Privacy Policy

This Privacy Policy explains how Myfour Ltd, trading as Threekey (“we”, “us”, “our”), collects, uses and protects personal data when you use the Signal Layer service available at signal-layer.ai (“Signal Layer”, the “Service”) and the related websites. Myfour Ltd is a company registered in England and Wales with company number 09939423 and registered office at 11 Brantwood Road, London, SE24 0DH.

This Policy forms part of, and should be read alongside, our Terms & Conditions. Capitalised terms not defined here have the meaning given in the Terms.

1. Who is responsible for your data

For the personal data we process to run our business — such as account registration, authentication, billing, communications, security, fraud prevention and improving the Service — we are the data controller.

For personal data that may be contained within the information you submit or authorise us to access (“Input Information”) and the output we generate from it (“Content”), your Organisation is the data controller and we act as a data processor, processing that data only on your documented instructions in order to provide the Service. This split mirrors clause 6 of the Terms.

2. Personal data we collect

• Account and profile data — your name, work email address, password (stored only as a salted hash), the Organisation you belong to, and your role.
• Billing data — your billing contact details and a record of your subscriptions, invoices and payments. Card payments are processed by our payment provider (Stripe); we do not store full card numbers.
• Input Information and Content — websites, documents, files, and data from integrations you provide or authorise us to access. These may contain personal data, which we process as a processor on your Organisation's behalf.
• Integration and connection data — when you connect a Google account, the email address of that account and the access/refresh tokens we need to read the Search Console and Analytics properties you select. OAuth tokens are encrypted at rest.
• Usage and technical data — IP address, device and browser type, pages and features used, actions taken, and timestamps, together with server and security logs.
• Analytics data — information collected through Google Tag Manager (including Google Analytics) and Microsoft Clarity about how the Service is used (see the cookies section below).
• Communications — the content of emails and support messages you send us, and our records of correspondence.

3. How and why we use your data

We use personal data for the following purposes, relying on the legal bases shown under the UK GDPR:

• To provide and operate the Service, including processing Input Information to generate Content — performance of a contract (and, where we act as a processor, on your Organisation's instructions).
• To create and administer your account, authenticate you, and keep the Service secure — performance of a contract and our legitimate interests in keeping the Service safe.
• To take payment and manage billing — performance of a contract and compliance with our legal obligations.
• To understand and improve the Service through analytics — our legitimate interests, and your consent where non-essential cookies or similar technologies are used.
• To communicate with you about the Service, support requests and important notices — performance of a contract and our legitimate interests; any marketing messages are sent only with your consent or where otherwise permitted, and you can opt out at any time.
• To prevent fraud and misuse, and to comply with the law — our legitimate interests and our legal obligations.

Signal Layer uses AI to help generate Content, but this output is decision support: it does not make decisions that produce legal or similarly significant effects about you without human involvement, and you remain responsible for reviewing and validating it before relying on it.

4. Cookies and similar technologies

We use cookies, local storage and similar technologies to run the Service and to understand how it is used. Non-essential analytics technologies are used only with your consent where the law requires it, and you can change your mind at any time through your browser settings or any cookie-preference control we provide.

Category	What it is used for	Consent
Strictly necessary	Sign-in and session management, security (including protection against cross-site request forgery), load balancing and remembering your interface preferences. The Service stores your authentication tokens in your browser's local storage so you stay signed in.	Always active — the Service cannot function without these.
Analytics & performance	Google Tag Manager (which we use to deploy measurement tags, including Google Analytics) and Microsoft Clarity help us understand how the Service is used, which features are valuable, and where users encounter difficulty. Microsoft Clarity also records anonymised session replays and heatmaps, with automatic masking of text you type and other sensitive content.	Set only where you have given consent (or where consent is not required by law). You can withdraw consent at any time — see “Cookies and similar technologies” below.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run Signal Layer (acting as our processors or sub-processors under appropriate contracts), and with professional advisers, regulators or authorities where we are required to do so by law. Our principal providers are:

Provider	Purpose	Location
Stripe	Payment processing and subscription billing.	EU / USA
OpenAI	AI and machine-learning processing of Input Information to generate Content.	USA
Google (Google LLC / Google Ireland)	Sign-in with Google (OAuth), importing Search Console and Analytics data you authorise, and Google Tag Manager / Google Analytics measurement.	EU / USA
Microsoft	Microsoft Clarity product analytics, session replay and heatmaps.	USA
Amazon Web Services	Cloud hosting, databases and file storage that run the Service.	EU (Ireland)
Email delivery provider	Sending transactional and service emails (e.g. sign-in, billing).	EU / USA

6. International transfers

Some of our providers are based outside the UK, including in the United States. Where we transfer personal data outside the UK, we put appropriate safeguards in place — such as the UK International Data Transfer Agreement or Addendum, the European Commission's Standard Contractual Clauses, or reliance on an adequacy decision — so that your data continues to receive an equivalent level of protection.

7. How long we keep your data

We retain Input Information and Content (together, “Customer Data”) for at least 12 months from the later of the date we last generated Content for you or the date your subscription or other time-bound contract ends, after which we may securely delete or irreversibly anonymise it unless the law requires us to keep it longer. This mirrors clause 3 of the Terms.

You can ask us to delete some or all Customer Data at any time by emailing hello@signal-layer.ai (or via any in-product mechanism we provide). We will action verified deletion requests within 30 days, unless we are legally required to retain the data. Account and billing records are kept for as long as needed to administer your account and to meet our legal, tax and accounting obligations. Backups and audit logs are held securely and erased on their normal lifecycle.

8. How we protect your data

We implement appropriate technical and organisational measures to protect personal data, including encryption of data in transit (TLS) and encryption of sensitive credentials such as OAuth tokens at rest, access controls and least-privilege permissions, network protections, and logging and monitoring. No system can be guaranteed to be completely secure, but we work to protect your data and to respond promptly to any incident.

9. Your rights

Subject to the conditions and exemptions in data protection law, you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase your data;
• ask us to restrict, or to object to, certain processing;
• receive certain data in a portable, machine-readable format (data portability);
• withdraw consent at any time where we rely on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

Where we act as a processor on your Organisation's behalf, we will direct any request we receive about Customer Data to your Organisation and assist it in responding. To exercise your rights, email hello@signal-layer.ai. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, although we would welcome the chance to address your concerns first.

10. Children

Signal Layer is a business tool intended for use by staff of organisations and is not directed at children, and we do not knowingly collect personal data from children through the Service.

11. Other websites

The Service and our communications may link to third-party websites. We are not responsible for the content or privacy practices of those sites, and we encourage you to read their privacy notices.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will publish the updated version on our website and, where the changes are material, take reasonable steps to notify you. The “Last updated” date at the top shows when it was last revised.

13. Contact us

If you have any questions about this Policy or how we handle your personal data, please contact us at hello@signal-layer.ai.

Myfour Ltd, 11 Brantwood Road, London, SE24 0DH. Registered in England and Wales, company number 09939423.