The short version

• The public generator creates the signature in your browser. The signature fields you type and the rendered signature HTML are not transmitted to IV-Lead.
• When an organisation connects HubSpot, IV-Lead stores the limited account, brand, security, and rollout records described below, and - only when a person deliberately copies or saves a finished signature, including by choosing "Add my team signature" - that person's own saved signatures, encrypted, up to five each and deletable by them. If a super admin shares a team signature design, IV-Lead also stores the shared design, its versions and the HubSpot user IDs of the people it was shared with; opening a shared design or changing its preview language does not save a personal copy. Team Health reads roster names and work email addresses from HubSpot when needed for display, but does not persist those roster fields in the application database.
• The app requests two required read-only HubSpot scopes, settings.users.read and crm.objects.users.read, one optional read-only scope for prefilling a person's own meeting link, scheduler.meetings.meeting-link.read, plus the baseline access HubSpot grants every app. It cannot read contacts, companies, deals, or mailboxes, and it cannot change HubSpot data or settings.
• IV-Lead does not insert tracking pixels or use generated signatures to measure opens, clicks, or recipients. Remote images can still cause ordinary request metadata to reach the relevant image host when an email client loads them.
• IV-Lead does not sell personal data or use it for advertising, behavioural profiling, or automated decision-making.

1. Who we are

The Service is provided by Chen Yehoshua, trading as IV-Lead (איי וי ליד), an Israeli licensed sole proprietor (עוסק מורשה), business number 037107026, of Rothschild Blvd 25, Tel Aviv, Israel ("IV-Lead", "we", "us").

IV-Lead is a trade name, not a separate company. The legal person providing the Service is Chen Yehoshua. Our controller and processor roles for different categories of data are explained in section 2.

We have not appointed a Data Protection Officer. Privacy questions, rights requests, and complaints can be sent to support@iv-lead.com.

2. Our roles: controller and processor

The role depends on why the data is processed:

• For the connected organisation's HubSpot roster, brand kit, per-user rollout status, saved signatures, shared team designs and their versions, recipient assignments and dismissals, and the team copy and click records described in section 4, the HubSpot account holder determines the purpose of the processing and acts as controller. IV-Lead processes that data on its documented instructions as processor, subject to the Data Processing Addendum.
• For IV-Lead's own service administration, terms-acceptance evidence, security audit records, infrastructure security, support correspondence, and legal compliance, IV-Lead acts as controller.

If you are an employee or contractor of a connected organisation and want to exercise a right concerning its roster or rollout data, contact that organisation's HubSpot administrator first. IV-Lead will assist the organisation as required and will handle any data for which IV-Lead is controller directly.

3. Using the public generator without connecting HubSpot

The generator assembles the signature locally in your browser and copies the result to your clipboard. The application does not transmit the signature fields you type or the rendered signature HTML to IV-Lead, and it creates no IV-Lead account for you.

One optional feature makes a server request. If you choose Start from your website and enter a company web address, that address is sent to IV-Lead, our server requests that public page once, and the brand details it can find - company name, logo, brand colours, postal address, telephone number, and links to company social profiles - are returned to your browser as editable suggestions. IV-Lead does not store the address you entered, the fetched page, or the suggestions; only the ordinary request metadata described below is processed. The feature reads public web pages only: it will not fetch a private, internal, or non-HTTPS address.

The acceptance control presented before copying a signature is evaluated in the browser and is not sent to IV-Lead. The interface font is served from IV-Lead's own hosting and does not contact Google Fonts.

As with any website, Cloudflare may process ordinary request and security metadata, such as an IP address, browser user-agent, requested path, and timestamp. IV-Lead does not use that metadata for advertising or to build behavioural profiles.

4. Data handled when a HubSpot account connects

The following table describes the principal records used by the connected app.

To complete a connection and launch the builder, the app also uses a signed connection-receipt cookie valid for 5 minutes and a signed generator-session token valid for 10 minutes. These are security credentials, not advertising identifiers.

When Team Health is opened, the app reads names, work email addresses, activation status, and job title where a user has set one, from HubSpot - to render the roster for an authorised super admin, to leave deactivated users out of it, and to calculate aggregate rollout totals. Those roster fields are processed in memory and are not written to the IV-Lead application database.

