Version 08d6f462
Effective 7 November 2026.
This describes what SIGNAL collects, why, who it goes to and what you can do about it. It covers Coaches and Clients. Where the two differ it says so.
Controller: SIGMAS INC., a Delaware corporation, 15370 Fairfield Ranch Road, Chino Hills, CA 91709, United States. Contact: signal@sigmas.com.
On Coaches and Clients. For data a Coach holds about their own Clients, the Coach decides what to collect and why, and we process it on their instructions. In UK and EU terms the Coach is the controller and we are the processor. For our own relationship with you, and for promotional use under the Terms, we are the controller.
| What | Examples | Why |
|---|---|---|
| Identity | Name, email address, phone number, timezone | To run your account and reach you |
| Profile | Photograph, headline, biography, specialties, social handles, address | To build your profile and, for Coaches, your public page |
| Account activity | Sign-ins, pages used, actions taken, a log of record changes | Security, support, and working out what is broken |
| Messages | What you write to your Coach or Client, and when each side read it | To deliver the conversation |
| Technical | IP address, browser and device, timestamps | Security, rate limiting, abuse prevention |
Enrolment details, your programme designs and exercise library, your calendar and availability, your billing details, and the records you keep about your own Clients.
The programmes you subscribe to, your scheduled training days and whether you completed, skipped or missed each one, the calls you book, and anything you or your Coach records about your training.
Health information. Training records, injuries, body measurements and progress photographs can reveal things about your health. Where UK or EU law applies, that is special category data and we rely on your explicit consent for it. You can withdraw that consent, and clause 6 says what happens then.
We do not take payment card numbers. When billing goes live, payment is handled by our payment provider and card details go to them, not to us. We do not buy personal data from data brokers, and we do not run advertising trackers inside the signed-in product.
Mostly from you. Some comes from your Coach, if they entered you as a contact before you had an account. Some is generated by using the product, such as which sessions you completed.
From an advertisement. If you answered one of our or a Coach's advertisements on Facebook or Instagram, you filled in a form inside that app rather than on our site. Meta passes us what you entered - typically your name, email address and phone number, and your answers to any questions the form asked - together with identifiers for the advertisement and form you used. We record which advertisement brought you so the Coach knows where the enquiry came from and so we can tell which advertising is worth running. Meta's own handling of that form is governed by Meta's privacy policy, not this one. What we then do with it is described here, and the enquiry goes to the one Coach whose advertisement you answered.
Your Coach. If you are a Client, your Coach sees your contact details, your subscriptions, your training record and your messages with them. If you work with more than one Coach, each sees only their own relationship with you. They cannot see each other, and a Coach cannot see that you work with anyone else.
Service providers. We use:
| Provider | What for | Where |
|---|---|---|
| Render | Hosting and the database | United States (Oregon) |
| Resend | Sending email | United States |
| Stripe | Card details, billing address, amount and subscription state | United States, with EU and UK entities |
Each is bound to use the data only to provide that service to us.
No one else. We do not sell your personal data and we do not share it with advertisers for their own purposes.
Under the Terms of Use you grant us a licence to use content you upload to promote SIGNAL, SIGMAS and, if you are a Coach, your own business. That includes editing it, as clause 5 of the Terms describes.
In data protection terms we rely on your consent for this, separately from everything else in this policy.
If you are a Client, your Coach needs your permission before they upload a photograph, video or result that identifies you. If they did not ask you, tell us and we will take it down.
Withdrawing consent stops the thing it was given for. It does not undo what was lawfully done beforehand.
On servers in the United States, operated by Render in Oregon.
If you are in the UK, the EU or the EEA, that is a transfer out of your region. We rely on the European Commission's Standard Contractual Clauses (2021 modules) with Render, Resend and Stripe, together with the UK International Data Transfer Addendum for UK data, and we carry out a transfer impact assessment for each. Stripe and Render are additionally certified under the EU-US Data Privacy Framework and its UK extension, which is an independent basis for those transfers.
For Australia, APP 8 applies and the same contractual terms are in place.
You can ask us for a copy of the clauses we rely on.
| What | How long |
|---|---|
| Your account and profile | While your account is open |
| Training records, bookings, messages | While your account is open, then 12 months |
| Financial records | 7 years, or whatever the tax rules require |
| Promotional material already produced | Indefinitely, as clause 7 of the Terms describes |
| Security and access logs | 12 months |
When you close your account we delete or anonymise what we no longer need. Some records survive in a Coach's own files, and that is their responsibility.
Depending on where you live, you can ask us to:
Email signal@sigmas.com. We will reply within 30 days. There is no charge, and we will not treat you differently for asking.
If you are in the UK you can complain to the Information Commissioner's Office. In the EU, to your national supervisory authority. In Australia, to the OAIC.
California residents. We do not sell or share personal information as the CCPA defines those terms, and we do not use it for cross-context behavioural advertising.
SIGNAL is for adults. We do not knowingly collect data about anyone under 18. A Coach who works with under-18s must have written consent from a parent or guardian before entering anything about them, and must not upload a photograph or video of them for promotional use.
If you believe we hold data about a child, email us and we will delete it.
Sessions are signed and time limited, and we send a one-time link rather than asking you to keep a password. Data is encrypted in transit. Access to the production database is limited to the people who need it.
No system is perfectly secure. If a breach affects you we will tell you and the relevant regulator as the law requires.
We set a signed cookie to keep you signed in, and one that remembers the email address you last used so signing in again is one tap. That is all. We do not run advertising or analytics cookies inside the signed-in product.
We may update this policy. If a change materially affects how we use your data, we will email you at least 14 days before it takes effect.
signal@sigmas.com