Privacy policy

Who operates the service

FollowUpSignal is the name of a software service. The legal entity or individual operating this deployment has not been identified in the application configuration. Before public launch, the operator must publish its legal identity and a working privacy contact.

This draft describes the application currently represented by this codebase. Actual hosting, provider and business arrangements may differ and must be confirmed by the operator.

Information processed

The service processes account details such as a user's name and email address, organization profile information, authentication data and workspace roles. Customers may enter prospect contact details, lead notes, activities, objections, follow-up tasks, form submissions, campaign attribution and recorded conversion information.

The service also processes product events, workflow and message delivery records, billing references and transaction metadata, contact requests and technical logs needed to operate and protect the service. Payment card details are entered on the provider-hosted checkout and are not stored by FollowUpSignal.

Public forms may receive submitted contact details and campaign parameters. Form analytics use a generated visitor key for deduplication. The application does not intentionally store visitor IP addresses as form analytics data; infrastructure providers may process connection data in their own logs.

Purposes and roles

The operator uses account and technical data to provide authentication, lead management, reporting, billing, support-request storage, security and service operations. The lawful basis for each use depends on the operator, customer relationship, applicable law and actual deployment; the operator must document that assessment.

A business customer generally decides why prospect data is collected and how it is used. The customer is responsible for giving required notices, selecting an appropriate lawful basis, honoring rights requests and recording valid channel-specific consent. The operator may process this data to provide the service under customer instructions; the parties' legal roles require case-specific review.

Providers, messages and transfers

Configured providers may include MongoDB hosting, Paystack for hosted payment checkout, Resend for email, and Meta's WhatsApp Business Platform. A provider is used only when configured by the deployment operator or workspace. Providers process data under their own terms and privacy documents.

Data may be processed in countries other than the user's or prospect's location depending on the hosting and provider configuration. The operator must identify actual locations and implement any transfer safeguards required by applicable law before launch.

Messaging features must be used only with the required consent and in compliance with provider rules. The application records consent and opt-out states for supported channels.

Cookies and technical storage

Authentication uses cookies needed to maintain a signed-in session. The application does not currently include an advertising pixel, optional analytics tag or cookie-preference banner. Hosting and browser technologies may also use storage necessary for security and operation. See the cookie policy for the current scope.

Retention and deletion

Workspace data is retained while the account and workspace remain active and may remain in backups or operational records for a period set by the operator. A self-service account or workspace deletion workflow is not currently available. Contact requests are automatically removed after 30 days. Billing and security records may need a different retention period for accounting, dispute resolution or security; the operator must define and disclose that period.

The operator must create a documented process to verify and respond to data access, correction, export, objection and deletion requests. A public contact form submission is stored for manual review, but does not notify staff; do not use it for urgent or sensitive requests until a monitored channel is configured.

Security and children's data

The application uses authenticated accounts, workspace role checks, server-side authorization for supported operations, encrypted transport when deployed behind HTTPS, and provider-hosted payment checkout. These measures do not establish that every deployment, backup or integration is secure. No independent audit, certification, penetration test or verified backup restore is claimed.

The service is designed for business use and is not intended for children to create accounts. Customers should not enter children's personal data unless they have confirmed an appropriate legal basis and safeguards.

Updates and rights

The operator may update this policy as the product, providers or legal requirements change and should communicate material updates appropriately. Rights and complaint routes depend on applicable law and the responsible operator. For Nigeria-related processing, the operator should assess obligations under the Nigeria Data Protection Act, 2023 with qualified privacy counsel.