorization credentials, callback secrets, configuration headers, observation payloads, measurement values, or raw MCP inputs in structured application logs. Correspondence: the content and addressing information in messages sent to support@signalsitter.com or privacy@signalsitter.com. Public-site and device data: IP address, user agent, request and security telemetry processed by Cloudflare and Framer when they deliver the public site, and essential browser storage used for authentication, security, and appearance preferences in the application.
3. Why we use data
We use data to provide, secure, troubleshoot, and improve SignalSitter; create and authenticate accounts; enforce organization scope and plan limits; accept and retain observations; detect and record incidents; deliver customer-directed callbacks; administer subscriptions; notify organization administrators about their account; answer support and privacy requests; prevent abuse; keep an audit trail; comply with law; and protect our customers, the public, and the service. Depending on the data and where you live, our legal basis is performance of our contract with you, our legitimate interests in operating and securing the service, compliance with law, consent where the law requires it, or the customer's instructions where we act as processor. We do not sell personal data or use it for cross-context behavioral advertising. We do not send observation payloads, measurement names or values, callback URLs, or credentials to Axiom. We do not send customer observation payloads or measurement values to an analytics provider, a session recording provider, or an AI model provider.
4. Cookies and telemetry
The authenticated application uses cookies and browser storage that are necessary to authenticate users, maintain sessions, prevent abuse, and remember appearance preferences. Cloudflare and Framer process ordinary request and security telemetry to deliver the public site and application. SignalSitter does not currently use optional advertising cookies, third-party product analytics, or session recording. If that changes, we will update this statement and obtain consent where required before using non-essential cookies. We use server-side operational metrics and sampled traces to diagnose service performance and reliability. Axiom processes the service performance telemetry described above.
5. Retention, export, and deletion
The current Free plan keeps readings for 14 days. The current Builder plan keeps them for 90 days, and the current Smart and Scale plans keep them for 365 days. Readings are the values, metadata, and data a monitor publishes, together with the summaries built from them, which share the same horizon. Retention runs in bounded background passes, so these horizons describe when readings become eligible for deletion, not deletion at an exact instant. Incident history becomes eligible based on closure, delivery history based on settlement, and open incidents and unsettled deliveries remain until they close or settle. Anomaly feedback becomes eligible based on submission. Plan changes do not rewrite already-issued plan versions, and the plan shown in the product is authoritative for your organization. Configuration, destinations, credentials, and organization projections remain until they are deleted, revoked, disabled, or the organization is purged. The general control-plane audit index is retained for one year. API credential audit history is retained for one year. Operational receipts and abuse refusal samples are retained for 30 days. Axiom's operational metrics and sampled trace datasets are configured for 30-day retention. Cloudflare platform logs and Microsoft 365 correspondence follow the applicable provider and tenant settings; SignalSitter does not promise a fixed deletion date for those records. You can export the organization's available data before requesting organization deletion. An organization deletion ends access, revokes credentials, disables destinations, and cancels a paid subscription immediately. Unless you choose immediate deletion, the request can be reversed for 7 days and the production stores are then purged. Immediate deletion begins that purge without the reversal window. Export is not available after the deletion request. Payload-free tombstones that prevent identifier reuse, bounded usage aggregates, and audit records may remain for security, accounting, and legal purposes. Deleting one monitor is immediate and irreversible.