When you open the builder from inside HubSpot, your own name, work email address, job title where set, and - where your HubSpot plan and account permit the optional permission in section 8 - your own personal meeting link are prefilled as editable defaults so you do not retype them. Only your own record is read; the prefill never contains a colleague's details. Every field stays editable, the app does not keep them in sync with HubSpot, and changing them here does not change them in HubSpot.

Saving a personal signature is a deliberate act. Personal signature drafts are not saved while you edit or preview them. Sharing a team design is a separate administrator action that stores organisation records as described above. When you copy a finished signature from a connected HubSpot session, that signature is saved to your account so you can reopen it later; you can keep up to five, rename them, and delete any of them at any time from the builder. A shared team design opens as a private preview filled with your own available details; you choose its language and check the details before saving a personal copy. "Add my team signature" saves one editable personal copy in the language you selected and uses one of your five slots; the other language is a separate click and a separate slot. If your library is full, you cannot add another copy, and existing copies are not deleted or replaced to make room. You may still review and update an existing copy without using another slot. When the team design changes later, your copy stays as it is until you review the update; "Update my copy" updates that language's copy with the values you review and confirm, preserving your own edits in the proposed update, and "Save as new" uses another slot. If you delete a copy, it is not re-created for you; you may add it again. The signature field payload is encrypted with the same key that protects the HubSpot access tokens; the separately stored library label and metadata are described above. The app shows the saved content only to you, through a verified session for your own HubSpot account ID and user ID. Siglane gives a super admin no function to view another person's saved signature content; a super admin sees rollout status and, for team designs, counts. The public generator saves nothing.

5. What we do not store or access

• No signature content stored by the public generator. Used without a HubSpot connection, the app saves nothing you type. In a connected HubSpot session, signature fields are saved only when you deliberately copy or save a signature, including "Add my team signature", only for you, encrypted, up to five at a time, and deletable by you - see section 4. Shared team designs and the IDs of the people they were shared with are separate organisation records described in section 4; they are not personal copies, and no personal copy is created for anyone who has not chosen to add one. Information that a person voluntarily includes in support correspondence is handled as support correspondence under section 12.
• No rendered signature HTML persisted by the application.
• No uploaded signature images. User photos, logos, and banners are referenced by URLs supplied by the user. Generated signatures may also reference contact-icon images supplied by IV-Lead and hosted on IV-Lead's HubSpot-hosted web assets.
• No mailbox access. The app does not access, read, send, scan, or inspect messages or mailboxes.
• No contact, company, or deal records. The app does not request the HubSpot scopes needed to retrieve those objects.
• No tracking pixels. IV-Lead does not insert recipient-specific or message-specific tracking identifiers into the contact-icon URLs and does not use them to measure opens, clicks, or recipients.
• No persisted roster contact fields. The app does not keep a copy of your account's user list. Names, work email addresses, activation status, and job titles read from HubSpot are processed in memory and are not stored as a roster. The app does store HubSpot account and user IDs for access, rollout records and team design assignments; when a super admin shares a design with "all active users", the IDs of the users active at that moment are recorded, not their names or addresses. Where your details appear inside a signature you chose to save, they are stored as part of that saved signature and, for a copy made from a team design, in its encrypted comparison baseline, as described in section 4.
• No analytics, advertising, session-recording, or in-app customer-messaging tools.

6. Remote images in generated signatures

A generated signature can contain remote images: images hosted at URLs supplied by the user and shared contact-icon files hosted for IV-Lead. When a recipient's email client loads a remote image, the relevant image host may receive ordinary request metadata such as the recipient's IP address, user-agent, timestamp, and requested file. Some email clients block or proxy remote images.

IV-Lead's contact-icon URLs are shared static asset URLs and are not unique to an account, user, message, or recipient. IV-Lead does not use image requests to identify recipients or measure engagement. The organisation or user supplying another image URL is responsible for the privacy and availability of that external host.

7. Why we process data and the applicable legal basis

For roster, brand-kit, rollout, saved-signature and team-design data processed on behalf of a connected organisation, as listed in section 2, that organisation determines the legal basis and gives IV-Lead documented instructions. IV-Lead processes the data only to provide, secure, support, and terminate the connected app, as described in the Data Processing Addendum.

