Privacy Policy

Last updated: August 2026

Who we are

The controller of the personal data described in this policy is Deal Baker Ltd, a private limited company registered in England and Wales under company number 14906367, whose registered office is at International House, 64 Nile Street, London, United Kingdom, N1 7SR. Deal Baker Ltd trades as SignalsAPI; full company details are on our imprint.

SignalsAPI ("we", "us", "our") provides real-time hiring intelligence for recruitment agencies. This policy explains how we collect, use, and protect information when you use our website at signalsapi.com and our services.

Information we collect

Account information. When you sign up or book a call, we collect your name, email address, company name, and phone number.

Usage data. We collect anonymized analytics about how you interact with our website and dashboard, including pages visited, features used, and session duration.

Signal configuration. We store your ICP filters, integration settings, and delivery preferences to operate the service.

Cookies. We use essential cookies for authentication and session management. We do not use third-party advertising cookies.

How we use your information

Data we deliver to you

We sell more than one service, and they do not deliver the same kind of data. Each paragraph below is about its own service.

Agency Delivery Service. Hiring signals contain publicly available business information: company names, job postings, and professional contact details of decision-makers sourced from public directories, company websites, and professional networks. This data is collected and processed in compliance with applicable data protection laws.

Hiring-Motion Data Plane. Our data plane API serves information sourced from applicant tracking systems and public job-board postings only. It returns no personal data about individuals and no LinkedIn-derived field. That scope is a warranted term of our Terms of Service, under the Data provenance warranty, and the guarantee is published in machine-readable form at GET /v1/compliance.

UPdata person search. Our person-record search API is contracted separately and does return personal data about individuals — including names, job titles, work email addresses, and LinkedIn profile details. Where you use it, that processing is governed by your separate agreement for that product.

Data sharing

We do not sell your personal information. We share data only with:

Hiring briefs. When you submit the brief form on this site, what you enter — the roles you recruit for, your ideal client, titles, channels and your email address — is sent to a service we run ourselves, at ss.signalsapi.com, and to nobody else. We receive the brief directly and we store it in our own database, on the same infrastructure that runs the rest of SignalsAPI: there is no form service, no mailing tool and no other third party in that route, and no copy of it is sent outside Deal Baker Ltd. Stored alongside your answers are two things the form does not ask you for: a one-way hash of the IP address the brief was sent from, which is how the endpoint is rate-limited against abuse, and the browser user-agent string. We keep a brief until it is deleted — nothing deletes it on a schedule — and we delete one on request. Briefs are read at [email protected], which is the address to use for anything about a brief, even though our general contact address elsewhere on this site is [email protected]. Ask at [email protected] and we will delete your brief. If you would rather not use the form at all, email the same details straight to [email protected] instead.

Briefs submitted before 11 August 2026. Until that date this form sent briefs to Formcarry (Teijal, Inc., trading as Formcarry), a form service that stored the submission on servers in Frankfurt, Germany and emailed it to us. Two of the sub-processors Formcarry lists as always active sat in the United States and handled every brief: Amazon Web Services, which sent that notification email, and Automattic (Akismet), which screened the submission for spam — so a brief sent through that route was transferred outside the UK even though the stored copy stayed in the EU. Formcarry's terms of service incorporate a data processing agreement which applied the EU Standard Contractual Clauses to those transfers and named no UK Addendum and no International Data Transfer Agreement; that gap was accepted at the time rather than closed, by Deal Baker Ltd as the controller named at the top of this policy. Briefs already sent that way are still on Formcarry's servers: the submission archive there is set to keep them rather than delete them on a schedule. The deletion route is the same one — ask at [email protected] and we will delete a brief from our inbox and from Formcarry.

Data retention

We retain your account data for as long as your account is active. Signal data is retained for 12 months for dashboard access and analytics. You can request deletion of your data at any time by contacting us.

Security

We use industry-standard encryption (TLS) for data in transit and at rest. Access to customer data is restricted to authorized personnel only. We conduct regular security reviews of our infrastructure.

Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact us at [email protected].

Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email or through our dashboard.

Contact

Questions about this policy, or a request about your data? Email us at [email protected], or write to Deal Baker Ltd, International House, 64 Nile Street, London, United Kingdom, N1 7SR.