Privacy Policy
Last updated: 8 November 2026. Applies to GDPR, UK GDPR and CCPA/CPRA.
1. Introduction and scope
This Privacy Policy explains how Western Star Group LLC (the "Company", "we"), provider of the WebSignals™ service, at 302 Washington St., Ste. #150-9852, San Diego, CA 92103, collects, uses and protects personal data across our website, web app and mobile app. The Company acts as a Data Controller for account administration data and as a Data Processor for the content your team enters (statuses, messages, locations, client names), as described in the Data Processing Agreement.
2. Information we collect (notice at collection)
| Category | What | Why |
|---|---|---|
| Identifiers | Email address, optional display name, password (stored only as a salted hash), optional mobile number, IP address | Account, sign-in, text alerts, security |
| Team content you enter | Team membership, traffic-light status, status message, client, location, team and direct chat messages | The core service; visible to your team as described in the Terms |
| Contact form | Name, email and message you send us | To reply to you; forwarded by email to our support inbox and not stored in the app |
| Commercial information | Subscription status and Stripe customer and subscription ids. Card details are handled only by Stripe and never reach us | Billing and access |
| Service records | Notifications about your access, an audit log of account and billing events, text-alert opt-in | Operation, support, security |
| Technical data | Server logs (IP address, user agent, request time), rate-limit counters, sign-in token | Security and reliability |
| On your device | Your chat translation language and any language packs. Translation runs on your device; we do not send message text to a translation service | Optional translation |
We do not collect precise device location. The "location" field is free text that you type. We do not use advertising or analytics trackers.
3. Lawful basis (GDPR Article 6)
- Contractual necessity: to provide the Service and process payments.
- Legitimate interests: to keep the platform secure, prevent fraud and abuse, and improve reliability.
- Consent: for text alerts and any marketing communications; you can withdraw consent at any time (for text alerts, clear the opt-in on your account page).
- Legal obligation: tax, accounting and responding to lawful requests.
4. Who we share data with
We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share data only with service providers that help us run the Service (see the sub-processor list in the DPA): Stripe for payments, Twilio for text alerts you opted in to, and our hosting provider. Teammates see the team content described in the Terms. We may disclose data when required by law.
5. Retention
- Chat messages: deleted automatically after 90 days (default; may be shorter or longer by agreement).
- Status and team data: kept while your account is active. Statuses are reset daily to red with the message, client and location cleared.
- Account data: deleted or anonymised within 30 days of an account deletion request, except what we must keep for legal, tax or fraud-prevention reasons (for example billing records, typically up to 7 years).
- Audit and security logs: kept for a limited period needed for security and compliance.
6. Cross-border transfers
Personal data from the European Economic Area (EEA) or the UK may be transferred to and processed in the United States. These transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK addendum where applicable).
7. Your rights (GDPR and CCPA/CPRA)
Depending on where you live you have the right to:
- Access and portability: a copy of your personal data in a structured, machine-readable format.
- Correction: fix inaccurate data (you can edit most of it yourself in the app).
- Deletion ("right to be forgotten"): erasure of your data, subject to legal retention obligations.
- Restriction and objection: limit or object to certain processing.
- Opt-out of sale or sharing: WebSignals does not sell personal information and does not share it for cross-context behavioral advertising. You will not be discriminated against for exercising your rights.
- Complaint: lodge a complaint with your data protection authority.
To exercise these rights, email support@westernstargroup.com from the address on your account. We verify your identity and respond within 30 days (GDPR) or 45 days (CCPA). If you use WebSignals through an employer or team owner, we may direct your request to them as the controller of that content.
7A. Additional rights by region
The rights above apply to everyone. Some places give you more, and we honor them for residents of those places:
- European Economic Area and United Kingdom (GDPR / UK GDPR): access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests), withdrawal of consent at any time, and the right to complain to your supervisory authority (in the UK, the ICO). Transfers outside the EEA/UK rely on the safeguards in section 6.
- California (CCPA/CPRA): the right to know, delete, correct, and to opt out of the sale or sharing of personal information, and to limit use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising and do not use sensitive personal information beyond providing the service. We do not discriminate against you for exercising these rights. You may use an authorized agent. We honor the Global Privacy Control signal.
- Other U.S. states (for example Virginia, Colorado, Connecticut, Texas, Utah): access, deletion, correction, portability and opt-out of targeted advertising, sale and profiling, plus the right to appeal a refusal by emailing us with "Appeal" in the subject.
- Canada (PIPEDA) and Australia (Privacy Act): access and correction rights, and the right to complain to the Office of the Privacy Commissioner of Canada or the OAIC.
- Brazil (LGPD): confirmation of processing, access, correction, anonymization or deletion, portability and information about sharing.
Use Cookie preferences in any page footer to review or change your cookie choices at any time. To exercise any right, email support@westernstargroup.com.
8. Security
We use technical and organizational measures appropriate to the risk, including encrypted connections, hashed passwords, access controls enforced on the server, signed payment webhooks and audit logging. No system is perfectly secure; tell us about suspected issues at support@westernstargroup.com.
9. Children
The Service is for business use by adults and is not directed to children under 16. We do not knowingly collect their data.
10. Changes and contact
We will post updates here and notify you of material changes. Cookies and similar technologies are described in the Cookie Policy. Contact: support@westernstargroup.com or Western Star Group LLC, 302 Washington St., Ste. #150-9852, San Diego, CA 92103.