Privacy Policy

1. At a glance

Sign Pulsar lets you preview email-signature designs, create an account with a secure email link, subscribe through Stripe, upload a profile photo or company logo as a paid user, and export a signature after paid access is verified. Optional email insights can record aggregate open signals and tagged-link clicks. Sign Pulsar does not connect to your inbox, read message content, or store recipient email addresses in its tracking tables.

We do not sell personal information, and the current application does not use personal information for cross-context behavioral advertising.

2. Information we handle

Account and workspace information

When you request a sign-in link, Supabase Auth processes your email address and maintains the session needed to recognize your account. The service creates a workspace identifier and may store workspace membership and role information.

Signature information

The studio can process the details you choose to enter, such as a name, job title, company, email, phone, website, location, professional links, profile photo, and company logo, plus template and color settings. Text and design edits are saved in this browser tab's session storage, scoped to the signed-in account and workspace, so they survive a reload or a dashboard visit. Drafts are cleared when you sign out and are never used to grant subscription access. If browser storage is unavailable, edits stay in the current page only. When a paid user selects an image, the browser validates and normalizes it before the authenticated upload-signature-assetEdge Function rechecks workspace ownership and paid access and stores the prepared image in the signature-assets Supabase Storage bucket. When a paid user requests an export, the signature details and the resulting image URLs are sent to the secure rendering service to produce the HTML and plain-text signature.

Normalized profile photos and company logos are served from public HTTPS URLs so recipients' email clients and mail providers can load them without a Sign Pulsar account. These uploaded images are not private files. Anyone who obtains the public URL may request the image, and email providers, security scanners, or privacy proxies may fetch, log, or cache it. Do not upload an image that should remain confidential.

Billing information

Stripe processes card and payment details on its hosted pages. Sign Pulsar does not receive full card numbers. To verify access and prevent duplicate subscriptions, the service stores limited billing records such as your account email, Stripe customer and subscription identifiers, subscription status, billing period, price, currency, and Checkout attempt status.

Technical information

Authentication and hosting providers may process standard request information such as IP address, browser or device details, timestamps, and security logs. The application also uses essential browser storage to keep you signed in. The site does not use an advertising-personalization pixel. Google Analytics remains off unless you select Allow measurement.

3. Optional campaign and site measurement

Sign Pulsar can recognize a limited set of campaign values in the landing-page address: gclid, gbraid, wbraid, and the standard utm_source, utm_medium, utm_campaign, utm_content, utm_term, device, matchtype, and network values. Unsupported fields are discarded and accepted values are length-limited and sanitized.

Before you choose, these values can remain in memory for the current page but are not persisted. If you select Allow measurement, the accepted values are stored in first-party browser storage for no more than 30 days and may be attached to your secure Checkout attempt to measure whether an ad led to a paid subscription. The signed-in Checkout service records the time and current policy version of that choice; it does not infer consent merely because campaign values are present. Selecting Essential only removes stored campaign attribution.

If you select Allow measurement, the site loads the Google Analytics tag G-3CTQYZED6V. Google Analytics may receive the page address, referrer, device and browser information, and interaction events used to understand site usage. Analytics storage is enabled only after that choice. Google advertising storage, advertising user data, and advertising personalization remain denied in the browser tag. If you select Essential only, the Google Analytics script is not loaded.

After a signed Stripe webhook confirms the first paid subscription invoice, Sign Pulsar may send a stored, consented gclid, gbraid, or wbraid to Google's server-side Data Manager API with the Stripe invoice identifier, paid time, USD currency, and actual paid purchase value. Each purchase request includes at most one of those click identifiers. The purchaser's email is not included in that Google conversion request. Without a stored Google click identifier and the matching authenticated consent record from Allow measurement, no Google conversion request is sent.

You can change this choice here at any time. To request deletion of server-side Checkout attribution, email contact@federalbidpartners.com and identify the email used for your Sign Pulsar account.

4. How information is used

• Authenticate your account and protect paid features.
• Validate, normalize, store, publicly serve, render, and deliver the signature images and export you request.
• Start Stripe Checkout, verify payment status, and provide billing management.
• Operate optional email insights when you deliberately enable them.
• Prevent abuse, diagnose failures, protect the service, and meet legal recordkeeping duties.

5. Optional email insights

Email insights are off unless a paid user turns them on for an export. When enabled, the exported signature can contain tagged destination links and a one-pixel remote image. A request to the image can create an approximate open event; selecting a tagged link can create a click event before redirecting to the chosen HTTPS destination.

The application tracking table stores a signature or link identifier, event type, timestamp, short time bucket, and a truncated keyed fingerprint used to suppress rapid replay. The fingerprint is calculated transiently from ordinary request signals; the table is designed not to persist recipient email content, recipient email addresses, IP addresses, or full user-agent strings. Infrastructure providers may still process ordinary network logs. Common scanner and prefetch traffic is filtered and a daily workspace quota limits abuse, but open signals remain estimates because privacy proxies, image blocking, forwarding, bots, and security scanners can make them inaccurate. Tracking automatically stops accepting events when paid entitlement expires.

You are responsible for using tracking lawfully and for giving recipients any notice or choice required by the laws and workplace policies that apply to you.

6. When information is shared

Information is disclosed only as needed to operate the service, including to:

• Stripe, for hosted Checkout, subscriptions, receipts, refunds, and billing management.
• Supabase, for authentication, database and object storage, public delivery of signature images, and server-side functions.
• Google, for consent-gated site analytics and server-side purchase measurement using click identifiers and limited transaction data as described above, without sending the purchaser email.
• Hosting and security providers, to deliver the site and protect its availability.
• Authorities or professional advisers, when reasonably necessary to comply with law, protect rights, or address fraud and disputes.

Those providers process data under their own terms and privacy commitments.

7. Retention, security, and your choices

We retain account, billing, security, and service records only as long as reasonably necessary to provide the service, maintain financial records, resolve disputes, prevent fraud, and meet legal obligations. Signature-tracking records remain associated with their signature until they are deleted or removed under an operational retention process. No fixed retention period is promised by this version of the policy.

Uploaded signature images remain publicly retrievable at their object URLs while they are stored in the signature-assets bucket. Deleting or replacing an object cannot recall a copy already downloaded, forwarded, or cached by an email recipient, provider, scanner, or proxy.

Sign Pulsar uses access controls, row-level database policies, signed Stripe webhooks, HTTPS endpoints, and server-side entitlement checks. No online service can guarantee absolute security.

You can leave insights off, cancel the subscription through the Stripe Customer Portal, and request access, correction, or deletion where applicable. Some billing, fraud-prevention, or legal records may need to be retained after a request.

8. Children and international processing

Sign Pulsar is a business productivity service and is not directed to children under 13. Service providers may process information in countries other than your own, subject to the safeguards they make available and applicable law.

9. Requests, questions, and policy changes

For a privacy or account request, use the support contact presented at Stripe Checkout, on your Stripe receipt, or in the Stripe Customer Portal, or email contact@federalbidpartners.com. Include the email used for your Sign Pulsar account, but never send a full card number or password.

We may update this policy as the service changes. A material update will be posted here with a revised effective date.