Privacy Policy

1. Who we are

This policy covers this website, the purchase of SignalBox subscriptions, emails between you and us, and the SignalBox application itself.

The controller of your personal data — the party that decides why and how it is used — is:

In this policy, “we”, “us” and “our” mean Individual Entrepreneur Vladislav Vandakurov.

Two other companies handle some of your data as independent controllers, under their own privacy policies rather than this one:

• Paddle, which sells SignalBox to you as our Merchant of Record (section 5);
• GitHub, which currently serves SignalBox downloads and updates (section 7).

We wrote this policy to meet the EU General Data Protection Regulation (GDPR) and the UK GDPR. We give the rights in section 11 to everyone, wherever they live.

2. At a glance

The short version. Each row is explained in detail further down.

3. This website

You can read this whole website without giving us any personal data. It has no accounts, sign-up forms or comments. To contact us, you send an email (section 6).

Like every website, this one is delivered by a web server. The company that hosts this website records standard server logs each time your browser requests a page or a file.

• What: your IP address, the date and time, the page or file requested, the page you came from, whether the request succeeded, and the user agent your browser sends (the type and version of your browser and operating system).
• Why: to deliver the pages, find and fix errors, and protect the site against attacks and abuse.
• Legal basis: our legitimate interests in running a working and secure website (GDPR art. 6(1)(f)).
• How long: for a limited period under the hosting company’s standard settings, usually no more than a few weeks. If we copy logs to investigate a specific problem, we delete our copy once the problem is solved.

We don’t use these logs to identify visitors, and we don’t combine them with other data. The fonts and images on this site come from our own host, not from other companies.

This site links to other websites, such as Paddle and GitHub. When you follow those links, the other website’s privacy policy applies.

4. Cookies and Paddle.js

We don’t set any cookies. We don’t use analytics, advertising or social media scripts, and our own scripts store nothing in your browser. When you open a page of this site, it loads nothing from any other company.

Paddle.js, Paddle’s checkout script, is loaded from cdn.paddle.com only when you ask to pay: when you press a Subscribe button on the home page or the pricing page, or when you open a payment link that Paddle sent you by email (for example, to update your card; such a link opens our home page with _ptxn in its address). Then:

• Your browser connects to Paddle’s servers, which receive your IP address and standard browser information.
• On the live site, Paddle.js also loads Paddle’s Retain script (formerly ProfitWell) from public.profitwell.com. Paddle uses it for subscription features, such as helping customers fix a failed payment.
• Paddle’s checkout opens in a window on top of the page, served from buy.paddle.com. Everything you enter there goes directly to Paddle, not to us.

Paddle.js, the Retain script and the checkout may set cookies or use similar technologies, such as local storage, and may collect information about your device and browser. Paddle uses this to run the checkout, keep payments secure and prevent fraud. Paddle decides how this data is used, as an independent controller. Its Privacy Notice explains what it collects, which cookies it uses and how you can control them.

We load Paddle.js at that moment because it is needed for the purchase you ask for (GDPR art. 6(1)(b)) and because of our legitimate interest in a secure checkout that prevents fraud (art. 6(1)(f)).

If you’d rather your browser didn’t contact Paddle, simply don’t press Subscribe: every page of this site works without it.

5. Buying a subscription

When you subscribe, you buy SignalBox from Paddle (Paddle.com Market Limited or one of its affiliates). Paddle collects your details directly at checkout. These are your name, email address, country and postcode, your payment details and, if you buy as a business, your company name and tax number.

Paddle handles payments, taxes, receipts, invoices, refunds and chargebacks as an independent controller, under its Privacy Notice and Buyer Terms. Paddle may run automated checks at checkout to prevent fraud; its Privacy Notice explains how.

You need to give Paddle these details to buy; without them, Paddle can’t process your order. We never see or store your full card number or security code.

What Paddle shares with us

• What:
  • your name and email address;
  • your country and postcode;
  • your company name and tax number, if you gave them;
  • your subscription and its status: start date, renewals, cancellation;
  • each transaction: date, amount, currency, tax, invoice number and Paddle’s reference numbers;
  • limited payment details, such as the type of payment method and, for cards, the card brand, last four digits and expiry date;
  • refunds and chargebacks;
  • whether you agreed to receive marketing emails.
• Why: to know who our customers are, so we can provide your subscription and support you; to answer billing questions and help with refunds and cancellations together with Paddle; to send you the emails described below; to detect and prevent fraud and abuse; to keep accounting and tax records; and to establish, exercise or defend legal claims.
• Legal basis:
  • providing the subscription and support: performance of our contract with you (GDPR art. 6(1)(b));
  • accounting and tax records: our legal obligations (art. 6(1)(c));
  • preventing fraud, protecting our business and handling legal claims: our legitimate interests (art. 6(1)(f)).
• How long: while your subscription is active and for 3 years after it ends, so we can answer later questions and deal with any claims. Invoices and other transaction records that accounting and tax laws require us to keep are kept for the period those laws set, generally up to 10 years, and then deleted.

