Privacy Policy

Scope, entity, and roles

This Privacy Policy explains how NOURIVANA INC (“signalclue,” “we,” “us,” or “our”), a corporation registered in California, USA (Entity No. 202120411028), collects, uses, stores, discloses, and protects personal information when operating signalclue.com, reviewing enterprise applications, administering enterprise accounts and authorized users, providing analytics services and customer support, and protecting service security. It also explains how individuals may exercise applicable rights.

This Policy applies to websites, application channels, and enterprise applications directly operated by signalclue that expressly link to it. Independently operated third-party sites, payment pages, browsers or extension stores, social platforms, and other services apply their own privacy rules.

For website visits, inquiries, enterprise applications, accounts, security, billing records, and support information, we act as the personal-information handler or controller required by applicable law for the relevant activity. For Customer Data submitted, connected, or otherwise authorized by an enterprise customer for its own business purposes, the customer determines the purposes and means, and we process under its lawful instructions, the customer service agreement, Order/SOW, data processing agreement (DPA), and applicable law.

Where data is obtained through a browser extension, a third-party service-provider interface, or a similar method, the enterprise customer remains the party that determines the processing of that data, and we provide technical support only as authorized by the customer.

Information categories and sources

Depending on how you interact with signalclue, we may process:

• website and contact data, including name, organization, job title, business email, business telephone number, inquiry or application content, and language preference;
• enterprise application and account data, including submitted application details, authorization relationships, account identifiers, organization, role, sign-in, and verification records;
• usage and device data, including access time, pages viewed, IP address, device and browser type, language, session identifiers, cookies, or similar technology data;
• security and operational data, including sign-in events, permission changes, activity records, error logs, anomalous activity, anti-abuse, and incident-response records;
• support data, including issue descriptions, communications, necessary attachments, troubleshooting steps, and outcomes;
• transaction and billing data, including order number, package, amount, currency, payment status, invoice, and reconciliation information. Full payment-card numbers, banking passwords, or payment-account credentials are handled directly by payment providers, and we do not ask you to provide them through ordinary contact channels;
• Customer Data submitted, connected, or directed for processing by an enterprise customer or its authorized users, including analytics inputs, intermediate results, outputs, and deliverables; and
• order-delivery address and recipient information obtained, uploaded, queried, or managed by an enterprise customer through the website, such as recipient names, addresses, and telephone numbers. This information forms part of Customer Data; and
• legal and compliance records necessary to meet legal obligations, conduct audits, and handle complaints, disputes, or rights requests.

Information may come directly from you; from your enterprise administrator or other authorized personnel; from systems you authorize us to connect to; from uploaded files; from providers acting for us; from publicly available sources where lawfully used; and from records generated through operation of the services.

Order-delivery address information may include personal information such as a consumer's residential address. The enterprise customer is responsible for ensuring that its acquisition and use comply with applicable data-protection law and that it has obtained necessary authorization or another lawful basis.

Do not send passwords, full payment-card data, government identifiers, biometric or health data, or other unrelated sensitive personal information through ordinary email or contact forms.

Purposes and legal bases

We process personal information as necessary to:

• respond to inquiries and review or process enterprise applications;
• create, administer, and protect enterprise organizations, accounts, roles, and authorization relationships;
• provide, maintain, support, and improve analytics services selected by customers;
• obtain, display, store, and manage order-delivery address information under enterprise-customer instructions so that the customer can complete order fulfillment, after-sales service, and necessary logistics operations;
• handle orders, payment status, invoices, reconciliation, and customer-service records;
• verify identity and authority and prevent fraud, abuse, attacks, and unauthorized access;
• diagnose faults, maintain availability, and perform capacity and quality analysis;
• send service, account, security, transaction, and material policy communications;
• perform contracts, follow lawful customer instructions, and meet tax, accounting, audit, regulatory, and other legal obligations; and
• establish, exercise, or defend legal rights and handle complaints or disputes.

We rely on bases permitted by applicable law, including steps requested before entering a contract or performance of a contract, compliance with legal obligations, legitimate interests or proper business needs in protecting users and services, lawful enterprise-customer instructions, and consent where required. Where processing relies on consent, consent may be withdrawn as provided by law without affecting processing that was lawful before withdrawal.

We process order-delivery address information only under the lawful instructions of the enterprise customer and do not use it for purposes unrelated to providing customer services.

If we intend to use personal information for a materially new purpose incompatible with the original purpose, we will provide required notice before processing and obtain new consent or another valid authorization where required.

