Signatrue is operated by Steps Technologies Ltd, a company registered in England and Wales (company number 17422636), registered office 124 City Road, London, EC1V 2NX, United Kingdom, which is the data controller for the personal data described here.
Signatrue collects account details, contact details, order and payment information, uploaded photographs and evidence, listing details, and assessment results to create and secure your account, assess your items, take payments, deliver results and support you. We also keep reviews you submit and your marketing preference. Passwords are stored as secure hashes, not readable passwords. Stripe processes your card details; we do not store your full card number.
We use account and order information to perform our contract with you, keep accounting information to meet legal obligations, and use security and deletion records for our legitimate interests in protecting the service and preventing deleted data from returning. Optional marketing emails and website tracking rely on your consent.
We use Stripe for payments, Amazon Web Services for photo and evidence storage, MongoDB Atlas for the database and backups, and Hostinger for email and server hosting. These providers process the information needed to provide their services. We do not sell your personal data.
The website uses essential cookies to keep you signed in and make the service work. Google Analytics (site usage statistics) and Meta Pixel (advertising measurement) load only after you accept optional cookies. You can refuse them by choosing Reject in the cookie banner.
To change your choice or withdraw consent, use the Cookie settings link at the bottom of any page and choose Reject. See our Cookie Policy.
The mobile app has no analytics, advertising or tracking SDKs.
You can request account deletion from your account page or the mobile app. We confirm your password first. The standard request has a 28-day cancellable window. You can choose immediate erasure instead. New orders and payments are blocked once deletion is requested.
When deletion completes, we remove the account, orders, certificates and stored files from the live service. We minimise payment and accounting records by removing account email and other stored metadata while retaining financial and audit fields where needed. A keyed hash of your email and deletion time is kept to prevent restored backups from reviving deleted data.
| Data | Kept for |
|---|---|
| Account (name, email, password stored securely) | Until you delete your account (28-day window, or immediately) |
| Orders, photos, certificates, reviews, support messages | While the account exists; deleted with it. Certificates stay so their QR code keeps working |
| Rapid Review results | 30 days |
| Cancelled unpaid orders | Deleted when cancelled |
| Payment and accounting records (email removed) | 6 years from the end of the financial year (HMRC) |
| Database backups | 30 days (daily backups). Deleted accounts are removed again after any restore |
| Deletion record (an unreadable code made from your email) | Only as long as backups that might contain the account exist |
| Server logs | 30 days |
Rapid Review results expire after 30 days even if database deletion is delayed. Keeping a certificate while your account exists does not extend that validity period.
Depending on the circumstances, you can ask to access, correct or erase your personal data, restrict its use, or receive and transfer a copy of data you provided. You can object to processing based on legitimate interests, including use for direct marketing. You can withdraw consent at any time without affecting the lawfulness of earlier processing.
Contact us at info@signatrue.ai or through the contact page to exercise your rights or raise a privacy complaint. We may need to confirm your identity. You can also write to our registered office above.
You have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Our service is for people aged 18 or over. We do not knowingly collect personal data from children. Please contact us if you believe a child has given us personal data.
Contact us through the contact page about your data or a deletion request.