Privacy notice

What SIGNAL does

SIGNAL is an intelligence briefing platform that monitors publicly available expert commentary from think tanks, defense analysts, OSINT researchers, and government publications. We use AI to summarize articles and synthesize daily briefings.

Information we collect

From subscribers: Email address (for account creation and briefing delivery). We collect the minimum information necessary to provide the service.

From monitored sources: Publicly available articles, names, and professional affiliations of public figures who publish expert commentary through public channels (RSS feeds, government APIs, open protocols).

Lawful basis for processing

We process subscriber data based on consent (you sign up and can unsubscribe anytime). We process public expert commentary based on legitimate interests under GDPR Article 6(1)(f) — providing aggregated analysis of publicly available professional commentary on matters of public concern. A full Legitimate Interest Assessment is available on request.

Data retention

Raw article text is automatically deleted after 7 days. AI-generated summaries and vector embeddings are retained indefinitely as our original analytical work. Source metadata (URLs, timestamps, provenance) is retained for compliance audit trails. Subscriber data is retained while your account is active and deleted within 30 days of a deletion request.

AI-generated content

SIGNAL uses AI (Claude by Anthropic) to summarize articles and generate briefings. All AI-generated content is reviewed by a human editor before publication and is labeled as “AI-assisted analysis.” Machine-readable metadata is included per EU AI Act Article 50 requirements.

What we do NOT do

• •We do not publish trust scores or leaderboards for named individuals
• •We do not profile individuals or make automated decisions about people
• •We do not monitor X/Twitter, Reddit, or YouTube (excluded for legal reasons)
• •We do not sell, rent, or share personal data with third parties
• •We do not reproduce verbatim article text — all summaries are abstractive

Your rights

Under GDPR, CCPA, and applicable privacy laws, you have the right to:

• •Access your personal data
• •Request correction of inaccurate data
• •Request deletion of your data (honored within 30 days)
• •Object to processing of your data
• •Data portability

To exercise any of these rights, contact us at the email address below.

Data processors

• •Supabase — Database hosting (US)
• •Cloudflare — Frontend hosting and CDN (global)
• •Hetzner — Backend server (Germany)
• •Anthropic — AI processing (US)
• •OpenAI — Embedding generation (US)
• •Resend — Email delivery (US)

Contact

For privacy inquiries, data subject requests, or to exercise your rights, contact: [email protected]