Vivid Signature is an email signature builder operated by Waterman Consulting Services, LLC ("we", "us"), a Texas limited liability company based in Houston, Texas, USA. This policy explains what we collect, why, who we share it with, and what you can make us do about it.
The short version. We collect the account details you give us and the signature content you build. We do not sell your personal information. Analytics and marketing cookies are off until you turn them on, and if your browser sends a Global Privacy Control signal we treat that as an opt-out without asking.
Waterman Consulting Services, LLC is the data controller for the personal information described here. Contact: [email protected].
Card numbers never reach our servers. Payments are processed by Stripe, which collects and stores your card details under its own privacy policy. We receive only a Stripe customer identifier, your subscription status and tier, the last four digits and card brand, and billing country.
If you redeem an AppSumo code we record the code, the date you redeemed it, and the account it was applied to. AppSumo handles the purchase itself and its own data collection under its policies.
| Purpose | Data | Legal basis (UK/EU GDPR) |
|---|---|---|
| Create and run your account | Account details | Performance of a contract |
| Save and render your signatures | Signature content | Performance of a contract |
| Take payment and manage subscriptions | Billing identifiers | Performance of a contract |
| Validate and honour AppSumo codes | Redemption records | Performance of a contract |
| Security, fraud prevention, abuse detection | Technical data | Legitimate interests |
| Product analytics | Usage data | Consent |
| Advertising measurement | Marketing identifiers | Consent |
| Answering support requests | Correspondence | Legitimate interests |
| Meeting legal and tax obligations | Transaction records | Legal obligation |
We group these into four categories.
| Category | Set by | What it does | Default |
|---|---|---|---|
| Strictly necessary | Vivid Signature, Firebase Auth, Cloudflare | Keeps you signed in, protects against abuse, and remembers your cookie choice (wcs_cookie_consent_v1 in local storage). |
Always on |
| Partner referral | Vivid Signature | If you arrive through a DRYLAND.AI partner link, the dry_aff cookie remembers that partner's referral number for 90 days so they are credited if you subscribe. It holds only the partner's number, nothing about you, and is not shared with advertisers. |
Only via a partner link |
| Analytics | Google Analytics 4 (G-P7NQ2D4VL2) |
Counts visits and shows which pages are used. We do not use it to identify you personally. | Off |
| Marketing | Meta Pixel (888878817069287) |
Measures whether our ads work and allows ads to be shown to past visitors. | Off |
Analytics and marketing tags do not load at all until you allow them. We implement Google Consent Mode v2 with every storage type denied by default, and the Meta Pixel script is not injected into the page unless you grant the marketing category.
We do not sell your personal information. We share it only with service providers who process it on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase (Auth, Firestore, Cloud Functions) | Accounts, signature storage, backend logic | USA |
| Cloudflare | Hosting, CDN, DDoS protection | Global edge network |
| Stripe | Payment processing | USA / Ireland |
| Google Analytics | Product analytics (consent only) | USA |
| Meta Platforms | Advertising measurement (consent only) | USA |
| Google Workspace | Support email | USA |
| AppSumo | Lifetime deal purchases and refunds | USA |
We may also disclose information where required by law, to enforce our terms, or in connection with a merger or sale of the business — in which case we will tell you before your information becomes subject to a different policy.
We are based in the United States and our providers are largely US-based. If you are in the UK, EEA or Switzerland, your information is transferred to the USA. Our providers rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and where applicable their certification under the EU-US Data Privacy Framework.
These are not aspirations. A scheduled job runs every night and enforces them; you can see the deletion date for your own account on the My Data screen once signed in.
| Data | Kept for | Then |
|---|---|---|
| Account profile and saved signatures | While the account is open, then 30 days after you close it | Permanently erased by an automated nightly job |
| Team Portal colleague records | Same as the account that created them | Erased with the account |
| Financial records (amounts, dates, Stripe customer id) | 7 years, as US tax law requires | Retained without your name, email or signature content |
| AppSumo redemption records | For the life of the licence | Codes are released back to you if you delete the account, so the licence you paid for is not destroyed |
| Encrypted backups | Rotate out within 90 days | Overwritten on rotation |
| Analytics | 14 months in Google Analytics | Deleted by Google |
| Support email | 24 months | Deleted |
Sign in and open My Data. Deleting the account takes effect immediately: access ends and any active subscription is cancelled at Stripe the same moment, so you are not billed again. Your data is then held for 30 days in case you change your mind — you can restore the account yourself during that window — and is permanently erased afterwards. Restoring does not resurrect a cancelled subscription; you would need to subscribe again.
Depending on where you live, you may have the right to:
Access, portability and erasure are self-service. Sign in and open My Data: download everything we hold as a JSON file, or delete the account outright. Neither requires you to email anyone or wait for us.
For correction, restriction, objection, or anything the screen does not cover, email [email protected]. We respond within 30 days and will not charge you or treat you differently for asking.
If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what we collect, to delete it, to correct it, to opt out of "sale" or "sharing", and not to be discriminated against for exercising those rights. Residents of Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws have comparable rights.
We do not sell personal information for money. Allowing the marketing category may constitute "sharing" for cross-context behavioural advertising under the CPRA. That category is off by default, you can switch it off at any time, and we honour Global Privacy Control as a valid opt-out signal.
In the past 12 months we have collected the categories described in section 2: identifiers, commercial information, internet activity, and approximate geolocation inferred from IP address. We have disclosed them for business purposes to the providers listed in section 6.
Traffic is encrypted with TLS. Authentication is handled by Firebase Authentication and we never see or store your password. Access to your account data is enforced by server-side security rules — your subscription tier and entitlements are written only by our backend, never by the browser. Payment card data never touches our infrastructure.
No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulator as the law requires.
Vivid Signature is a business tool and is not directed at anyone under 16. We do not knowingly collect information from children. If you believe a child has given us data, email us and we will delete it.
We will update this page when our practices change and revise the date at the top. For material changes affecting your rights we will give notice by email or an in-app notice before they take effect.
Waterman Consulting Services, LLC
Houston, Texas, USA
[email protected]