signoffPrivacy policy
Last updated: 23 October 2026
Signoff is an email signature tool that Realm Digital (Pty) Ltd ("Realm", "we"), registration number 2012/065828/07, provides to companies ("your employer"). This policy explains what Signoff does with information about the staff who use it, about the people who receive their emails, and about anyone who registers interest on this website.
Who is responsible
Your employer decides to use Signoff for its staff and chooses its settings, so your employer is responsible for the personal information Signoff handles about you. It is the responsible party under the Protection of Personal Information Act (POPIA), or the controller under the UK and EU General Data Protection Regulation (GDPR).
Realm runs Signoff for your employer and handles that information only on your employer's behalf, as its operator (POPIA) or processor (GDPR), under a data processing agreement between Realm and your employer. Realm does not use it for any purpose of its own.
For questions about this policy, contact privacy@realmdigital.co.za. Realm's Information Officer is Simon Bestbier.
What we collect when you sign in
You sign in with your company Google account. Google tells Signoff:
- your name
- your email address
- that your email address is verified
- your company's Google Workspace domain
Signoff uses these only to check that you work for the company whose Signoff address you are using, and to show your name on the page. An account from any other company is refused.
If your employer signs you in through its own Google app rather than Signoff's, Signoff also reads your job title and mobile number from your company's Google directory, to fill in the form for you. Signoff's own Google app does not ask for this.
Your signature details
The details you type into the form are used to build your signature in your browser:
- name
- job title
- mobile number
- LinkedIn address
- office
They are saved in your browser's local storage, so the form remembers them next time. They are not sent to or stored on Signoff's servers. You can remove them by clearing your browser's data for your Signoff address.
Cookies
Signoff sets only cookies it needs to work, and no advertising or analytics cookies:
| Cookie | Why | How long |
|---|---|---|
| Session | Keeps you signed in | 12 hours |
| Sign-in check | Proves the browser that started sign-in is the one finishing it | 10 minutes |
| Sign-in hand-back | Ties a one-time sign-in code to your browser | 10 minutes |
The banner in your signature
Each signature can show a banner image that links to a page on your employer's website. When someone opens an email, their email program may load the banner image from Signoff. When they click it, Signoff sends them on to your employer's page.
- What Signoff keeps about clicks: for each click, the month, which banner, whether it looked like a person or an automated scanner, and the time. Nothing about who clicked, their IP address or their browser.
- How long: individual click records are deleted at the start of the next month, once they have been added up into monthly totals per banner. The totals identify nobody, so they are kept for as long as your employer uses Signoff.
- Image loads (opens) are not recorded by Signoff.
- Banner addresses: your employer chooses between one shared banner address for all staff (the default) and a separate address per person. A separate address per person lets admins show the banner only to selected staff and stop it in a leaver's signature. It also means that when an email is opened, the banner request names whose signature it came from. Signoff does not record this, but it appears in the hosting provider's request logs, which are kept for no more than 30 days and are not used to track anyone.
- Your employer's website: the link to your employer's website carries campaign tags (for example
utm_source=email_signature), so your employer's own website analytics can count visits from signatures. That analytics is your employer's, not Signoff's.
What admins can see and store
Your employer's Signoff admins can:
- choose the monthly banner
- turn it on or off
- limit it to selected staff (where per-person addresses are used)
- edit the company's look
Signoff stores the email address of the admin who made the latest settings change, and the list of selected staff email addresses, until an admin changes them. Banners record the email address of the admin who made and chose them. Any admin email address more than 24 months old is removed, and the banner or setting itself is kept.
To write banner headlines, Signoff sends the text of a page on your employer's own website to Anthropic's Claude service. No information about staff or email recipients is sent.
Where information is kept and who processes it
| Service | What it handles | Where |
|---|---|---|
| Vercel | Runs Signoff and keeps request logs for no more than 30 days | United States (Washington, D.C.) |
| Vercel Blob | Stores settings, banners, click records and encrypted secrets | South Africa (Cape Town) |
| Upstash | Holds a one-time sign-in code, encrypted, for up to 60 seconds while you sign in | United States (Washington, D.C.) |
| Signs you in | Google's global infrastructure, under Google's Cloud Data Processing Addendum | |
| Anthropic | Writes banner headlines from your employer's public web page | United States |
| Brandfetch (Brandfetch Sàrl) | Suggests a company's brand colours when an admin asks. It receives only the company's web address, no personal information | Switzerland-based company |
| Resend | Emails Realm if the monthly banner run fails (no staff or recipient information), and emails Realm's sales team when someone registers interest on this website | United States |
Signoff runs in the United States, so information about staff in South Africa, the UK and the EU is transferred there. Realm only uses providers that are bound by written agreements giving it protection substantially similar to POPIA's, as section 72 of POPIA requires. For staff in the UK and EU, those agreements include the standard contractual clauses approved for transfers out of the UK and EU.
How long information is kept
- Sign-in: the session cookie lasts 12 hours, sign-in cookies 10 minutes, and one-time sign-in codes 60 seconds.
- While your employer uses Signoff: click records are added up and deleted each month, and admin email addresses are removed once they are more than 24 months old.
- When your employer stops using Signoff: everything Signoff holds for your employer is deleted within 30 days, including settings, banners, click totals and its encrypted secrets.
- Your signature details stay in your browser until you clear them.
Registering interest on this website
If you register interest on this website, you are dealing with Realm directly, so Realm is the responsible party for what you send us, not your employer.
- What we collect: your name, work email, company, team size, which email platform you use, and anything you write in the message box.
- Why: to contact you about Signoff and, if you go ahead, set your company up. We do not add you to marketing lists or share your details with anyone else.
- Where it goes: a copy is stored in Realm's private storage on Vercel, and Realm's sales team is emailed through Resend.
- How long: registrations are deleted automatically after 12 months. If your company becomes a Signoff client, your contact details move to Realm's client records instead.
- Changing your mind: email privacy@realmdigital.co.za and we will delete your registration.
This website sets no cookies and uses no analytics.
Security
- Secrets are encrypted at rest.
- Each company's data is kept separate, and one company's session is refused on another company's address.
- Sign-in codes can be used once, expire after a minute, and work only in the browser that started sign-in.
Your rights
You can ask your employer, or Realm on its behalf, for access to or correction or deletion of information about you, and you can object to how it is used. Contact privacy@realmdigital.co.za. If you are not satisfied, you can complain to the Information Regulator in South Africa (inforegulator.org.za), the Information Commissioner's Office in the UK (ico.org.uk), or the data protection authority in your EU country.
Changes
We will update this page if Signoff starts handling information differently, and change the date at the top.