Privacy notice

Last updated: 18 October 2026

The short version. If you are only here to build a signature, nothing you type into the builder is stored. Your name, job title, email address and phone number are used to render the signature and are then discarded. You do not need an account, and none is created for you. If you do have an account, that stays true unless you choose to save a signature - then we keep it until you delete it.

Who we are

Michael Shreeves is the controller for the personal data described here. You can contact us about anything on this page at hello@mashreeves.com.

What we collect, and why

Two groups of people give us anything: people who just use the builder, and people who have an administrator account. A third group gives us nothing directly: staff of an organisation that connects its Microsoft 365 directory, which is covered in its own section below.

If you only use the signature builder

The details you type are sent to our server, rendered into a signature, and returned to you. They are not written to any database and not kept in your session. Closing the page ends it; to make the same signature again you fill the form in again.

The one exception is deliberate and yours to make: if you have an account and choose Save, that signature's details are stored so you can reopen it. Nothing is saved unless you press it.

Downloading a signature is deliberately a form submission rather than a link, so that your details are never placed in a web address, where they would otherwise be recorded in our server logs and your browser history.

If you have an administrator account

Personal data stored for account holders
What	Why	Lawful basis	Kept for
Your email address and name	To identify your account and sign you in	Contract	Until the account is deleted
Your password, stored only as a one-way hash	To sign you in. We cannot read it or recover it for you	Contract	Until the account is deleted
A count of wrong passwords and wrong second-factor codes, and the time your account was locked if it was. If it locks we email you once and record the lock in the audit log	To lock an account that is being guessed at, for 30 minutes, and to tell you	Legitimate interests: protecting accounts	The count and lock time stay until your next sign-in attempt after the lock ends, or until you reset your password, and go when the account is deleted. The audit entry is kept as long as the rest of the audit log
The font you chose under Your account › Appearance, if you chose one other than the default	So pages are shown in that font on any device you sign in on	Contract	Until you change it back to the default, or the account is deleted
Your two-factor secret, if you set it up, stored encrypted	To check the codes from your authenticator app	Legitimate interests: protecting accounts	Until you disable it, or the account is deleted
Any passkeys you add: the public key your device made (never your fingerprint, face or PIN, which stay on the device), the technical details the device reports about itself (which model or password manager made it, how it connects, whether it syncs), the name you give each, a random account handle, and when each was added and last used	To check it's you when you sign in with a passkey instead of a code	Legitimate interests: protecting accounts	Until you remove it, or the account is deleted. The audit trail keeps each passkey's name and a short fingerprint of it, like any other change to how you sign in
If you sign in with Microsoft: your Microsoft account's tenant ID and object ID (two identifiers, not your password), and whether your account was created by signing in or by your organisation's group sync	To recognise you the next time you sign in with Microsoft, and so your organisation's group sync can switch off the account when you leave the group	Contract	Until the account is deleted; cleared when it is anonymised
If your organisation sets up its own Microsoft sign-in: its Microsoft tenant ID, app ID and email domains, the app secret (stored encrypted), the security group it chose and who confirmed the set-up worked	To send your organisation's staff to its own Microsoft sign-in, and to add or remove accounts from its group	Contract	Until the organisation removes it or its account is deleted
Which organisation you belong to, and your role	To show you only your own organisation's templates	Contract	Until the account is deleted
An administrator action record: who did what, to which record, when, and the IP address it came from	So changes to accounts and templates can be traced during a security review	Legitimate interests: keeping the service secure and accountable	Two years
Password reset requests	To let you set a new password. The link is stored only as a hash and works once	Contract	One hour, then it expires
When you sign in, sign up or ask for a password reset: your IP address and technical signals from your browser, checked by Cloudflare Turnstile	To stop bots guessing passwords, creating fake accounts and flooding people with reset emails	Legitimate interests: keeping accounts and the service safe from automated abuse	We don't store it. Our server passes your IP address to Cloudflare with the check and gets back a pass or fail, and that's all
Signatures you choose to save - the template, the details you entered (typically your name, job title, email address and phone number) and any colours or fonts you picked	So you can reopen and change a signature instead of filling the form in again	Contract	Until you delete it or your account
Your organisation's name, if you registered as an organisation	To keep your templates separate from every other organisation's	Contract	Until the account is deleted
The email address of somebody an administrator invites to join their organisation, the role offered, who sent it, and the name the person gives when accepting	To email them the invitation, and to check it is accepted using the same address it was sent to	Legitimate interests: letting an organisation add its own staff	Until it is accepted, cancelled or expires (7 days), then deleted within a further 30 days
If your organisation connects Microsoft 365: which Microsoft 365 organisation it is (its tenant ID, and the email domain of the Microsoft administrator who approved it - not their name or address), who here connected it and when, and whether it last worked	To know which directory your organisation has allowed us to read, and to stop a Microsoft 365 organisation being connected twice	Legitimate interests: providing the connection your organisation asked for	Until it is disconnected or the organisation is deleted
Banners you create, including any text or images you put in them	To show them in signatures	Contract	Until you or an administrator deletes them

If your employer connected its Microsoft 365

An organisation using this service can connect its Microsoft 365 so its staff signatures are kept up to date from its own directory. If yours has, we hold a copy of these details about you, read from that directory about once an hour: your name (display name, first name and surname), work email address and sign-in name, job title, department, company name, office location, and work and mobile phone numbers, plus Microsoft's identifier for your account. Only staff with an enabled work account and a work email address are copied - not guests or disabled accounts (which is how Microsoft 365 usually holds shared and room mailboxes).

