Privacy Policy

LightSignal LLC ("LightSignal," "we," "us," or "our") operates the LightSignal service at lightsignal.app and in our mobile apps (the "Service"). This policy explains what we collect, how we use it, who processes it for us, how long we keep it, and what you can do about it.

In short: you can see, export and delete your data. We never sell your personal information and never share it for advertising.

1. Who this policy covers

This policy covers business owners and their team members who use LightSignal ("you"). LightSignal is a service for businesses; it is not meant for personal use and is not directed to anyone under 18. We offer it in the United States.

The books and sales you connect can include the names of your own customers. We hold that information on your behalf and use it only to provide the Service to you. If you are a customer of a business that uses LightSignal, see section 10.

2. Information we collect

a. Information you give us.

• Account details: your name, business name, email address and password (stored only as a secure hash).
• Business profile: what you tell us about your business, such as its address and locations, industry, operations, team members and their roles, rent, loans and insurance, goals, and, if you choose to say so, whether it is minority-owned, woman-owned or veteran-owned.
• What you ask and write in the Service: your questions, scenarios, notes and corrections.
• Documents you upload.
• Payment details: entered with our payment provider, Stripe. We do not see or store your full card number.
• Messages you send us.
• If you join our waitlist: your email address and the answers you give about your business (type, revenue range, systems, locations and how you heard of us).

b. Information from the tools you connect.

Connections are read-only: LightSignal never moves money or changes your records. Depending on what you connect:

• QuickBooks Online or Xero: your books, such as revenue, expenses, invoices, bills, balances and accounts receivable and payable. This includes the names of your customers on invoices, which we use to show who owes you and who your largest customers are, and which are kept in the reads we store for you.
• Square: your sales, such as amounts, times, items and locations, and, for each card payment, the fingerprint Square gives the card so we can tell returning customers apart; never the card number. The Square payment records we keep include each card's last four digits, its BIN (the first six digits, which name the bank that issued the card) and its expiry date, never the full card number. They also hold the buyer's email address, billing address and shipping address when Square has them. They can also hold the seller's note on the payment and the link to the customer's record, and, for the payment methods that carry them, a Cash App Pay buyer's full name, $cashtag and country, and a bank payment's bank name, routing number, the last digits of the account, the account's type, owner type and country, the fingerprint Square gives the account and the description sent to the bank. The Square customer records we keep hold each customer's name, nickname, company name, email address, phone number, address, birthday, any tax ID, email preferences and the seller's note about the customer, as Square holds them, along with the groups and segments the seller put the customer in, how the record was created, and the reference numbers and dates Square and the seller keep for the record.
• Shopify: your orders, products, inventory, payouts, refunds and discounts, and your customers' names, email addresses, order counts and lifetime spend as Shopify reports them. We store these to show your customers and sales.
• Facebook Page: photos from your Page, only if you connect it and allow photos (below).

You choose which tools to connect, and you can disconnect any of them at any time in Settings.

c. Public information about your business and market.

• We look up your business listing and nearby businesses on Google, place your address on a map with Mapbox, and search public web pages with Firecrawl for market research and opportunities.
• Photos of your business, only with your permission (Settings, Data & Privacy, Business photo permissions) and only from the sources you pick: your Google Business Profile and the Street View image of your address, your website, and your Facebook Page.

d. Information collected automatically.

• Sign-in records: IP address, device type and time of each sign-in, so you can see and end your sessions in Settings.
• Which features you use, so we can improve them.
• On our website, we use PostHog to count which pages are viewed and which buttons are clicked. PostHog never receives the words on the page or anything you type, and there is no session recording. Our apps don't use PostHog or any other outside analytics service; they record which screens are viewed and which buttons are tapped in our own database. What you type into LightSignal (questions, notes, corrections, check-ins) is stored in our own database, on your account, to run the service.
• Cookies and similar technologies, described in section 8.

3. How we use your information

• To provide the Service: reading your books and sales and writing your insights, alerts and recommendations.
• To analyze your business data with our engine provider, as described in section 4.
• To sign you in, keep your account secure, and bill your subscription.
• To send you account emails and the reports and alerts you choose.
• To improve the Service, including with aggregated information (section 5).
• To detect and prevent fraud, abuse and security problems, and to meet legal obligations.

We do not sell your personal information, we do not share it for advertising, and we show no ads.

4. How your business data is analyzed

LightSignal uses Claude, made by Anthropic, to analyze your business data. To do that, we send Anthropic your connected books and sales figures, your business profile answers and the questions you ask. They are used to write your insights, forecasts and answers. Under Anthropic's commercial terms, this data is not used to train Claude.