Where IV-Lead acts as controller, the purposes and bases are:

• Providing and administering the Service - performance of the Terms and IV-Lead's legitimate interest in operating the Service requested by the user or organisation.
• Recording acceptance of the Terms - performance and administration of the contract and IV-Lead's legitimate interest in retaining proportionate evidence of acceptance.
• Security, fraud prevention, and troubleshooting - IV-Lead's legitimate interest in protecting the Service, connected accounts, users, and IV-Lead.
• Support and privacy correspondence - performance of the Terms, IV-Lead's legitimate interest in supporting users, and compliance with legal obligations.
• Legal compliance and claims - compliance with law and IV-Lead's legitimate interest in establishing, exercising, or defending legal claims.

IV-Lead does not rely on consent for these core activities. Disconnecting stops future HubSpot access but does not replace the rights described in section 15.

For the purposes of Israel's Privacy Protection Law, the data described in this notice is collected and used only for the stated Service, security, support, contractual, and legal purposes and is handled through the providers identified in section 10.

8. The HubSpot permission we request

The app requests two required read-only HubSpot scopes: view users and their permissions (settings.users.read) and view user records (crm.objects.users.read), and one optional read-only scope, read meeting link metadata (scheduler.meetings.meeting-link.read). The optional scope is used for one purpose: to prefill a person's own personal HubSpot scheduling link into their own signature. HubSpot offers it on Professional-tier accounts only; on other plans HubSpot shows the permission as unavailable and it cannot be granted at all. Declining it, or being on a plan that does not offer it, changes nothing else - the app installs and works exactly the same, and that one field is typed by hand instead. The first is used to retrieve the account roster, verify that a caller belongs to the connected account, and verify super-admin status before individual Team Health data, brand-kit changes, or disconnection are permitted. The second is used to tell active users from deactivated ones, so that rollout totals count only people who still work with you, and to read a job title where a user has set one.

No scope the app requests allows it to change users or settings, and none grants access to contacts, companies, deals, marketing email, one-to-one email, or mailboxes. The meeting-link scope is read-only. HubSpot's consent screen describes it as reading "metadata and booking availability information for meeting links" - that is the reach of the permission, and it is deliberately wider than IV-Lead's use of it. IV-Lead calls one endpoint, the list of personal meeting links organised by the person using the builder, and takes a single value from the reply: the web address of the link. Nothing else in that reply is read or stored, no availability or booking endpoint is ever called, and the request is filtered to that person's own links, so it cannot return a colleague's. crm.objects.users.read is a CRM-object scope, but the object it reads is the user record — the people who hold a seat in your account — not contacts, companies, or deals. HubSpot displays the requested permission before the installing user approves the connection. The app manifest also declares HubSpot's baseline oauth scope, which every HubSpot app is granted and which confers no access to data.

9. Strictly necessary cookie and browser credentials

• Connection-receipt cookie: signed, restricted to the connected page, and valid for 5 minutes.
• Generator-session token: signed, held in browser memory, and valid for 10 minutes.
• App-session cookie: set only when you choose Open full app from inside HubSpot, so that the app on IV-Lead's own domain remembers which HubSpot account and user you are. Signed, HttpOnly, Secure, SameSite=Lax, and valid for 7 days. It carries no signature content and is cleared when you sign out.

These credentials are used only for security and navigation. The Service does not use analytics or advertising cookies.

10. Providers, external services, and international handling

• Cloudflare, Inc. - application hosting, database, request handling, security observability, and point-in-time database recovery. The application uses Cloudflare infrastructure and requests may be routed through Cloudflare's global network.
• HubSpot, Inc. - OAuth authentication, the user-roster API, and delivery of IV-Lead-owned contact-icon files hosted in IV-Lead's HubSpot web assets.
• Google LLC - Google Workspace for support and privacy email. Google is not used to deliver the application's font.

IV-Lead is established in Israel, which the European Commission recognises as providing an adequate level of data protection. Providers may process data in additional countries. Where an applicable transfer requires safeguards, IV-Lead relies on the transfer terms and safeguards in the relevant provider agreement, including the European Commission's Standard Contractual Clauses where applicable.

This list reflects the providers and external services used for the Service as of the date above. Changes involving a processor are handled under the Data Processing Addendum.

11. Team Signature Health visibility

Individual Team Health information is limited to a verified HubSpot super admin of the connected account. A super admin can see each roster member's work name, work email address, language, template, and whether the person marked a signature as generated or confirmed as installed. Other verified account users can see aggregate rollout totals only, without names, email addresses, or individual status. For the current version of each team signature design shown in the management panel, a super admin can see how many people are assigned that version and how many currently have a saved copy of it. The assigned count is based on stored assignments, not a live count of active HubSpot users. The app does not show which people added, hid or deleted a copy.

