# Privacy notice

> What signalnine.io collects, why, who handles it, how long I keep it, and how to see, fix or delete what I hold about you.

I collect what you send, booking and email link clicks, and Google Analytics counts. Google sets cookies only once you allow them. I use it to reply and learn which pages work. I delete form text from my site records after 30 days, but inquiry desk copies have no end date yet. Email inquiry@signalnine.io to see, fix or delete anything.

## What I collect

It depends on what you do on the site.

- Reading pages. Google Analytics counts page views and clicks whatever you choose, and Google gets each count with your IP address. Until you choose Allow analytics, it sets no cookies. Allowing it lets Google set a cookie that recognizes your browser when you come back. Cloudflare, which hosts the site, also counts visits without cookies.
- Clicking a booking or email link. Whatever you chose about analytics, the site sends me a count of the click. The count holds which link, the page, how you arrived and your country, plus a random id for this browser tab. It holds no name or email.
- Using a tool. A tool sends me your answers as categories, such as a team size range. Apart from an optional "How did you hear about this?" answer, tools send no free text.
- Sending a message through a form. I store what you type, with your name and email.
- Ticking a box to get email from me. I store your email, the words you agreed to and when you ticked the box.
- Booking a call. Cal.com runs my booking page. It collects your name, email and any answers on the booking form, then sends me a copy.
- Emailing me. What you email me goes to my inquiry desk, described below.

Anything you send through the site also carries the page you were on, how you arrived, your country and the tab id. My site works out your country from your IP address and keeps only the country.

## What I never do

- I never sell your data.
- I never use what this site collects for cold email.
- I never add you to a mailing list unless you tick the box yourself. The box always starts unticked.

## Why I use it

In plain words, these are my legal reasons.

- To answer you. When you write to me or book a call, I use what you sent to reply. I also use it for the steps you ask for before we agree on any work.
- To learn which pages lead to a conversation. Click counts and categories serve my legitimate interest in knowing which pages work. They hold no name or email.
- With your consent. Google Analytics cookies and email from me beyond a reply need your yes. You can take it back any time.

## How my inquiry desk handles an email

When you email inquiry@signalnine.io, my automation server picks it up from Gmail. OpenAI reads it to sort it, then drafts a reply when one is needed. Telegram shows me the draft with your message quoted. I approve every reply before Gmail sends it.

Langfuse keeps a trace of each AI step, and my database keeps a record of each email the desk handled. A message you send through a form on this site can take the same path.

## Who handles it for me

*Who handles your data for me*

| Who | What it does for me | What it sees |
| --- | --- | --- |
| Cloudflare | Hosts this site, checks forms for bots and counts visits without cookies. | Every visit, including your IP address. |
| Google | Google Analytics, with cookies only after you choose Allow analytics. Gmail, where I read and send email. | Page views and clicks with your IP address, whatever you choose about analytics, plus the emails we exchange. |
| My automation server | Runs on a server I rent from Contabo, in the United States. It takes in what the site sends me and runs my inquiry desk. | Everything you send through the site or by email. |
| Neon | Hosts my database in the US East region. | Form text for 30 days, categories, contact details, consent records, bookings and my inquiry desk's records. |
| Langfuse, run on my automation server | Keeps a trace of each AI step in my inquiry desk. | Your email address, subject and message, plus my draft reply. |
| OpenAI | Reads each email to my inquiry desk, sorts it and drafts my reply. | Your name, email address, subject and message, plus earlier emails in the same conversation. |
| Telegram | Delivers my approval message for each draft reply. | Your name, email address, subject and the first 1,200 characters of your message. |
| Cal.com | Runs my booking page. | Your name, email and booking answers. |

Some of these companies store data outside Canada, including in the United States, where local law can give authorities access to it.

## How long I keep it

- Form text. Deleted from my site records 30 days after you send it. I keep the categories, such as which tool you used and the ranges you picked.
- Your "How did you hear about this?" answer. Kept with the categories. When you sent it with your email, erasure deletes it too.
- Click counts and categories. No fixed end date. They hold no name or email.
- Your name and email. Kept with your records until you ask me to erase them.
- Consent records. Kept while your consent stands. Once you withdraw, I keep the record of what you agreed to and when. It is my proof that I had your permission. I delete it when you ask me to erase your data.
- Bookings. Kept until you ask me to erase them. Cal.com also keeps its own copy.
- Copies outside my site records. Emails stay in Gmail. My inquiry desk's records, traces and Telegram messages have no fixed end date yet. My automation server's logs can also hold a copy until I clear them.