Emails we send you

Paddle sends receipts, invoices and subscription emails itself.

We may email you about things that matter for your subscription, such as a price change, a change to our terms, or an important problem or security fix in SignalBox. We do this to perform our contract with you (GDPR art. 6(1)(b)) and because of our legitimate interest in keeping customers informed (art. 6(1)(f)).

We don’t send newsletters or marketing emails today. If we start, we will only email customers who agreed to receive them, for example at Paddle checkout, and we will rely on that consent (art. 6(1)(a)). Every such email will have an unsubscribe link. You can withdraw your consent at any time. We then stop and keep only a record that you opted out.

6. Emails you send us

When you email us, before or after buying, we receive what you send.

• What: your email address and name, the content of your messages, and any attachments, such as screenshots or SignalBox log files. A log file can include technical details such as camera models, the IP and MAC addresses of devices on your local network, and your computer’s name (which on a Mac often includes your own name). Please send only what is needed; you can remove anything from a log before you send it.
• Why: to answer your questions, solve problems, fix bugs and improve SignalBox.
• Legal basis: for customers, performance of our contract, because support is part of the subscription (GDPR art. 6(1)(b)); for everyone else, our legitimate interest in answering the people who write to us (art. 6(1)(f)).
• How long: up to 3 years after the last message in the conversation, unless we need it longer for a legal claim. We delete log files and screenshots once the problem they were sent for is solved.

Our emails are stored by the company that provides our email service (section 8).

7. The SignalBox app

Your cameras and footage stay on your network

SignalBox works on your local network. It talks directly to your cameras: Sony over Wi‑Fi, Blackmagic over Ethernet. It serves its control panel to browsers, phones and OBS Studio on the same network.

Camera settings, status and the Live Preview picture travel only between your cameras, the computer running SignalBox and the devices you open the panel on. Your recordings stay on the cameras’ own cards and drives. SignalBox doesn’t copy or upload them.

Files stored on your computer

SignalBox keeps its settings and diagnostic logs on the computer where it runs:

• Windows: in the SignalBox folder, next to SignalBox.exe;
• macOS: in ~/Library/Application Support/SignalBox/.

These files never leave your computer and are never sent to us, unless you choose to send us one yourself, for example a log with a support request (section 6). You can delete them at any time. On Windows, delete the SignalBox folder; on macOS, delete the folder shown above.

Update checks

The only internet connections SignalBox makes are checking for and downloading updates. It checks for new versions when it starts, then every few hours while it runs, and whenever you ask it to. It downloads an update only to install it.

The update server is currently GitHub (api.github.com). Updates, and the installers you download from this website, also come from GitHub (github.com).

These requests contain no information about you, your settings or your cameras. But, like any internet request, they show GitHub your computer’s public IP address and that they come from SignalBox. GitHub, Inc. receives this as an independent controller and handles it under the GitHub General Privacy Statement. GitHub shows us at most overall figures, such as how many times a file was downloaded, and never who downloaded it.

• Why: to tell you about new versions, and to install them when you ask, or automatically if you turned that on.
• Legal basis: updates are part of your subscription (GDPR art. 6(1)(b)), and we have a legitimate interest in keeping SignalBox up to date and secure (art. 6(1)(f)).
• How long: we receive nothing, so we keep nothing. GitHub keeps its server logs under its own policy.

If you don’t want SignalBox to contact GitHub, block it in your firewall or use it on a network without internet access. SignalBox keeps working; it just won’t find updates.