• The status is self-reported. The app cannot inspect a mailbox and does not claim that a signature is actually in use.
• The app does not let any user see another person's saved signature content or the personal fields that person typed into the builder.
• The purpose is to coordinate a company signature rollout. It is not attendance or productivity monitoring and should not be used as such.
• The app presents a short notice before a user first records a rollout status. Before a super admin shares a team design, the app asks them to confirm that they are authorised to share it on behalf of the organisation and that they are responsible for telling the selected colleagues that it has been shared with them and about the related data processing, as described in sections 4 and 11 of this notice; the app records that confirmation (confirmation text version, admin user ID, account, number of recipients and time) without any signature content. The app sends no invitation or email to recipients. When a person opens a design shared with them, the app shows a short line saying that their organisation shared it and recorded them as a recipient, and that opening the preview saves no personal copy. The connected organisation remains responsible for providing any employee notice required by its law, policies, or employment arrangements.

12. Retention

Cloudflare's point-in-time recovery for the application database keeps earlier copies for a rolling period of 7 days, depending on the Cloudflare plan in use (7 days on Workers Free, 30 days on Workers Paid). After live-database deletion, earlier copies may therefore remain in recovery history for up to that further period before ageing out. A restore is a whole-database operation used only for disaster recovery; IV-Lead will reapply completed deletions after any restore. IV-Lead keeps no separate application-database backup outside Cloudflare.

13. Disconnecting and deletion

A HubSpot super admin can disconnect the app from its Settings page. On disconnect:

• the stored refresh token is overwritten and the access token is deleted;
• IV-Lead requests token revocation from HubSpot;
• future access to the HubSpot account is blocked; and
• the account is placed into the deletion workflow described in section 12.

To request earlier deletion of remaining live-database records, email support@iv-lead.com. IV-Lead will verify the request, remove the records it controls, and confirm completion. Recovery copies then age out within the rolling 7-day period described above.

14. Security

• HubSpot OAuth tokens are encrypted before storage using authenticated encryption.
• The application does not intentionally write OAuth token values, signature fields, or rendered signature HTML to its own logs.
• Traffic uses HTTPS.
• OAuth state and builder launch tokens are stored hashed, expire in minutes, and launch tokens are single-use.
• The signature preview runs in a sandboxed frame.
• Customer data is isolated by the account taken from a verified session rather than from browser-supplied account input.
• Automated tests cover tenant isolation, including a simulated cross-tenant replay attempt.

No system is perfectly secure. Suspected vulnerabilities or incidents should be reported to support@iv-lead.com.

15. Your rights and privacy complaints

Depending on the law that applies, you may have rights to access, correct, export, erase, object to, or restrict processing of personal data, and rights concerning solely automated decisions. IV-Lead makes no solely automated decisions about individuals.

Send a request or complaint to support@iv-lead.com. IV-Lead may ask for information reasonably needed to verify identity and authority.

IV-Lead will respond without undue delay. Where EU or UK data-protection rules apply, IV-Lead will normally respond to a rights request within one month and will explain within that first month if a lawful extension is required. IV-Lead does not charge for ordinary rights requests.

If you delete a personal copy made from a team design, its content and its encrypted comparison baseline are removed from the live database at once. Records that hold no signature content but still relate to you (identifiers, version and revision numbers, digests, timestamps and click outcomes) are kept until the account record is erased, so that an old retry cannot re-create the copy. They are pseudonymous, not anonymous, and remain personal data.

For a data-protection complaint, IV-Lead will acknowledge receipt within 30 days, investigate appropriately, keep the complainant informed where needed, and communicate the outcome without undue delay.

If you are in the EEA or UK and remain dissatisfied, you may complain to the relevant supervisory authority. In Israel, you may contact the Privacy Protection Authority.

16. Children

The Service is designed for business and professional use. It is not directed at children, and IV-Lead does not knowingly collect personal data from children through the Service. If you believe a child has provided personal data to IV-Lead, contact support@iv-lead.com.

17. Changes to this notice

If the Service's data practices change, IV-Lead will update this notice and the date above. Where a material change affects connected accounts, IV-Lead will also provide notice through the Service, the associated HubSpot account contact route, or another reasonable channel before the change takes effect where practicable.

18. Contact

Privacy questions, requests, and complaints: support@iv-lead.com.