Privacy Policy
Last updated: September 30, 2026
1. Information We Collect
We process account and support information, research requests and results, public social-media profiles, content, interactions, and contact data, service usage and technical records, and purchase and subscription records. This information comes from you, your connected agents, authentication and other service providers, and public sources; it can concern people who do not have a Public Signal account.
2. How We Use Your Information
We use this information to provide and secure the service, run research and AI-assisted analysis, save and deliver results, manage usage and purchases, respond to requests, prevent abuse, and meet legal obligations. Where EEA or UK law applies, we rely on a contract to provide an individual's requested service; legitimate interests to provide public-information research, serve business customers, protect the service, and handle legal claims; legal obligations where required; and consent for optional uses where required. We balance our legitimate interests against the rights of affected people; publicly available information remains personal data.
3. Authentication, Storage, and Security
We use authentication and hosting providers to manage accounts and store service records. We take measures to protect information, but no online service is completely secure. Providers may process data outside your country. Where required, transfers are subject to applicable legal safeguards, such as adequacy decisions or approved contractual measures; contact us for information on the destinations and safeguards applicable to your data, including how to obtain a copy.
4. Public Instagram Data and Research Results
We obtain publicly available account, profile, contact, post, Reel, comment, liker, follower, and following information from Instagram and public-data suppliers, keep underlying source records, and generate research results and assessments. These results can include personal information and may be incomplete or inaccurate. We do not use our assessments to make decisions about people that have legal or similarly significant effects. Customers must check results and have a lawful basis for their own use, sharing, or outreach.
5. Exports and Integrations
You can export saved research or connect an agent to request and receive results. We use public-data, AI-processing, hosting, authentication, and diagnostic providers to operate these features. Relevant prompts, conversation content, and research records are sent to providers that perform research and AI processing; diagnostic records can also contain prompts and results. Customers and their connected services can retain exported results under their own policies. We may disclose information to advisers, authorities where required, or parties to a business transfer, subject to applicable law.
6. Payments
When you buy a paid plan, Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) processes your payment. We receive and store your name, email, billing address, country, VAT ID if provided, the payment method type with its last four digits and expiry, and records of subscriptions, invoices, refunds, and disputes; we do not receive your full card number. We process this to perform the contract (Art. 6(1)(b) GDPR), to meet tax and accounting obligations (Art. 6(1)(c) GDPR), and to prevent fraud (Art. 6(1)(f) GDPR). Stripe also processes payment data as an independent controller for its own legal obligations and fraud prevention, and may transfer data to the United States under the EU-U.S. Data Privacy Framework or standard contractual clauses; see Stripe's Privacy Policy. If you choose to save your details with Link, Link's own privacy policy applies. Stripe sends receipts and invoices by email on our behalf. Do not send card details to our support address.
7. Analytics and Service Monitoring
We use necessary cookies and browser storage for sign-in, session security, and functional state, and keep usage and diagnostic records to operate and protect the service. Blocking necessary storage may prevent some features from working. Product analytics is separate from necessary service monitoring.
Where analytics is enabled, PostHog automatically processes page visits, acquisition sources, interaction and performance signals, research and upgrade activity, and browser session recordings. Signed-in analytics links this activity to your account identifier, email, name, current plan and credit balance. Product events describe accepted research, results used, and verified subscription/payment changes; analytics is not the financial ledger and does not prove a payment by a browser redirect.
Browser analytics uses our same-origin relay to PostHog's EU ingestion service. We configure recordings for all eligible sessions, including short visits, with an initial 30-day recording retention. Recordings include visible page text, draft and submitted research instructions, agent replies, result-grid contents, and ordinary non-secret input values. Passwords, one-time codes, API keys, access tokens, and payment credentials are protected; credential-management and sign-in interfaces are blocked; authentication query parameters and bearer links are scrubbed. We do not enable PostHog console, exception, or network body/header recording. Cross-origin authentication, checkout, and external agents' screens are not recorded. These controls reduce exposure but are not a guarantee or legal certification.
The MVP does not provide an in-product analytics switch. Collection is controlled by the service's deployment configuration. Disabling a collector does not automatically erase previously collected data or necessary security, research, usage, and accounting records. Contact us about privacy questions or deletion requests.
8. Data Retention
We retain information as needed for active accounts and saved research, source and usage auditing, support, disputes, abuse prevention, and legal obligations. The period depends on the record and the applicable purpose and legal requirements; stopping use or disconnecting an agent does not automatically delete records. Deletion requests require a reviewed administrative process, and lawful exceptions, source evidence, and backup or diagnostic copies may affect what can be removed and when. Invoices and other accounting records are retained for the periods required by German commercial and tax law (currently up to 10 years; 8 years for accounting vouchers such as invoices). Contact us for details about a particular record.
9. Your Choices
Depending on applicable law, you may request access, correction, deletion, restriction, or a portable copy of your information; withdraw consent for future processing; or opt out of qualifying sale or sharing of personal information. These rights also apply, where provided by law, to people appearing in research results who are not account holders.
Right to object: where we rely on legitimate interests, you may object on grounds relating to your situation. We must stop that processing unless overriding grounds or legal claims justify it. You may object to direct marketing at any time.
Email us to make a request, with a relevant profile link if your information appears in research. We may verify your identity and will respond as required by law. You may complain to your data-protection authority or exercise any applicable appeal right. Requests to us cannot automatically remove copies held by independent customers or the original platform. The service is intended for adults; contact us if a result raises a concern about a child.
10. Contact
The operator of publicsignallabs.com (Public Signal) is responsible as controller for the processing described here. For privacy questions or requests, email support@publicsignallabs.com. We may update this policy as our practices or legal requirements change; the date above shows the latest version, and we will give any further notice required by law.