Privacy Policy

Effective date: August 11, 2026 · Version 2026-08-11

SIGNAL is operated by Blue Crane Works of Hamilton, Ontario, Canada. This policy explains what we collect, why, and what control you have. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

Account: your email address and a salted hash of your password. We never store the password itself.
Business profile: business name, trades, home city and service radius, typical contract size, certifications, and any keywords you add. This is what matching runs on.
Activity: bids you watch (star) or dismiss, and a record of which digests we sent you.
Technical: a single session cookie (essential, used only to keep you signed in) and standard server logs, which may include IP addresses, kept for operations and security.

Payments are processed by Stripe, Inc. Your card details go to Stripe directly and never touch our servers; what we store is your Stripe customer and subscription identifiers and your subscription status. Stripe handles payment data under its own privacy policy. If another member referred you, we also record which member that was, because referrals reduce their bill. Beyond this we deliberately collect nothing the service does not need.

2. What we use it for

Matching public tender notices to your profile and ranking them.
Learning your preferences. See the next section.
Sending your digest and transactional email (verification, password reset).
Securing accounts and operating the service.

2A. How SIGNAL learns from what you star and dismiss

Every SIGNAL account improves its own ranking over time. When you star a bid, we treat that as a sign the work suits you; when you dismiss one, we treat it as a sign it does not. From that history we work out which kinds of work you tend to pursue, and nudge similar bids up (and dismissed kinds down) in your future rankings and digests.

Plainly, so there are no surprises:

It is per account. Your stars affect only your own ranking. We never pool your behaviour with another business’s, and we never share or sell it.
It needs a few decisions before it does anything at all, so one accidental click cannot reshape your digest.
Its influence is deliberately small and bounded. It re-orders bids you would already have been shown. It cannot widen your service area, override a keyword you excluded, or surface work outside the trades you selected.
You stay in control: your Profile settings and keywords always outrank anything we infer, and you can undo a star at any time.
Deleting your account deletes this history with it.

Profile attributes such as your trades and keywords may be processed by our AI provider (Microsoft Azure OpenAI) as part of ranking tenders for you. Your email address and password are never part of that processing, and your data is never used to train AI models.

3. What we share — and what we never do

We do not sell, rent or trade your personal information, ever. We share data only with the service providers that run the service:

Cloudflare — hosting and database infrastructure.
Microsoft Azure — email delivery (Azure Communication Services) and AI ranking (Azure OpenAI).
Stripe — payment processing. Card details go to Stripe directly; we hold only customer and subscription identifiers.

These providers may process data outside Canada (including in the United States), where it is subject to the laws of those jurisdictions. We may also disclose information where the law requires it.

4. Cookies

One cookie: signal_session, which keeps you signed in. It is HttpOnly and essential. There are no advertising, analytics or tracking cookies.

5. Email

Digest emails carry an unsubscribe link that works without signing in, and every commercial email identifies us and our mailing address, as Canada’s Anti-Spam Legislation (CASL) requires. You can also pause digest emails from the Account page. Transactional email (verification, password reset) is sent only when you request it.

6. Retention and deletion

We keep your information while your account exists. Deleting your account from the Account page removes your account, business profile, matches and watchlist from our live systems. Operational logs and backups age out on a short cycle afterwards. If you ask us to stop emailing you, we keep the minimal record needed to honour that request.

7. Your rights

You may access and correct your information in the app (Profile and Account pages), delete your account yourself, or write to us to ask what we hold about you, have it corrected or deleted, or withdraw consent. We answer within 30 days. If you are unsatisfied you may complain to the Office of the Privacy Commissioner of Canada.

8. Security

Passwords are stored only as salted scrypt hashes; all traffic is HTTPS; sessions are HttpOnly cookies with fixed expiry; access to production systems is limited to the operator. No system is perfectly secure, but we collect little and guard what we hold.

9. Children

SIGNAL is a business tool and is not directed at anyone under the age of majority. We do not knowingly collect information from minors.

10. Changes

If this policy changes materially we will notify you by email or in the app before the change takes effect.

11. Contact

Blue Crane Works
10 Trudy Court, Hamilton, Ontario L9H 5P7
trevor@bluecraneworks.ca