1. Who is responsible for your information
SignalHub's public trial and demo instance is operated by Ramesh Maharaddi, the individual developer maintaining the open-source project, based in Singapore. Public contact for privacy and support: support@signalhub.at. References to we and us mean that individual. This notice covers the public demo's accounts, operation and workspace information, not every installation of SignalHub.
The maintainer handles account and operational information to run the demo. People or organizations creating workspaces decide what test information to add, what to publish, and whom to notify. They remain responsible for the permissions and disclosures needed for information they supply. The precise controller and processor roles depend on the activity and applicable law; describing the instance as a free demo does not remove responsibilities for personal information.
A workspace's own privacy notice is linked from its status page. This demo notice does not replace it or any data-processing agreement required for the activity. Use synthetic workspace content and test recipients, not production customer data. Account emails, connection logs and information you actually submit may still identify real people.
2. When you download and self-host
The public demo helps you evaluate the project before running your own installation. On a self-hosted installation, its operator determines the infrastructure, providers, access controls, retention and privacy practices. Contact that operator and read its notice for information handled there. These demo documents do not make the project maintainer responsible for operating every downloaded copy.
Downloading or running the open-source software does not itself give the maintainer permission or access to administer your instance or read its database. Information you separately send to the maintainer for support, or to external services through your chosen integrations, is a separate data flow. Do not include personal information or secrets in public issue reports or support attachments.
3. Information the service handles
Account and access information: name, email address, account identifiers, password hashes, verification and recovery records, workspace memberships and roles, accepted document URLs and versions, and acceptance times. Depending on configuration, this includes SSO identifiers and claims, MFA enrollment material, recovery-code hashes and trusted-device records.
Workspace information: page branding and assets, components, incidents, maintenance updates, announcements, metrics, team invitations and administrative changes. Public content is visible to its selected audience; administrators and members can access information according to their permissions.
Monitoring and integration information: target URLs, hostnames, addresses, ports, request settings, supplied credentials or tokens, check results, timings, error details and relevant response information. Targets and responses can contain personal information or secrets; configure checks to avoid collecting unnecessary material.
Subscriber and delivery information: email addresses or phone numbers, verification records, chosen pages and components, subscription preferences, consent evidence, unsubscribe or restriction events, message content, delivery attempts, outcomes and provider responses. A workspace may supply or import information about its own contacts.
Operational information: IP addresses, browser or device information, session activity, security and administrative audit events, rate-limit records, application logs, export jobs, support correspondence and privacy-request details. Collection depends on the feature and deployment; aggregate page analytics do not mean that security logs contain no personal information.
4. Where information comes from
We receive information from you when you register, configure a workspace, subscribe, contact support or make a request; from workspace administrators and invitations; from enabled identity and delivery providers; and from monitoring requests and use of the service. Public status content comes from the publishing workspace and its configured monitors or integrations.
5. Purposes and legal bases
We use information to create and authenticate accounts; enforce permissions; operate monitoring and status pages; send verification, security and requested status messages; provide integrations and exports; handle support and privacy requests; prevent abuse; investigate faults; manage capacity; and maintain evidence of consent, acceptance and administrative actions.
The operator must identify the applicable legal basis for each purpose, including any reliance on contract, consent, legal obligation or legitimate interests and the relevant interests: Account, workspace and contact information is used as needed to provide the demo requested by users and perform the demo agreement. Where applicable law permits reliance on legitimate interests, service administration, troubleshooting, security and abuse prevention support the interest of operating and protecting the service. Optional subscriptions and communications rely on consent where required. Processing required by law, including applicable record-keeping and responses to valid legal requests, relies on the relevant legal obligation. Where another activity requires consent under applicable law, that consent is required separately. Where consent is the basis, it can be withdrawn without affecting processing that was lawful before withdrawal. Acknowledging this notice does not provide consent for unrelated marketing.
Account information needed to authenticate and operate the service is necessary to provide an account. Without a subscriber contact method, we cannot deliver that channel's updates. Optional content, integrations and subscriptions are controlled through their settings. We do not use this notice to authorize selling customer content or unrelated advertising uses.
6. Public pages and workspace access
Information published on a public status page can be viewed, searched, copied or redistributed by others. Removing it from SignalHub does not necessarily remove search-engine caches or recipient copies. Workspace administrators control page access, member roles and publication settings and should check them before including personal information.
Authorized workspace members may access subscriber, operational or content information according to their roles. The operator may access information when necessary to operate, secure or support the service, respond to requests or meet legal obligations. Do not place information in a public page that should remain confidential.
9. Processing locations and international transfers
Information may be processed where the operator, infrastructure providers, configured integrations and recipients operate. The application host's EU location does not mean every provider processes data only in the EU. When the built-in Twilio integration is used, it sends SMS requests to Twilio's default API endpoint, which Twilio identifies as its US processing region; other provider operations and message delivery can involve additional locations. A user's location or the service's domain name does not establish where all information is stored or accessed.