For this data, your organisation is the controller and we process it on its behalf, to produce its staff's email signatures. It decided to connect its directory, so it is responsible for telling its staff and is the right place for questions about why, or to exercise your rights over this data - or ask us and we will pass them on. Only that organisation's administrators can see the list; no other organisation can.

How long: for as long as you are in the directory. If you leave, are disabled or are removed there, you drop off the list at the next sync and your copy is deleted 30 days later - long enough for a mistaken change in Microsoft 365 to be put right. If the organisation disconnects Microsoft 365, every copy it had is deleted straight away.

Who can see your saved signatures

Only you. A saved signature belongs to your account, not to your organisation. Other people in your organisation cannot see it, and neither can your organisation's administrator - they manage the templates everyone can choose from, not what anybody put into one.

Who else sees it

Nobody, beyond the suppliers who make the service run. All of them act on our instructions under contract.

Vultr hosts the server, in its Manchester data centre in the UK. The database and backups live there.
Cloudflare sits in front of the site and handles the secure connection, so every request passes through it and it sees your IP address, your browser details and the page you asked for. Its Turnstile service also checks that a sign-in, sign-up or password-reset request comes from a person rather than a bot. Cloudflare is a US company and its network runs outside the UK too; its data processing terms include the UK’s approved safeguards for international transfers.
Microsoft, only if you choose to sign in with a Microsoft account. You sign in on Microsoft's own page, and Microsoft sends us back your name, email address and the two identifiers above - we never see your Microsoft password. If your organisation has set up group sync, our server also asks Microsoft which of your organisation's staff are in the group it chose, using the permission your organisation's IT team granted. If an administrator connects Microsoft 365 so signatures can be kept up to date from the directory, they sign in on Microsoft's page in the same way; we keep only the domain of their sign-in name (see the table above), and read the directory with the separate permission they approve. Microsoft runs Microsoft 365 for your organisation, not for us. Microsoft is a US company; its data processing terms include the UK’s approved safeguards for international transfers.
Microsoft 365 delivers the emails the service sends (password resets, invitations and similar). The service hands each email to a mail server on its own hosting, which passes it to Microsoft 365 to deliver, so Microsoft sees the recipient’s address and what the email says. Microsoft holds this email in the United Kingdom.
Brevo is kept as a fallback email provider. It handles no email day to day, and would deliver the same emails only if the Microsoft 365 route failed and the service was switched to it. Brevo is a French company and handles mail in the EU, which the UK recognises as giving adequate protection.

Two things on this site are loaded from someone else's servers: Turnstile, on the sign-in, sign-up and password-reset pages only, and a page-view counter run on our own analytics server at analytics.mashreeves.com on every page. Using Turnstile, your browser exchanges some technical information (such as your IP address) directly with Cloudflare so it can make that check; we never see what it exchanges, only whether the check passed. The analytics counter is self-hosted (Matomo, run by us, not a third party we hand your data to), does not set a cookie, and anonymises your IP address before it is stored - it tells us how many people visited which page, not who visited. Beyond those two, there is no advertising and no tracking. We do not sell your data and we never share it for marketing.

The Microsoft buttons - signing in with Microsoft, and an administrator's Connect Microsoft 365 - take you to Microsoft’s sign-in page at login.microsoftonline.com, and bring you back here afterwards.

Cookies

Only strictly necessary ones, which is why there is no cookie banner: a session cookie once you sign in, and a token used to protect forms against cross-site request forgery. Both are needed for the service to work at all and are not used to track you. One more, st_shell, remembers how you like the screen laid out: whether the side menu is open or folded down to icons on this device, and a copy of the font you chose in your account, so the sign-in and other signed-out pages use it too. It holds nothing about who you are, lasts a year, and is removed when you go back to the default layout and font. Our analytics counter (above) is deliberately configured not to set a cookie, so nothing on this site is set for advertising or cross-site tracking.

Where it is held

Held in the United Kingdom, on a Vultr server in Manchester.

Deleting your account

You can delete your own account at any time from your account page — you do not need to ask us. The account stops working immediately and is scheduled for deletion.

You have 30 days to change your mind. During that time you can sign in for the sole purpose of cancelling. After 30 days your name and email address are permanently replaced with placeholders, anything you saved is deleted, and none of it can be recovered.

If your account belongs to an organisation, an administrator there can also remove you. That works the same way and they can restore you within the same 30 days, after which it is equally permanent.

One thing is deliberately kept: the record of administrator actions described above. It shows what was done to accounts and templates, which is what makes a security review possible, and an account being deletable should not be a way to erase its own trail. Your name is removed from those entries when your account is deleted, and the entries themselves are kept for two years as described above.

Accounts that go unused

We do not currently delete dormant accounts automatically, so an account you simply stop using stays until you delete it. If that changes we will say so here and give notice first.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to have it sent elsewhere. Email hello@mashreeves.com and we will respond within one month.

Deleting your account is self-service, as described above — you do not need to email us for that one. For everything else on this list (a copy of your data, correcting it, restricting or objecting to how we use it, or having it sent elsewhere) there is no button in the product yet, so email us and we will deal with it by hand. That does not limit your rights, it just means you have to ask rather than click for those.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Is providing any of this required?

To use the signature builder, no — you can leave any field blank, and nothing is kept either way. To hold an administrator account you have to give an email address, because that is what the account is identified by and how a password reset reaches you.

Automated decisions

We do not make any automated decisions about you, and we do not profile you.

Changes

We update this notice whenever what we actually do changes, and change the date at the top. It is kept in the same version control as the software, so every revision is dated and attributable.