sincerely

Privacy Policy

Last updated: 22 August 2026

Who we are

Sincerely (“we”) provides email signature management for Google Workspace. We are the data controller for account data and a processor for the employee data our customers manage through the product. Contact: [email protected].

What we collect

  • Account data: your name, email address and Google profile photo when you sign in.
  • Workspace data: your organisation's verified Google Workspace domain; where an administrator connects the Google Directory, the fields needed to build signatures, names, job titles, phone numbers, departments, organisational units, group membership and profile photos. Nothing else from the directory is stored.
  • Signature content: the signatures, templates, images and campaigns you create.
  • Click data: when a recipient clicks a tracked link we record the time, a one-way daily-salted hash of the IP address (raw IPs are never stored), a coarse browser family, and country. See link tracking explained.
  • Product analytics: usage events via PostHog, gated behind the cookie banner.

What we never do

  • We never read your email. Sincerely does not touch mail flow and holds no Gmail message scopes.
  • We never use open-tracking pixels.
  • We never sell personal data, and never use it for advertising.

Google user data, Limited Use disclosure

Sincerely's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Directory data is used only to provide the signature features the user has requested. It is not used for advertising, is never sold, and is not read by humans except with your explicit consent, for security purposes, or to comply with law.

Where data lives

Primary data is stored with Supabase in London (UK). Our subprocessors are Supabase, Vercel, Stripe, Resend, Upstash, PostHog and Sentry; the current list with roles and regions is on the DPA page.

Retention

  • Click records: 13 months, then deleted.
  • Audit logs: 24 months.
  • Anonymous generator drafts: 30 days.
  • Directory-sourced fields: purged when your admin disconnects Google.
  • Account deletion (available in settings) removes your data within 30 days.

Your rights

Under UK and EU data protection law you can access, correct, export or delete your personal data, and complain to the ICO or your local authority. Email [email protected] and we will respond within 30 days.