1. Who is responsible for your data
The Gignal operator determines why and how personal data is processed and is its controller under the Law of Ukraine On Personal Data Protection. Send privacy requests to [email protected].
For account, subscription, support, and security data, the operator determines the purposes and acts as controller. For client, colleague, and other third-party contacts you add to the workspace, you determine the purpose and lawful basis, while Gignal processes the data on your instructions to provide the service.
For customer-controlled workspace data, these Terms are your documented processing instructions. Gignal limits access to authorised personnel and subprocessors bound by confidentiality, assists with reasonable data-subject and incident requests, and deletes or returns data through the available export and deletion functions, subject to backups and legal retention. Contact us before use if you require a separately signed data-processing agreement.
2. Data we process
- Account and security
- Username, email, name, language, time zone, password hash, two-factor authentication settings, sessions, role, and organization membership.
- Workspace
- Organization, clients, contacts, contracts, tasks, meetings, time entries, notes, proposals, and client portal messages.
- Financial data
- Transactions, expenses, invoices, supporting files, invoice bank details, exchange rates, tax settings, and calculation results.
- Imports and integrations
- CSV content during the import wizard, parsed rows, external IDs used for deduplication, and identifiers for connected Google or Telegram integrations.
- Subscription
- Plan, status, seat count, Paddle customer and subscription IDs, and payment event history. Gignal does not receive your full card number.
- Technical data
- IP address, request headers, browser type, security and error logs, essential cookies, and aggregated events on public pages.
- Signup source
- Campaign UTM tags, the first landing page, and signup, verification, and first-value dates. We do not copy client names, amounts, time entries, IP addresses, or the full referrer into this analytics record.
3. What we do not collect
- Passwords or access codes for Upwork, Payoneer, or banks. Gignal does not connect to your financial accounts or move money.
- Full payment card details. Paddle processes them in its own secure environment.
- Data for advertising profiles or sale to advertising networks.
- Your client or financial records for training machine-learning models.
4. Why we process data and our legal basis
| Purpose | Legal basis |
|---|---|
| Account creation, product features, imports, calculations, exports, and support | Performance of a contract |
| Security, abuse prevention, error diagnosis, and backups | Legitimate interest |
| Measuring which campaigns lead to signup and a first useful action | Legitimate interest in improving the service with data minimisation |
| Payments, subscription records, and compliance with mandatory requirements | Contract and legal obligation |
| Optional digests, browser notifications, and integrations that you enable | Consent, which you may withdraw |
5. Providers that help us process data
We share only the data each provider needs for its specific function:
- Cloudflare and our hosting infrastructure process network traffic, IP addresses, and server logs.
- Our email provider receives the address, subject, and content of transactional emails and digests.
- Paddle processes payments, payment and tax documents, and returns subscription status to Gignal.
- Google processes OAuth sign-in or Calendar data only when you connect the relevant integration.
- Telegram receives bot commands and replies only after you choose to connect it.
- Operator-configured S3 storage and error monitoring may process files or technical diagnostics for their respective purposes.
- The NBU API receives only the currency and requested rate date, without a user identifier.
Gignal may disclose data in response to a valid lawful request from a competent authority or when needed to protect rights and safety. We do not sell personal data.
6. Cookies and analytics
Essential cookies support sign-in, form protection, language, and session security. Public marketing pages use self-hosted Plausible for aggregated page-view and CTA-click statistics. Analytics is not loaded in the authenticated workspace and does not receive client, financial, or tax data.
When you open Gignal with UTM tags, they are temporarily stored in the existing session and, after signup, linked to the workspace together with verification and first-value dates. This provides a campaign funnel without an advertising profile, third-party cookies, or copying workspace data.
| Technology | Purpose | Duration |
|---|---|---|
| sessionid | Keeps you signed in to the protected workspace | Up to 14 days or until you sign out |
| csrftoken | Protects forms from forged requests | Up to 1 year |
| django_language | Remembers your selected language | Until the browser session ends |
| localStorage | Remembers theme and local interface preferences on this device | Until you clear site data |
In our configuration, Plausible sets no analytics cookies and creates no advertising profiles. If the cookie set or analytics purpose changes materially, we will update this Policy and, where required, request consent before enabling non-essential technologies.
7. How long we retain data
- Account and workspace data is retained while the account exists or until you delete an individual record.
- Uploaded CSV text is available to the import wizard for up to 10 minutes and is deleted after confirmation or cancellation; only the data you choose to import is retained.
- Backups rotate automatically; by default, up to 14 latest copies are retained and expire through rotation.
- Payment and accounting records are retained as long as Paddle, the operator, and applicable law require for accounting, refunds, and disputes.
- Technical logs are kept only for the operational rotation period, unless needed for an incident investigation or legal obligation.
8. Location and international transfers
Core infrastructure may operate in Ukraine, the European Economic Area, or other countries where providers are located. For international transfers, we use contractual and organizational safeguards available for the provider and required by law.
9. How we protect data
We use TLS, password hashing, CSRF protection, sign-in rate limits, two-factor authentication, role separation, organization-level data isolation, backups, and restricted administrative access. No system is perfectly secure; we notify users and competent authorities of material-risk incidents within time limits required by applicable law.
If we confirm a personal-data incident affecting customer-controlled data, we will notify the affected workspace owner without undue delay where required by law and provide the information reasonably available for assessment and response.
10. Your rights
You may ask about processing, access and obtain a copy of your data, correct or delete it, restrict or object to processing, transfer it, and withdraw consent where consent is the basis. Export and deletion are available in your profile; for other requests, write from your account email. We may verify your identity to avoid disclosing data to someone else.
If you added your client's data as its controller, you respond to that person's rights request and may use Gignal's export, correction, or deletion features. We will assist with a valid request within technical capabilities and the law.
11. Children's data
Gignal is intended for adults and does not knowingly collect children's data. If you believe a child created an account, tell us so we can investigate and delete it.
12. Changes and contact
The current Policy always shows its effective date. We will give at least 14 days' notice by email or in the product before materially expanding data categories, purposes, or recipients, unless the law requires otherwise.
Data and privacy requests: [email protected]. You may also complain to the Ukrainian Parliament Commissioner for Human Rights or another competent supervisory authority.