Privacy policy

1. Introduction

This policy explains how Footer365 ("we", "us", "our") collects, uses and protects personal data when you visit our website, sign up for a trial, or use the Footer365 service. We are committed to processing personal data in accordance with the UK GDPR and the Data Protection Act 2018.

2. Who we are

Footer365 is a product of Chillishot Limited, a company registered in England and Wales under company number 06493118, whose registered office is 144 Evesham Street, Redditch, England, B97 4HP. Chillishot Limited is the entity behind this policy, and references to "we" and "us" mean Chillishot Limited trading as Footer365. For the personal data in a customer's directory that we process to deliver the service, the customer is the data controller and we act as a data processor - see our data processing terms. For website visitors and account contacts, we act as the controller.

3. Data we collect

Account and contact data - names, work email addresses, phone numbers, job titles and roles for the owner, accounts and technical contacts you provide at signup.
Organisation and billing data - company name, domain, address, VAT number and payment details (card details are handled by our payment provider; we store only a token and the card's expiry).
Directory data - as a processor, the user and group attributes we sync from your Microsoft directory to build signatures (for example display name, title, phone, photo).
Usage and technical data - server log data and the device and browser information a request carries, used to keep the service running and secure. We do not run third-party analytics or tracking on the website.
Support data - the content of messages you send us.

We do not read or retain the body of your email messages beyond injecting the configured signature.

4. The Outlook add-in

Footer365 Signatures is an optional Microsoft Outlook add-in, deployed centrally by your administrator rather than installed by you. It exists so you can see your signature while you are writing, and it is not required for signatures to be applied: those are added server side as email leaves your organisation whether the add-in is present or not.

When it runs, the add-in:

Signs you in with your existing Microsoft 365 identity using single sign-on. It receives your name, work email address and organisation identifier from Microsoft. It never sees or stores your password.
Reads your directory details and the signatures your administrator has configured, so that the correct signature can be built for you and placed in the message.
Reads the recipients of the message you are composing, to work out whether your internal or external signature applies. Only the domain part of those addresses is sent to us, for example example.com, and never the addresses themselves. It also sends the address you are sending from, so that the right mailbox's signature is returned.
Writes the signature into the message you are composing.
Records that a signature was applied, so your administrator can see coverage and diagnose a signature that did not appear. That record holds the sending address and which template and rule applied. It does not hold recipients, or anything about the message itself.

The add-in does not read your mailbox, does not read the content of the message you are writing, and does not collect message subjects, attachments or history. It never prevents a message from being sent: if it cannot run or cannot reach us, the message sends as normal and the signature is added server side instead.

On Microsoft 365 the add-in is governed by the permissions your administrator consented to, and your administrator can remove it at any time from the Microsoft 365 admin centre.

5. How we use it

We use personal data to provide and secure the service, create and bill accounts, send transactional messages (setup links, invoices, renewal and card-expiry notices), provide support, improve the product, and meet legal obligations.

6. Legal bases

We rely on: performance of a contract (to deliver the service you sign up for); legitimate interests (to run, secure and improve our business, and for limited marketing to business contacts); consent (where required, for example certain cookies); and legal obligation (for example accounting records).

We share personal data with vetted sub-processors that help us run the service (hosting, payments, email delivery, server monitoring and security), listed on our sub-processors page. We may disclose data where required by law. We do not sell personal data.

8. International transfers

You can choose the region where your data is processed, including UK and EU options. Where data is transferred outside the UK or EEA, we use appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

9. Retention

We keep personal data only as long as needed for the purposes above and to meet legal, accounting or reporting requirements. Directory data is retained while your subscription is active and deleted after offboarding. Billing records are kept for the period required by law.

10. Your rights

Subject to conditions, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise a right, contact us using the details below. You may also complain to the UK Information Commissioner's Office (ICO).

11. Cookies

We use cookies and similar technologies as described in our cookie policy.

12. Security

We apply technical and organisational measures to protect personal data, including encryption in transit and at rest, least-privilege access and audit logging. See our security page.

13. Changes

We may update this policy from time to time. Material changes will be notified through the service or on this page, with the "last updated" date revised.

14. Contact

For any privacy question or to exercise a right, email [email protected] or use our contact page.