Cookies, automatic collection, and choices

Technologies currently used include: (1) browser local storage, which stores minimized sign-in status and account-role information to support sign-in determination and page routing; this storage item does not contain passwords or authorization credentials; and (2) essential session and security technologies used to provide access, sign-in, security protection, and troubleshooting functions.

We currently do not use advertising cookies or non-essential analytics technologies that require user choice. If such technologies are introduced, we will update this Policy before activation and provide choices required by applicable law. You may use browser settings to restrict or delete cookies or local storage, but disabling essential technologies may affect sign-in, security, or page functionality.

Sharing, providers, and legal disclosures

We do not disclose personal information merely because we possess it. To fulfill the purposes described in this Policy, we may provide necessary information to:

• enterprise customers and their authorized personnel who receive enterprise applications, administer accounts, or receive Customer Data and deliverables;
• providers of cloud infrastructure, OSS/CDN, email, customer support, security, analytics, payment, audit, or professional services;
• participants in diligence or recipients of relevant operations in a reorganization, financing, merger, acquisition, or asset transaction, subject to appropriate confidentiality and security safeguards;
• courts, regulators, law-enforcement bodies, or public authorities lawfully entitled to request it; and
• persons who need the information to protect the rights, safety, or property of signalclue, customers, users, or the public, or to investigate fraud, attacks, or unlawful conduct.

Providers processing information for us may act only for agreed purposes and instructions and must be subject to appropriate confidentiality, security, incident-notice, deletion or return, and onward-subprocessing obligations. Information about relevant providers or subprocessors and notices of changes are provided under the applicable customer agreement or DPA.

Order-delivery address information is accessible only to authorized personnel under least-privilege controls and only as necessary to follow customer instructions. We do not proactively browse, analyze, or use it except for troubleshooting, security protection, or legal requirements.

We do not use Customer Data, including order-delivery address information, for advertising, sale, or purposes unrelated to customer services. We do not use Customer Data to train a general-purpose model for other customers unless the enterprise customer expressly authorizes that use in the applicable customer contract.

If we engage in activity that legally constitutes a sale of personal information, sharing for targeted advertising, or another activity requiring specific disclosure and choice, the applicable details and opt-out method are: [Special disclosure and choice statement: We currently do not sell personal information, share it for cross-context behavioral advertising, or conduct targeted advertising].

Storage locations and international transfers

The primary production-storage location for personal information and Customer Data is [Primary storage location: Hong Kong]; log and backup locations are [Log and backup locations: Hong Kong]. Access locations and personnel are restricted under customer agreements, DPAs, provider arrangements, and applicable law.

Where cloud services, remote support, providers, or enterprise-customer instructions require information to be transferred to another country or region, we use transfer mechanisms and safeguards required by applicable law, including [Applicable transfer mechanism: safeguards required by applicable law]. Where required, we provide additional notice, obtain separate consent, execute standard clauses, complete certification, impact or security assessments, or make required filings.

Questions about applicable safeguards and requests for available copies may be sent to info@signalclue.com.

Retention, deletion, and anonymization

We retain information only for the period necessary to fulfill the purposes described in this Policy, follow customer instructions and contracts, meet legal-retention obligations, complete audits, or handle disputes. Current principal periods are:

• website inquiries and contact records: [Website inquiry retention period: 24 months after the last interaction];
• enterprise application records: [Enterprise application retention period: 24 months after review closes];
• account and authorization records: for the life of the account and [Additional account-data retention period: 24 months after account or customer-relationship termination] after termination;
• security, access, and error logs: [Security log retention period: 12 months];
• support records: [Support-record retention period: 24 months after the support matter closes];
• Customer Data and deliverables: as specified by the customer agreement, Order/SOW, DPA, or lawful customer instruction; and
• transaction, tax, accounting, audit, and dispute records: for the period required by applicable law.

At the end of the applicable period, we delete or irreversibly anonymize information. Information retained for litigation hold, regulatory requirements, or another legal obligation is restricted to that purpose. After deletion from production systems, backup copies are deleted through the [Backup rotation period: 90 days] cycle and are not restored for ordinary business processing before rotation, except where needed for lawful security recovery.

Security measures and incident response

We maintain administrative, technical, and physical safeguards appropriate to the nature, context, and risk of processing, including identity and access controls, least privilege, transmission and storage protection, logging and monitoring, backup recovery, vulnerability and patch management, provider oversight, personnel confidentiality obligations, and incident response. No network transmission, storage system, or safeguard can guarantee absolute security. Users and enterprise customers must also protect devices, networks, account credentials, authorization relationships, and downloaded files.