6. Where data is processed
SignalSitter stores monitoring data, including monitor configuration, observations, incidents, delivery records, and credential verifiers, together with pseudonymous account identifiers and audit records, in a PostgreSQL database in the European Union. PlanetScale hosts that database in Amazon Web Services' Ireland region (eu-west-1) and keeps its backups in the same region. The service that accepts observations, evaluates monitors, and sends callbacks runs on Heroku in that AWS region, and readings, the values, metadata, and data a monitor publishes with their summaries, are stored in ClickHouse Cloud in the same AWS region. A monitor created with the EU jurisdiction is stored in the European Union. A monitor created with the unrestricted jurisdiction is currently stored in the same EU deployment, but unrestricted is not a promise of storage in the European Union, the United States, or any other country. Jurisdiction is fixed when a monitor is created. Requests to the application, API, and ingest addresses enter Cloudflare's global network. SignalSitter's edge Workers validate application and API requests and forward them to the EU service, and Cloudflare's proxy forwards ingest requests to the EU service directly. Observation payloads therefore pass through Cloudflare's network in transit; Cloudflare does not store monitoring data for SignalSitter. SignalSitter has not restricted the region in which its Workers run, and Cloudflare offers no regional placement for Workers Logs. Clerk stores account identity and session data in the United States. WhooshBang stores administrators' email addresses and notice delivery records in the European Union. Flow XO Mail, operated by Flow XO LLC, sends account notices through Amazon Simple Email Service in AWS Ireland (eu-west-1); its service database and mail content storage are in that same region. Human correspondence is stored in the existing Flow XO LLC Microsoft 365 tenant location. Stripe and the other providers below may process data in the countries where they and their subprocessors operate. Where personal data is transferred internationally, we rely as applicable on an adequacy decision, including the EU-US Data Privacy Framework for certified US recipients, the European Commission's Standard Contractual Clauses, the UK Addendum or data bridge, or another lawful transfer mechanism. Choosing an EU monitor does not make identity, support correspondence, routing metadata, or platform logs EU-resident.
7. Service providers and subprocessors
These are the external providers that currently process personal or customer data for SignalSitter:
Cloudflare, Inc.
What it handles: Public and application traffic; edge Workers that validate and forward API and application requests; the proxy in front of the ingest addresses; EU-restricted R2 storage of deletion and recovery bookkeeping; rate limiting; platform logs
Location and transfer posture: Global network. R2 storage is restricted to the EU; SignalSitter does not restrict Worker execution to a region, and log placement is not selectable. Cloudflare's DPA includes international-transfer safeguards.
PlanetScale, Inc.
What it handles: The PostgreSQL databases that store SignalSitter monitoring data, configuration, incidents, delivery records, credential verifiers, pseudonymous account identifiers, usage and audit records, and Flow XO Mail domain, message-operation and delivery records for account notices
Location and transfer posture: PlanetScale's eu-west region, hosted in AWS Ireland (eu-west-1), with backups in the same region. PlanetScale's DPA incorporates the Standard Contractual Clauses for international transfers.
ClickHouse, Inc.
What it handles: The readings store: the values, metadata, and data monitors publish, and the summaries built from them
Location and transfer posture: ClickHouse Cloud in AWS Ireland (eu-west-1). ClickHouse's DPA governs processing and transfers.
Salesforce, Inc. (Heroku)
What it handles: The processing service that accepts readings, evaluates monitors and sends callbacks, with its operational logs
Location and transfer posture: Heroku's EU region in AWS Ireland (eu-west-1), under Salesforce's DPA with Standard Contractual Clauses.
Amazon Web Services, Inc.
What it handles: Flow XO Mail account-notice sending through Amazon Simple Email Service, mail content storage, delivery events and operational logs
Location and transfer posture: AWS Ireland (eu-west-1). The AWS Data Processing Addendum, incorporated in the AWS Service Terms, includes the Standard Contractual Clauses.
Axiom, Inc.
What it handles: Operational metrics and sampled traces: timestamps, trace and span identifiers and parent relationships, operation and outcome categories, background-duty labels, timings, counts, database row totals and statement-shape fingerprints, fixed network-provider and method categories, pseudonymous organization and project identifiers, and service, environment, cost-component and instrumentation-scope labels
Location and transfer posture: Telemetry is stored in Axiom's EU Central 1 (AWS) deployment with 30-day dataset retention. Axiom's Data Processing Addendum includes Standard Contractual Clauses for applicable international transfers.