We ask your permission before this analysis starts, and you can withdraw it at any time in Settings, Data & Privacy. LightSignal also keeps a record of what it has learned about your business so its answers stay consistent over time; that record is yours alone and is never shown to another customer. None of this is used to make decisions about people with legal or similarly significant effects.

5. Aggregated information

We combine figures across customers to build benchmarks for businesses of a similar type and size. Before any cross-customer analysis we remove identifying details such as your business name and account identifiers. Aggregated figures that no longer identify you or your business are not treated as your personal information under this policy.

6. Who processes data for us

These companies run parts of the Service for us. They process data only to provide their service to us, under contracts that limit what they may do with it.

Tools you connect. When you connect Intuit (QuickBooks Online), Xero, Square, Shopify or Meta (Facebook Page), we exchange data with that company only as needed to read your data, with the access you granted.

We use data from Google and Meta only for the features you turn on and only as their developer terms allow.

Other disclosures. We disclose information when the law requires it (for example, a valid subpoena), to protect the rights, safety or property of LightSignal, our customers or others, and if LightSignal is part of a merger, acquisition or sale of assets, in which case we will tell you before your information is covered by a different privacy policy.

Data processing agreements. If your business needs one, email hello@lightsignal.app.

7. How long we keep it

• While your account is open, we keep your data so the Service can compare periods. Connected books and sales are read up to 24 months back.
• Disconnecting QuickBooks deletes the QuickBooks data we hold for that company. Disconnecting another tool stops new reads; the reads you already have stay until you delete them.
• Deleting your account: starting deletion cancels your subscription at once and starts a 14-day grace period, during which you can still sign in and restore the account. When it ends, your account and its data are deleted.
• If your subscription ends without a deletion: your history is kept for 30 days, during which nothing reads or processes it, and then deleted. You can have it deleted at once from Settings.
• Deleted data leaves the live Service at once and leaves our backups on their normal schedule; the longest any backup is kept is 12 months.
• We keep a record of the consents you gave and our own billing, spend and security records, which hold no business data, where needed for legal, tax, security or audit purposes. Aggregated figures that no longer identify you may be kept.

8. Cookies and similar technologies

We use no advertising cookies and no third-party advertising trackers. On our website we use:

• Sign-in cookies: keep you signed in. The two that carry your sign-in cannot be read by page scripts. They last up to 7 days and are removed when you sign out.
• Analytics (a PostHog cookie and browser storage): measure how the site is used (section 2d).
• Browser storage we set ourselves: the campaign link that brought you (kept 30 days), your onboarding progress, and small display preferences.

You can block or clear cookies in your browser. Blocking the analytics cookie does not affect the Service; blocking the sign-in cookies stops you from signing in.

9. Security

We protect your information with access controls, encryption in transit, encryption of stored connection keys, hashed passwords, per-account separation of data, and encrypted backups. No system is perfectly secure, and we cannot guarantee absolute security.

If we learn of a breach affecting your personal information, we will notify you and the authorities the law requires, without undue delay.

10. Your choices and requests

• See your data: your numbers and the reads built from them are on your pages, what LightSignal knows about your business is in Business Profile, and your connections, sign-ins and consent history are in Settings.
• Export your data: Settings, Data & Privacy, Export my data downloads everything stored for your account as one file.
• Correct your data: edit it in Business Profile or Settings, or ask us below.
• Delete your data: Settings, Data & Privacy, Start deletion (section 7).
• Disconnect tools at any time in Settings, Integrations, and manage emails in Settings, Notifications.
• Withdraw permission for the analysis in section 4 in Settings, Data & Privacy.

Anyone can also send us a request to know, get a copy of, correct or delete personal information we hold, or to ask that it not be sold or shared (we do neither), using the form below or by emailing hello@lightsignal.app. We confirm a request within 10 business days and answer within 45 days. We may ask you to confirm who you are before we send or delete anything. Someone else may make a request for you with your written permission, and we will ask for proof of it. We will not treat you differently for making a request.

If you are a customer of a business that uses LightSignal, that business decides how your information is used; please contact it first. If you contact us, we will pass your request to the business and help it answer.

Loading the request form.

11. Where your data is processed

LightSignal is operated from the United States and offered only in the United States. The companies in section 6 process data for us from the United States or under their own terms for data sent outside it.

12. Changes to this policy

We may update this policy. If we make material changes, we will tell you in the Service or by email and update the date above.

13. Contact us

LightSignal LLC
New York, NY
hello@lightsignal.app