When you ask me to erase your data, I delete your name, email, messages and "How did you hear about this?" answers from my site records. I also delete the copies above by hand. The categories stay, with no name or email left on them.

## Cookies and browser storage

The site keeps these in your browser.

- s9_consent (local storage): your analytics choice, so the site doesn't ask again. It stays until you clear this site's data in your browser.
- s9_ft (session storage): how you first arrived in this tab, meaning the campaign tag, the referring site and the landing page. It is gone when you close the tab.
- s9_sid (session storage): a random id for this tab, sent with click counts and anything you send. It is gone when you close the tab.
- s9_test (cookie): marks my own devices, so my visits stay out of the counts. A normal visit never sets it. It lasts a year.
- Google Analytics cookies (_ga, plus names that start with _ga_): set only after you choose Allow analytics.
- Turnstile: Cloudflare's check that a person sent the form. It loads only when you send a form or a tool's answers.

The first four hold no name or email. They work whatever you choose about analytics.

## Your choices

- Analytics. Use the Analytics choice link in the footer to change your answer any time. Choosing No thanks also deletes the Google Analytics cookies already set.
- Email from me. Use the way out in any email I send, or write to inquiry@signalnine.io. I record the date you withdrew.
- See, correct or erase what I hold. Email inquiry@signalnine.io. I answer every request myself, within a month.
- Complain. Tell me first, so I can fix it. You can also complain to the Office of the Privacy Commissioner of Canada or to Alberta's Information and Privacy Commissioner. In the EU, contact your national data protection authority.

## Email consent under CASL

Canada's anti-spam law, CASL, covers the email I send. Beyond replies, I email you only after you tick a box that starts unticked. The box says what I'll send, that it comes from me, Mashrur Rahman at SignalNine, and how to reach me. Every such email has a way out, and I honour it.

## Canadian and EU privacy law

I follow Canada's federal privacy law, PIPEDA, and Alberta's Personal Information Protection Act. Where a company above handles your data outside Canada, you can ask me for a written account of how I handle that. I answer those questions myself.

If you are in the EU, the GDPR gives you the rights above. You can also object to my use of your data, or ask for a copy to take elsewhere. My legal reasons are listed under "Why I use it".

Analytics cookies stay off for everyone, including visitors in Quebec, until you choose Allow analytics.

## Changes to this notice

When what the site collects changes, I update this notice and its date. Last updated 2026-10-05.

## Questions

**Do you sell or share my data?**

I never sell it. I share it only with the companies in the table above, each for the job listed there.

**Does AI read my email?**

Yes. OpenAI reads each email to my inquiry desk to sort it and draft a reply. I read and approve every reply before it goes out.

**If I book a call, do I end up on a mailing list?**

No. Booking gives me what I need to hold the call. I add you to a list only when you tick the box that offers it.

**Can I use the site without being tracked?**

Mostly. Choose No thanks and Google Analytics sets no cookies, though Google still gets a cookieless count of each page and click. The site also counts clicks on booking or email links, tied to a random id that ends when you close the tab.

**How do I get my data deleted?**

Email inquiry@signalnine.io and say what to remove. I delete it from my site records, then the copies in Gmail, my inquiry desk, traces and Telegram. I confirm by email when it's done.

**Where is my data stored?**

My database runs on Neon in the US East region. My automation server is one I rent. The rest sits with the companies in the table above, most of them United States companies.

[BOOK A FREE CONSULTATION](https://cal.com/mashrur-signalnine/30min)

## Related

- [About Mashrur Rahman, founder of SignalNine](https://signalnine.io/md/about): I'm Mashrur Rahman. I map and build business systems for service businesses that want to grow without adding proportional headcount.
- [Contact SignalNine](https://signalnine.io/md/contact): Book a free thirty-minute consultation or email inquiry@signalnine.io. What happens on the call, when calls run, and what to bring.

---
Mashrur Rahman, Founder, SignalNine. Published 2026-10-04, updated 2026-10-05.
Id: F-privacy
Canonical: https://signalnine.io/privacy