Data handling for report buyers

Information we collect

• Contact, business-profile, order, intake, support, and consent information submitted by a customer or requester.
• Documents and financial or operational information intentionally uploaded for a purchased workstream.
• Payment status and provider references from Stripe. ExecSignal does not receive or store full payment-card numbers.
• Access, delivery, security, error, and limited aggregate page-use records needed to operate, protect, and improve the service.
• Public business and market information collected for research and report generation.

How we use it

• Process payment, verify access, and fulfill the requested work.
• Generate, review, correct, store, and deliver reports.
• Respond to support, refund, privacy, and security requests.
• Prevent fraud and abuse, secure the service, keep required records, and comply with legal obligations.
• Measure aggregate product use and improve report quality without building cross-site advertising profiles.

ExecSignal does not sell or rent personal information and does not use customer intake, uploads, or report content for targeted advertising.

What we keep

• Delivered order intake, report versions, QA records, PDF artifacts, and uploaded support documents are retained for up to 24 months.
• Private delivery links expire after delivery and are removed after a 30-day expiration or revocation grace period.
• Operational troubleshooting events are retained for up to 12 months.
• Funnel analytics and resolved non-refund contact records are retained for up to 24 months.
• Industry availability requests retain the submitted contact details, selected industry, consent time, and delivery status for up to 24 months. They authorize one availability email only and do not enroll the requester in a newsletter or marketing sequence.
• MSP Signal Dispatch subscriptions retain the normalized email, selected monthly or quarterly cadence, consent and confirmation times, delivery status, and bounded campaign attribution. Active subscriptions are retained while consent remains active; non-active records are removed after up to 24 months. Every issue includes an unsubscribe link.
• Public commercial-page visits are retained for up to 13 months as daily aggregate counts by page, product, industry, and campaign. These counts do not use visitor IDs, session IDs, referrers, user agents, or raw network addresses.
• Public-form abuse controls retain salted one-way network-address hashes and request counters for up to seven days. Raw network addresses are not stored in the rate-limit table.

What can be removed

On request, ExecSignal can delete customer-order records tied to a specific order ID, including report payloads, uploaded files, generated files, private delivery tokens, manual review records, and linked support or premium-interest records.

Some payment, fraud-prevention, tax, security, or legal records may be retained longer when required. Refund-related support evidence is excluded from routine aging. Aggregate source snapshots and benchmark data are retained because they are not customer-order records, subject to each source provider's rights and caching restrictions.

Independent error monitoring receives scrubbed technical failure data. Customer identities, request bodies, uploaded documents, report content, private-link queries, cookies, and AI inputs or outputs are excluded from that monitoring configuration.

Service providers

ExecSignal may use Vercel for hosting and analytics, Supabase for application storage, Stripe for payment processing, Resend for email, Google Maps Platform for public local-search and route context, SerpApi for configured public search-result observations, Browserless for optional public-website rendering, OpenAI for optional controlled synthesis, public-site analysis, and valuation OCR, and Sentry for optional scrubbed error monitoring. Report synthesis sends only the limited business profile, current section, and source-linked claims needed for that drafting task; provider output is retained with validation and critique metadata. Providers receive only the information needed for the requested function and process it under their own terms and privacy policies.

The current provider-by-provider data path, runtime status, customer-document boundary, official policy links, and internal sensitive-intake review status are published in the Security and Confidentiality disclosure.

SerpApi requests contain a controlled industry phrase and the resolved city/state market. They do not include the customer's business name, street address, uploaded documents, intake notes, financial data, or report content. ExecSignal retains compact public ranking, domain, listing-name, rating, and count fields for up to 30 days rather than raw search-result HTML, snippets, phone numbers, addresses, or images.

Google Maps requests use a selected market and public business coordinates to retrieve competitor-search and traffic-unaware route context. Customer-uploaded financial documents are not sent to Google Maps. Routes content is used at report generation time and is not placed in ExecSignal's persistent source cache. Google's processing is governed by the Google Maps/Google Earth Additional Terms and the Google Privacy Policy.

Privacy requests and mailing address

To request deletion or ask a privacy question, submit a support request, email support@execsignaladvisory.com, or write to ExecSignal Advisory at:

Cookies and access records

The service uses necessary cookies or similar browser storage for order-bound access, security, and basic site operation. Public page measurement is stored as daily aggregate counts without visitor or session identities. ExecSignal does not use third-party behavioral advertising cookies.

Security

ExecSignal uses administrative, technical, and organizational controls designed to protect information, including private storage, signed expiring access, bounded uploads, and restricted administrative access. No internet transmission or storage system can be guaranteed completely secure, and customers should not submit information the intake does not request.

Your requests and choices

Subject to applicable law and necessary exceptions, a person may ask to access, correct, obtain a copy of, or delete personal information tied to them. ExecSignal may request information reasonably necessary to verify identity, authority, and the relevant order before acting. An authorized agent may be required to provide written authorization.

A request may be limited or denied when information cannot reasonably be verified, must be kept for payment, tax, fraud-prevention, security, legal-claim, or compliance purposes, belongs to another person, or is otherwise exempt. ExecSignal will explain a denial and any available appeal path when required by law.

Dispatch subscribers can unsubscribe using the link in every issue. One-time requested notices do not enroll the requester in a recurring marketing program.

Children and geographic scope

The service is intended for business users age 18 or older and is not directed to children. ExecSignal does not knowingly collect personal information from children. If such information was submitted, contact support for review and deletion.

ExecSignal operates from the United States. Providers may process data in the United States or other locations described in their policies. Customers are responsible for confirming that submission and processing are permitted where they operate.

Changes to this notice

This notice may be updated as the service, providers, or legal requirements change. The effective date and version used at checkout identify the applicable notice. Material changes will be presented through an appropriate service or contact channel when required by law.

Nothing in this notice limits rights or obligations that cannot be limited under applicable law.