Privacy & Cookie Policy

Last updated: 5 July 2026

1. Who we are

Signum ("we", "us") provides an AI-assisted buyer-research tool for sell-side M&A advisors. This policy explains what data we collect through signum-buyers.up.railway.app, why, and what choices you have.

[PLACEHOLDER: legal entity name and registered address]

2. What data we collect

• Account data — your email address and password. Authentication is handled entirely by our provider, Supabase; we never see or store your raw password ourselves.
• Content you provide — target company details, buyer lists, notes, and feedback you enter to run an analysis or manage a project.
• Anonymous trial usage — if you try Signum before creating an account, we set one strictly-necessary cookie so we can recognize that your browser has already used its free trial.

We do not collect payment information — Signum does not currently process payments.

3. Cookies we use

• signum_anon_id — strictly necessary. Lets us enforce a one-time free trial per browser before requiring an account. Expires after roughly 400 days, or sooner if you create an account. Not used for advertising, analytics, or tracking you across other sites.
• Once you log in, our authentication library stores your session in your browser's local storage (not a cookie) so you stay signed in between visits.

We do not use analytics, advertising, or cross-site tracking cookies. Because the only cookie we set is strictly necessary for a feature you explicitly used (the free trial), we don't show a cookie-consent banner — there is nothing non-essential to opt into.

4. Third parties we share data with

Running an analysis means the company and buyer details you submit are sent to the following providers, solely to generate and score your results:

• Supabase — authentication and database hosting
• Railway — application hosting
• Cerebras — AI model inference
• Tavily — web search grounding
• Apollo.io — optional, only used if you look up a contact via Reach Out
• European Patent Office (Open Patent Services) — optional, only used for the patent-filing signal, if enabled
• Google — we load fonts and small company icons from Google's servers, which means your browser's IP address is visible to Google when fetching them

Each provider processes data only as needed to provide their part of the service, under their own privacy terms.

5. Legal basis for processing

Where the GDPR or a similar framework applies, we process your data on the basis of performing our contract with you (running the analyses you request), our legitimate interest in preventing free-trial abuse, and — for any future non-essential cookie or feature — your consent.

6. Data retention

We keep account and analysis data for as long as your account is active, plus a reasonable period afterward for backups, unless you ask us to delete it sooner.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at [PLACEHOLDER: contact email].

8. International transfers

Some providers listed above may process data outside your country. Where required, we rely on their standard contractual clauses or equivalent safeguards.

9. Changes to this policy

We may update this page from time to time. Material changes will be reflected by an updated "last updated" date above.

10. Contact

Questions about this policy: [PLACEHOLDER: contact email]