Privacy policy
Effective 19 October 2026
InboxSig (https://inboxsig.wouldairecommend.workers.dev) is run by SupaDesign, operated by Darren Buckley, a sole trader based in Cobh, Co. Cork, Ireland ("we", "us"). We are the data controller for account data. This policy explains what we collect, why, and your rights under the GDPR.
What we collect
- Signature details you type (name, title, phone, links). In the free builder these stay in your browser unless you save the signature or upload an image.
- Images you upload (logo, headshot), stored so email clients can display them.
- Account data if you sign up: email address, plan, and saved signatures.
- Click counts on Pro signature links: date, link and country only. No IP addresses or recipient identities are stored.
We do not sell personal data, we do not run advertising trackers, and our page analytics are aggregate counters (page path, day, referring site) with no cookies, no IP storage and no fingerprinting.
Why we use it (legal bases)
- To provide the service you signed up for (contract, Art. 6(1)(b) GDPR).
- To keep it secure and prevent abuse, e.g. rate limits and spam filtering (legitimate interests, Art. 6(1)(f)).
- To bill paid plans and keep tax records (contract and legal obligation, Art. 6(1)(b) and (c)).
- Service emails such as sign-in links, alerts you configured and billing notices (contract). We do not send marketing email without your opt-in.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1, EU jurisdiction), content delivery, DDoS protection | Data stored in the EU; served from Cloudflare edge worldwide |
| Stripe Payments Europe, Ltd. | Card payments and invoices for paid plans (we never see card numbers) | Ireland / United States |
| Resend, Inc. (only once email is switched on) | Sending sign-in links and notification emails | United States |
Where a provider processes data outside the EEA, transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
How long we keep it
- Saved signatures and images: until you delete them or your account.
- Images uploaded without an account: deleted after 18 months without views.
- Click counts: 24 months.
- Billing records: 6 years (Irish tax law).
Cookies
We set one strictly necessary cookie when you sign in (a session identifier, 30 days). No consent banner is needed because we use no analytics or advertising cookies.
Your rights
You can access, correct, export or delete your data, object to processing, or restrict it. Most of this is self-serve in the app (export and delete account); otherwise email hello@wouldairecommend.com and we will reply within 30 days. You can also complain to the Data Protection Commission (Ireland), dataprotection.ie, or your local authority.
Changes
We will post changes here and, for material changes, email account holders at least 30 days before they apply.
Contact
SupaDesign, operated by Darren Buckley, Cobh, Co. Cork, Ireland · hello@wouldairecommend.com