Applicable international transfer arrangements, safeguards and how to obtain information about them: Information may be processed outside your country by the maintainer, service providers or recipients. Applicable data-protection requirements continue to apply. This notice does not promise exclusive-country storage or assert that a particular transfer mechanism has been verified for every provider. Contact support@signalhub.at for available details about particular processing and transfer arrangements. No specific data-residency guarantee or transfer mechanism is represented unless confirmed here or in a separate applicable agreement.
10. Retention, exports and deletion
Demo monitor-check history, metric points, aggregate analytics and delivery history have configured retention windows capped at 90 days. Demo resets, workspace deletion or operational changes may remove evaluation data sooner; this is not a minimum storage commitment. Scheduled cleanup performs deletion after records become eligible; these windows are not a guarantee of deletion at an exact instant.
Accounts, workspace configuration and published content are generally needed while the service is being used. Resolved incidents are not automatically removed merely because monitoring history expires; incident deletion depends on the workspace's explicit retention setting or deletion action. Active subscription consent evidence remains associated with the subscription until it is detached or removed under the applicable process.
The application's configurable defaults are 2,555 days for audit records, 365 days after completion for closed privacy requests, 365 days for detached consent evidence, and 7 days for completed export archives. These are software defaults, not a statement that every deployment uses them or that each period is legally appropriate. Expired verification and recovery records are cleaned up separately.
The operator's actual periods and reasons, including account closure, acceptance evidence, operational logs and any legal holds: Information is retained according to its purpose, the configured record-specific retention rules, and applicable legal or security needs. Accounts and workspace content may remain while the account or workspace is in use. Demo data may be reset or removed at the maintainer's discretion; no fixed account-deletion or demo-reset timetable is promised. Acceptance, consent, audit and privacy-request records can have separate retention rules. Deletion and anonymization requests are reviewed through the service's privacy-request process, subject to applicable exceptions. Records needed for a justified legal obligation, security investigation or dispute may be retained for the applicable period with appropriate restrictions.
Backup retention and removal cycle: Where backups exist, residual copies may remain until overwritten, expired or deleted under the applicable operational arrangements. No fixed backup-retention period, deletion cycle or recovery guarantee is offered for this evaluation demo. Backups are for recovery rather than ordinary use; any restoration must take account of previously completed deletion and restriction requests. Contact support@signalhub.at about a particular deletion request. Deletion from the active service does not guarantee immediate erasure from backups or copies already received by independent recipients. Export links and files expire; download available data before closing a workspace.
11. Security measures
The application uses password hashing, access controls, session management and multi-factor authentication when configured or required, with encrypted storage for supported integration and authenticator secrets. Security also depends on deployment configuration, protection of encryption keys, transport security, backups and the providers in use. These measures reduce risk but cannot guarantee that every threat or unauthorized disclosure will be prevented.
Use strong credentials, limit membership and API permissions, protect recovery codes and inspect publication settings. Report suspected compromise to the contact in this notice without sending passwords or private keys. The operator will assess incidents and provide notifications where applicable law requires them.
12. Your choices and privacy requests
Depending on applicable law and the processing involved, you may have rights to access, correction, erasure, portability, restriction, objection and withdrawal of consent. These rights can have exceptions, including information needed for legal obligations or the rights of others. We may need proportionate identity or authority checks before releasing information or changing an account.
Subscribers can use the private preferences link in subscription messages to unsubscribe, manage preferences, export available personal data or submit a privacy request. Keep that link private. Signed-in workspace users can open Privacy in their workspace. You can also contact the operator using the details below, including if you cannot sign in or have not created a workspace.
For a workspace's subscriber or published data, contact that workspace through its status-page privacy notice; the hosted operator can help identify the appropriate route. Unsubscribing from status updates does not stop account-security messages necessary for an active account. Requests will be addressed within applicable legal time limits, with an explanation where an exception or permitted extension applies.
Privacy questions and complaints: support@signalhub.at. You may also complain to the competent supervisory authority where applicable. Regulator details: For privacy questions, contact Ramesh Maharaddi at support@signalhub.at. You may contact the Personal Data Protection Commission of Singapore at https://www.pdpc.gov.sg, or another competent authority where applicable.
13. Children's information
The public demo is intended for adult users and is not directed at children. Demo account registration requires users to be at least 18. Do not knowingly use a demo workspace to collect children's personal information. Contact the maintainer if you believe a child has supplied information so the circumstances can be assessed and appropriate action taken. This demo eligibility rule is not an additional condition on the open-source software license.
14. Changes to this notice and contact
We will update this notice when relevant practices change and identify the current version and effective date. Material changes will be communicated through the service or an appropriate account contact where reasonably possible. Where a new processing purpose requires consent or another legal step, changing this notice alone does not replace that requirement.
Contact Ramesh Maharaddi at support@signalhub.at. Operator location: Singapore. Identify the workspace or page involved and the nature of your request, and provide only the information necessary to handle it.