8. Who receives your data

We share personal data only with the following recipients, and only as far as needed:

• Paddle (Paddle.com Market Limited and its affiliates), our online reseller and Merchant of Record. Paddle is an independent controller of the data it collects at checkout and through Paddle.js. It shares with us what we need to support you (section 5). See Paddle’s Privacy Notice.
• The company that hosts this website. It delivers the pages and keeps the server logs (section 3). It acts on our behalf, as our processor.
• The company that provides our email service. It stores and delivers our emails (section 6). It acts on our behalf, as our processor.
• GitHub, Inc. It serves SignalBox downloads and update checks, and receives your IP address when you use them (section 7). GitHub is an independent controller; see the GitHub General Privacy Statement.
• Professional advisers, such as accountants, auditors and lawyers, when we need their help. They are bound by confidentiality.
• Authorities, courts and law enforcement, when the law requires it, or when it is needed to establish, exercise or defend legal claims or to protect the rights and safety of others.
• A buyer or successor, if SignalBox or our business is ever sold or transferred. They would have to use your data as this policy describes, and we would tell customers in advance.

Our processors may use personal data only on our instructions, under data processing terms that require them to keep it secure. We don’t sell personal data, and we don’t share it for advertising.

9. International transfers

We are based in Republic of Armenia. Paddle, GitHub and our hosting and email providers may process data in other countries, including the United Kingdom, the United States and countries of the European Economic Area (EEA). So your data may be processed outside the country where you live.

When personal data from the EEA, the UK or Switzerland goes to a country whose data protection laws have not been recognised as adequate, we use one of these safeguards, as applicable:

• an adequacy decision for the destination country or framework, for example for the United Kingdom, or the EU–US Data Privacy Framework (with its UK and Swiss extensions) for US companies certified under it;
• otherwise, the European Commission’s standard contractual clauses, with the UK addendum or the UK International Data Transfer Agreement for data from the UK, plus any extra measures the transfer needs.

Paddle and GitHub are responsible for the transfers they make as independent controllers, and their privacy policies describe their safeguards. You can ask us for more information about our safeguards, or for a copy of them (section 14).

10. Security

We protect personal data with technical and organisational measures that fit the risk:

• This website is served only over HTTPS, so pages travel encrypted.
• Only Paddle handles payment details. We never receive or store card numbers.
• We keep as little data as we can, limit access to the people who need it, and protect our accounts with strong passwords and two-factor authentication.
• We choose service providers that protect data with appropriate security measures.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.

Your part. The SignalBox panel has no password: anyone who can reach the computer on your local network can open it and control your cameras. Blackmagic cameras also accept control over the network without a password. Keep your studio network private: use secured Wi‑Fi, and don’t make the panel’s port (8787) reachable from the internet.

11. Your rights

Under the GDPR, the UK GDPR and similar laws, you have the right to:

• Access: find out whether we hold data about you, and get a copy of it.
• Rectification: have inaccurate data corrected, or incomplete data completed.
• Erasure: have your data deleted, unless we have to keep it, for example for tax records.
• Restriction: have us limit the use of your data, for example while we check a correction you asked for.
• Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another company. This applies where we process the data by automated means, based on your consent or on our contract.
• Objection: object at any time to processing based on our legitimate interests. We will stop, unless we have compelling legitimate grounds or need the data for legal claims. You can always object to direct marketing, and we will then stop.
• Withdraw consent: at any time, where we rely on your consent. This doesn’t affect processing that took place before you withdrew it.
• Complain to a data protection supervisory authority, in particular in the country where you live or work, or where you think your rights were infringed. We’d appreciate the chance to sort out your concern first, but you don’t have to contact us before you complain.

To use any of these rights, email privacy@signalbox.cam. It’s free of charge. We may ask you to confirm your identity, usually by writing from the email address you used to buy.

We reply within one month of receiving your request. If a request is complex, or we receive many, we may extend this by up to two more months. If we do, we will tell you within the first month and explain why.

For data that Paddle holds as controller, such as your payment details, you can also contact Paddle directly, as described in Paddle’s Privacy Notice. If you write to us instead, we will pass your request on and help.

If you live in a US state with a consumer privacy law, such as California, you have similar rights to know, correct and delete your personal information; send your request the same way. We don’t sell personal information, we don’t share it for cross-context behavioural advertising, and we will never treat you differently for using your rights.

12. Children

SignalBox and this website are meant for adults and businesses. They are not directed to anyone under 16, and we don’t knowingly collect personal data from children. If you think a child has given us personal data, write to us and we will delete it.

13. Changes to this policy

We may update this policy when SignalBox, our service providers or the law change. The “Last updated” date at the top shows the current version.

If a change materially affects how we use your data, we will tell customers by email before it takes effect. Where the law requires your consent to a change, we will ask for it.

14. Contact us

For any question about this policy or your personal data, write to us:

For billing and payment questions, you can also contact Paddle at paddle.net. See also our Terms of Service, Refund Policy and contact page.