Privacy Notice
Last updated: 29 September 2026
1. Who we are
Mackie AI Enterprises Limited, trading as ServiceSignal, is the controller of the personal data described in this notice. We are registered in England and Wales under company number 17107639. Our registered office is 62 Ringley Road, Horsham, England, RH12 4AT. Our ICO registration number is ZC110311.
Privacy questions and rights requests can be sent to [email protected].
2. Data we collect
- Assessments and reports: work email, organisation profile, supplier or service-provider details, answers, optional notes, scores, recommendations, and submission timestamps.
- Framework requests: email address, request time, and whether you separately opted in to product and research updates, including the consent version and time.
- Enquiries: name, email, optional company name, message, and our correspondence with you.
- Rights requests and data protection complaints: contact details, the request or concern, relevant supporting information, our correspondence, and the outcome.
- Optional public-site analytics: sanitised page path, referrer, approximate location, device and browser information, and interaction data. Query strings, URL fragments, private reports, authentication pages, and administrator pages are excluded.
- Security and administration: administrator identity, access and moderation audit events, request metadata, and limited technical logs used to secure and operate the service.
ServiceSignal does not currently take payments or create customer accounts. Please do not enter passwords, access tokens, special-category personal data, or personal data that is not needed for the assessment or enquiry.
3. Why we use data and our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Create and protect a requested assessment report | Assessment and report data | Performance of our service agreement |
| Send a requested framework | Email and delivery record | Performance of our service agreement |
| Respond to an enquiry | Contact details and message | Legitimate interests or steps requested before a contract |
| Handle rights requests and data protection complaints | Request, complaint, correspondence, and outcome | Legal obligation and, where needed, legitimate interests in legal claims |
| Send optional product and research updates | Email and consent record | Consent |
| Measure use of public pages | Optional analytics data | Consent |
| Secure, troubleshoot, and administer the service | Technical, access, and audit data | Legitimate interests and legal obligations |
Our legitimate interests are answering business enquiries, maintaining a reliable service, preventing abuse, investigating incidents, and keeping an attributable administrator record. We limit the data and access used for those purposes and take account of the rights and expectations of affected people.
4. What is required
Fields marked as required are needed to provide the requested report, framework, or response. If they are not provided, we cannot complete that request. Assessment notes, company name on the contact form, and marketing consent are optional. Refusing analytics does not restrict the public site or assessment tools.
5. Who receives data
Access is limited to authorised ServiceSignal administrators and providers needed to operate the service. Current providers are:
- Cloudflare: network protection, administrator access, Worker API, D1 database, and private R2 file storage.
- Vercel: website hosting and, only after consent, cookieless Web Analytics.
- Resend: delivery of framework and contact-form email.
- Microsoft: hosting for the mailbox receiving enquiries and operational notifications.
- Google Analytics: public-site analytics, only after consent.
A restricted legacy migration backup may remain temporarily with Supabase until its deletion and provider backup cycle are complete. It is not used to run the live service. We may also disclose information where law requires it, to establish or defend legal claims, or to professional advisers under confidentiality. We do not sell personal data.
6. International transfers
Some providers operate internationally, so limited data may be processed outside the UK. Where UK data protection law requires a transfer safeguard, we rely on an applicable adequacy regulation or contractual safeguards such as the UK International Data Transfer Addendum, together with provider security and data-protection terms. Contact us if you would like more information about the safeguard relevant to your data.
7. How long we keep data
| Data class | Normal retention |
|---|---|
| Assessment and report data | 12 months from completion; the signed private report link normally expires after 30 days |
| Contact enquiries | 12 months after the last substantive contact, unless needed for a contract or legal claim |
| Rights requests and data protection complaints | 24 months after closure, unless a legal claim requires a longer record |
| Framework delivery without marketing consent | 30 days from the latest request |
| Framework product-update consent | Until withdrawal or 24 months after the latest framework request, whichever is earlier |
| Cookie preference | 183 days, then we ask again |
| Google Analytics | Analytics cookies up to 183 days; GA4 event data 2 months and user data 14 months |
| Vercel Web Analytics | A session hash is discarded within 24 hours; ServiceSignal receives aggregate analytics |
| Administrator audit events | 24 months |
| Routine operational logs | Normally up to 30 days; a necessary incident or legal record may be kept longer |
We delete or anonymise records when their period ends. Deleted database records may remain in restricted provider backup or recovery copies for up to 30 further days before rotation. We may pause deletion where a record is needed for a legal claim, security investigation, or statutory duty, and will keep only what is necessary.
8. Security
Measures include encrypted transport, signed application-to-database requests, private report links with expiry, restricted administrator access, hardware-key MFA, a separate administrator allow-list, and attributable audit logging. No internet service can guarantee absolute security. Please contact us promptly if you believe a report link or other ServiceSignal data has been exposed.
9. Your rights
Depending on the circumstances, UK data protection law gives you rights to access, correct, erase, restrict, or receive your personal data, and to object to processing. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. You also have an absolute right to object to direct marketing.
Email [email protected] to make a request. We may need enough information to verify your identity and locate the relevant record. We normally respond within one month.
10. Assessment scoring
ServiceSignal applies deterministic scoring rules to the answers you submit and generates an indicative band, findings, and recommendations. This does not make a legal or similarly significant decision about you, and it is not a certification or substitute for professional judgement. See the Terms of Use for the service limitations.
11. Children
ServiceSignal is a business service and is not directed to children. You must be at least 18 years old to submit personal data through the service.
12. Complaints
To make a data protection complaint, email [email protected] with the subject "ServiceSignal data protection complaint", or write to our registered office. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and explain the outcome without undue delay.
You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
13. Changes to this notice
We review this notice when our service or providers change. Material changes will be identified on this page, and we will seek fresh consent where the law requires it.