Clerk, Inc.
What it handles: Account identity, organization membership, authentication, and sessions
Location and transfer posture: United States. Clerk relies on the EU-US Data Privacy Framework and contractual safeguards described in its DPA.
Google LLC
What it handles: Optional Google sign-in: Google processes the sign-in and shares your name, email address, profile image, and Google account ID with Clerk
Location and transfer posture: Google’s global infrastructure, under Google’s own privacy policy. SignalSitter sends Google no monitoring or customer data.
Timescale, Inc. (Tiger Data)
What it handles: The database of WhooshBang, holding administrators' email addresses, consent records and delivery outcomes for account notices
Location and transfer posture: AWS Ireland (eu-west-1). Tiger Data's DPA governs processing and transfers.
Stripe, Inc. and its applicable affiliates
What it handles: Checkout, payment methods, subscription administration, invoices, and billing-provider records
Location and transfer posture: Stripe processes data internationally under its DPA and transfer mechanisms.
Microsoft Corporation and its applicable affiliates
What it handles: Human support and privacy correspondence in Microsoft 365
Location and transfer posture: The existing Flow XO LLC tenant location and Microsoft’s service locations, subject to Microsoft’s DPA and transfer commitments.
Framer B.V.
What it handles: Hosting and delivery of the public website and its ordinary request telemetry
Location and transfer posture: Framer and its subprocessors may process data internationally under Framer’s DPA and Standard Contractual Clauses.
GitHub, Inc.
What it handles: Deployment and a restricted operator workflow carrying organization identifiers and bounded support diagnostics
Location and transfer posture: GitHub’s service locations, subject to its data-protection terms and transfer mechanisms. The workflow does not expose observation payloads, measurement names or values, callback destinations, or secrets.
Account notices to organization administrators are delivered through WhooshBang and Flow XO Mail, both operated by Flow XO LLC. Flow XO Mail uses Amazon Simple Email Service to send these notices from notices.signalsitter.com. Customer-configured HTTPS callback destinations are recipients chosen by the customer, not our subprocessors. Where SignalSitter offers it, a customer may instead choose a WhooshBang destination operated by Flow XO LLC; that sends the incident data the customer directs to that separate service and any messaging providers the customer configures there.
8. Sharing and disclosure
We disclose data to the providers above to operate the service; to a destination you configure; within your organization according to membership and role; when required by law or a valid legal process; to protect rights, safety, and the service; or as part of a merger, financing, acquisition, or sale of assets with appropriate protections. We do not disclose monitoring data to support staff through the support-diagnostics interface: it exposes state, timing, counts, and public identifiers only.
9. Security
We use administrative, technical, and organizational safeguards designed for the nature of the data, including HTTPS, tenant-scoped authorization, isolated monitor authorities, derived credential verifiers, encrypted or derived secret material, one-time secret display, callback destination validation and DNS rechecking, structured log allowlists, least-privilege operator access, and audit records. No service is perfectly secure, and these controls are not a guarantee that an incident cannot occur.
10. Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal data; object to or restrict processing; withdraw consent; and complain to a data-protection authority. You may also have the right to appeal our response. We may need to verify your identity and may retain information where law permits or requires it. Account holders can use product controls where available or email privacy@signalsitter.com. If a SignalSitter customer submitted data about you, contact that customer first because it controls the data; the customer can route an authorized request to us. Authorized agents may make requests where the law allows it, subject to verification.
11. Children
SignalSitter is a business service and is not directed to children. You must be at least 18 years old to create an account. We do not knowingly collect personal data directly from children through account registration.
12. Changes and contact
We may update this statement when the service or law changes. We will publish the revised statement at https://signalsitter.com/privacy with a new last updated date and provide additional notice where required. Questions and privacy requests: privacy@signalsitter.com General support: support@signalsitter.com Flow XO LLC, 4711 Muirfield Ct, Santa Rosa, CA, United States