Privacy Policy

Who we are

Sigil is provided by Tophhie Cloud Ltd (“we”, “us”), a company registered in England and Wales under number 17393069. When you use Sigil, your organisation is the data controller for its directory data and we act as a data processor on your behalf. For our own account and billing records we act as a controller. You can reach us at privacy@usesigil.app.

What Sigil processes

Directory attributes (to build signatures)

To render a personalised signature, Sigil reads user attributes from your Microsoft 365 directory through the Microsoft Graph API, using permissions your administrator grants at onboarding. These include name, job title, department, company, email address, phone numbers, office and address, manager details, and any on-premises extension attributes your organisation uses. Sigil only ever reads the directory. It never writes to it. These attributes are already visible to colleagues in the address book.

Templates and images you create

Signature templates, compliance footers, campaign banners and the images you upload are stored so the service can render and manage them.

Usage telemetry (to show the service is working)

Sigil records metadata about signature activity so administrators can see whether signatures are reaching users: which mailbox requested a signature, which template version was served, the compose type, and whether the add-in applied it. It also counts clicks on tracked links in signatures and banners. This telemetry contains no IP addresses, no recipient identities, and no message content or rendered signature HTML: counts and metadata only.

Account and billing data

We store your organisation's tenant record and subscription details. Payment card handling is performed by our payment processor; we do not store card numbers.

Campaign tags (to know which advert an organisation arrived by)

When an administrator reaches Sigil from a paid advert, the link they follow carries campaign tags: the advertising source, medium, campaign, ad group and search term (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and, for Microsoft Advertising, a click identifier (msclkid). This website keeps those tags in the browser's session storage for that tab only, so they survive a look at the pricing page, and adds them to its links to the Sigil portal. It sends nothing to us or to any advertising network on the way, and it sets no cookie and loads no tracking pixel for this purpose.

If that administrator then starts admin consent, the portal records the tags on that onboarding attempt, so we know which campaign brought the organisation to Sigil. The record describes the link the administrator arrived by, not the administrator: it holds no IP address or advertising profile, is kept with the onboarding record for the organisation, and is not shared with the advertising network. We rely on our legitimate interest in measuring our own advertising.

Cookies and analytics on this website

This website (usesigil.app, blog included) uses two optional Google services. Neither runs until you agree to it in the cookie banner, and you can change your answer at any time from the Cookie settings link at the foot of every page, or here. A refused service is not loaded at all: it sets no cookie and receives nothing, not even an anonymous ping.

Essential: always on

Your cookie answer is kept in your browser's local storage (sigil.consent) for twelve months, so we do not ask on every visit. The campaign tags described above live in session storage for the tab. Neither is sent to anyone, and this website sets no cookie of its own.

Analytics (Google Analytics 4): with your consent

Google Analytics tells us which pages are read and which buttons are clicked, so we can see what helps and what does not. It sets the _ga and _ga_* cookies (up to two years) to tell returning browsers apart. Google Analytics 4 does not store IP addresses, and we send it nothing you type: no name, no email address, and none of the campaign tags above.

Advertising (Google Ads): with your consent

We advertise Sigil on Google. With your consent, Google's tag measures whether a click on one of our adverts led to a trial or an enquiry, and may set the _gcl_* cookies (up to 90 days) to do so and to tailor the Google adverts you see. Without it, our adverts still show; they are just not measured.

Both services are provided by Google Ireland Limited, which describes how it uses the data at policies.google.com/technologies/partner-sites. We rely on your consent for both, which you can withdraw as easily as you gave it: withdrawing it removes the Google cookies this site can reach and stops the tag.

What Sigil never does

• It does not read, store or transmit the content of your emails.
• It does not track individual recipients or log who received what.
• It does not sell or share personal data for advertising.

Sub-processors

Sigil relies on the following providers to deliver the service:

Retention and deletion

Directory data is read on demand to render signatures and cached only transiently. Templates, images and account records are kept for as long as your organisation uses Sigil. Activity telemetry (metadata only) is retained to provide historical adoption reporting. When an organisation is deprovisioned, its templates, images, cached signatures and tenant data are deleted.

Your rights

Depending on your location, you may have rights to access, correct or delete personal data, or to restrict or object to its processing. Because your organisation controls its directory data, please direct such requests to your organisation's administrator; we will assist them as processor. For data we control, contact privacy@usesigil.app.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected in the “last updated” date above.

Who provides this service

Tophhie Cloud Ltd, a company registered in England and Wales under company number 17393069. Registered office: 21 Manor Way, Hoyland, Barnsley, S74 9QX, United Kingdom. Support: support@usesigil.app. Privacy: privacy@usesigil.app.