If a personal-information security incident occurs, we take steps to identify and contain it, preserve evidence, assess impact, remediate, and prevent recurrence. For personal information we independently control, we notify affected individuals and competent authorities as required by applicable law. For Customer Data, we provide incident notice and necessary assistance to the enterprise customer under the DPA and applicable law.

Security concerns may be reported to info@signalclue.com. Do not include passwords, full payment-card data, or unnecessary sensitive personal information in ordinary email.

Individual rights and request process

Depending on your location, the information, and our processing role, you may have rights to notice, access, copy, correction, completion, deletion, restriction or objection, portability, consent withdrawal, account closure, and explanation, human review, or appeal of automated decisions.

Requests may be submitted to info@signalclue.com and should identify the relevant information, relationship, and requested right. To protect individuals and enterprise information, we may request identity or authorization evidence proportionate to the request. We respond within [Rights-request response period: 30 days after receipt and necessary identity verification]. If applicable law permits an extension because of complexity or request volume, we explain the reason and expected timing. Where law permits, we may refuse a manifestly unfounded or excessively repetitive request, or one that would impair another person’s rights or conflict with a legal-retention duty, and will provide the applicable reason and appeal route.

If a request concerns Customer Data controlled by an enterprise customer, contact that customer first. We assist under the DPA and do not directly alter its business records without authorization. We respond directly for website, application, account, security, billing, or support information that we independently control.

Customer Data and the DPA boundary

“Customer Data” means data that an enterprise customer or its authorized users submit, connect, authorize us to access, or ask us to process on its behalf for enterprise purposes, including analytics inputs, intermediate results, outputs, and deliverables, as well as order-delivery address and recipient information obtained, uploaded, queried, or managed by the enterprise customer through the website. The enterprise customer is responsible for ensuring a lawful basis for its collection, use, submission, and instructions; providing required notice and authority; and complying with data-minimization requirements.

We process Customer Data only under the customer service agreement, Order/SOW, DPA, lawful customer instructions, and applicable law. The DPA or other customer contract governs processing purposes, data categories, data subjects, duration, transfers, subprocessors, safeguards, incident cooperation, assistance with individual rights, audit, and return or deletion after contract termination.

If this Policy conflicts with a signed DPA for the same processing-on-behalf activity, the order of precedence in the customer contract applies. This Policy continues to apply to personal information we independently control for accounts, security, billing, support, contract administration, or legal obligations.

Minors and other special processing

signalclue is intended for enterprises and their authorized business personnel and is not directed to minors under [Minimum applicable age: 18]. We do not ask enterprise customers to submit minors’ information through ordinary website or contact channels. If order-address information uploaded or obtained by an enterprise customer includes recipient information relating to a minor, the enterprise customer is responsible for ensuring a lawful basis; we provide technical services only under customer instructions. A guardian who believes a minor provided personal information without appropriate authority may contact info@signalclue.com. After verification, we will delete it or take other action required by applicable law.

Our current activities involving sale of personal information, sharing for targeted advertising, direct marketing, profiling, solely automated decisions producing legal or similarly significant effects, and AI or model training are: [Special-processing activity statement: We currently do not sell personal information, share it for targeted advertising, conduct direct marketing or profiling, make solely automated decisions with legal or similarly significant effects, or train a general-purpose model for other customers using personal information or Customer Data]. If those activities change, we will update this disclosure before new processing begins and provide any consent, opt-out, human review, or appeal mechanism required by applicable law.

We do not use Customer Data to train a general-purpose model for other customers unless the enterprise customer expressly authorizes that use in the applicable customer contract.

Updates, contact, complaints, and language

We may update this Policy when law, organization, services, providers, or processing activities change. The updated version will be published at [Privacy Policy URL: https://signalclue.com/privacy] with its last-updated and effective dates. For a change materially affecting individual rights or processing, we provide additional notice through [Material-update notice method: prominent website notice and email where valid contact information is available] and obtain consent where required by applicable law. An ordinary website update does not unilaterally amend a signed customer agreement or DPA.

Privacy questions, rights requests, or complaints may be sent to the signalclue Privacy Team at info@signalclue.com. The expected acknowledgment time is [Privacy-request acknowledgment time]. Security concerns should be sent to info@signalclue.com.

If you are dissatisfied with our response, you may request review through [Internal appeal channel: email info@signalclue.com with “Privacy Appeal” in the subject line] or complain to the personal-information protection or other regulatory authority with lawful jurisdiction in your location.

This Policy is available in Chinese and English. If the versions conflict, [Controlling language: English] controls unless applicable law requires another language or mandatory rule to prevail.