Privacy Policy

You can browse each directory page without giving us a name or an email address.

Cloudflare hosts this site. Cloudflare sees the IP address of each request. The site sends that IP address to our application server. The server uses the IP address for two purposes only. It applies rate limits, and it runs the Cloudflare Turnstile anti-abuse check on the contact form. We do not keep your IP address in our database.

Google Tag Manager loads on every page. Google receives the page URL, the referrer and the device information that the browser sends with that request. Tags that we configure in Tag Manager may send further page-view information to Google for analytics and advertising measurement.

We record interaction events. These events show a manufacturer how its listing performs. An event record contains four items only:

• The event type.
• The type of page where the event occurred.
• The manufacturer that the event applies to, when it applies to one.
• The time of the event.

There are five event types: a profile view, a click on a website link, a click on an email address, a click on a telephone number, and the start of a quote request.

An event record contains no IP address, no device information and no identifier that identifies you. A manufacturer sees totals only.

A quote request collects this information:

• Your name.
• Your email address.
• Your telephone number, if you give one.
• The sign type that you want.
• The destination country.
• Your description of the project. This includes the date that you need the sign and any sizes that you give.

You can attach a maximum of five files. Each file can be a maximum of 5 MB, in JPEG, PNG, GIF or PDF format.

We send the quote request to a maximum of three manufacturers. If you send it from a manufacturer's profile, that manufacturer is always one of the three. Each manufacturer receives an email that contains the information above and links to your attachments. The quote request also shows in that manufacturer's dashboard. We send a confirmation email to you.

We keep attachments in a public storage bucket. A person who has the link to an attachment can open it. Do not attach confidential material.

The contact form collects your name, a reply email address, a topic and your message. Cloudflare Turnstile checks the submission to prevent automated abuse.

When our mail provider accepts the message, we remove your name, your reply address and your message from our database. We keep a delivery receipt that contains no personal information. We delete that receipt after 30 days.

You can select the marketing checkbox on the contact form. We then add your name and your email address to our mailing list in Bento. The newsletter box in the footer adds your email address only. Each marketing email contains an unsubscribe link.

Registration collects your email address and a password. A profile claim collects your password and your verification evidence. A profile claim uses the email address that received the invitation.

We hash each password. We do not keep the password that you typed, and we cannot read it. A password change or a password reset ends each of your sessions.

Your public profile contains the business information that you enter:

• Business name, short description and full description.
• Website, business email address and business telephone number.
• Address, city, region, postal code and country.
• Specialities, sign types and qualifications.
• Shipping origins, shipping destinations, shipping distance and freight methods.
• Production time and minimum order.
• Business registration identifier and year established.
• Your profile completeness score and the profile fields that are incomplete.
• Your project gallery.

We publish all of this information. We keep gallery images in a public storage bucket.

Verification evidence is one of two items. It is a business-domain email address that agrees with the address that received your invitation, or it is a company registry reference.

We encrypt the reference in our database. We exclude it from each API response and from each profile view, public and internal. We never publish it.

The badge decision asks only if an evidence record exists. It never decrypts the reference. Of the verification data, a visitor sees only the badge and the date when we recorded the evidence.

The business registration identifier in your profile is different. It is a profile field, and we publish it with the other profile fields above.

Read the verification criteria.

Pro is an optional paid subscription for a claimed profile. Stripe processes these payments.

You pay on a page that Stripe hosts. You manage your card and your subscription in the Stripe billing portal. We do not see or keep your card number, its expiry date or its security code. The Stripe JavaScript does not run on this site.

We keep these Stripe references for your profile:

• The customer reference and the subscription reference.
• A billing history of invoice, charge and payment references. Each entry shows the amount, the currency, the status and the date.

The Stripe privacy policy tells you what Stripe does with your payment details. The Terms of Use give the subscription terms.

A Sign Customiser Store owner can ask to link your listing, to include Pro with their subscription. We send you a one-time link by email. The link starts only when you agree.

We keep these items for a link:

• The Store that your listing is linked to, and the date that the link started.
• A request that waits for your answer. It holds the Store that asked, a secure hash of the one-time link and the expiry date. We do not keep the one-time link itself.
• A record of each request, acceptance, refusal and removal, with its date.

You see the linked Store in your dashboard. The people who manage that Store in the Sign Customiser admin see your listing. Our staff can see the link. We do not show the link on your public profile.

You or the Store owner can remove the link at any time. Pro that the link includes stops immediately.

A Pro subscription changes where a profile shows. We give a maximum of two of the three quote request matches to Pro profiles first. On every listing page we put a publicly verified Pro profile above a publicly verified free profile. Public verification comes before Pro in that order, thus a free profile that keeps its verification shows above a Pro profile that loses it.

Paid placement does not change the verified badge. Verification is free. Evidence and profile completeness decide it. A manufacturer cannot buy a verified badge.

The website link on a Pro profile is a followed (dofollow) link. Links on free profiles are nofollow. A public profile shows the project gallery, the email address and the telephone number only when the profile has Pro.

We set one cookie, sign_directory_session. It contains your manufacturer sign-in token in encrypted form. We set it when you sign in or when you register.

The cookie is HttpOnly, thus no script on the page can read it. It is SameSite=Lax, and it is Secure in production. It expires after 7 days. It expires after 30 days if you selected the option to stay signed in.

Google Tag Manager may set analytics or advertising cookies, depending on the tags that we have configured. Google's privacy policy covers those cookies.

Cloudflare can set its own security cookies, such as __cf_bm, because it protects this site and supplies the Turnstile check. Those cookies are Cloudflare's, and the Cloudflare privacy policy covers them.

• Cloudflare serves the site and supplies the Turnstile anti-abuse check.
• Heroku runs our application server, our database and our job queue. Each record in this policy is kept there.
• Amazon Web Services keeps gallery images and quote-request attachments.
• Stripe processes Pro payments.
• Bento sends our newsletter and our marketing email.
• Postmark delivers our transactional email.
• Sentry receives our error reports. An error report contains a correlation identifier, the route, the HTTP method, the error message and a stack trace. We do not put your name, your address or your message text into an error report.
• Google Tag Manager loads on every page. Google receives the page URL, the referrer and the device information that the browser sends with that request.

We serve the site typefaces from our own domain. Your browser does not request them from a third party.

We do not sell your information. Google Tag Manager may send page-view information to Google for analytics and advertising measurement.

• Contact form messages. We remove the message when the mail provider accepts it. We delete the delivery receipt after 30 days.
• Sign-in sessions. 7 days, or 30 days if you selected the option to stay signed in.
• Repeat-request records. We keep the fingerprint of a submitted form for 24 hours, so that a retry does not record your message twice.
• Quote requests, attachments, interaction events, manufacturer accounts and gallery images. We keep these until you ask us to remove them. We do not run an automatic deletion schedule for this information.
• When we delete a manufacturer profile, we delete the copies of the quote requests that we sent to it and its interaction events. We keep the original quote request record and its attachments until you ask us to remove them.

• Ask us for a copy of the information that we hold about you.
• Ask us to correct the information. A manufacturer can correct most of it in the dashboard.
• Ask us to delete the information. We do this manually. Give us the profile URL or the email address that you used.
• Cancel marketing email with the unsubscribe link in the email.
• Report an incorrect listing on the contact page.

We update this page when our practices change. We also change the last-updated date at the top of this page.

Send an email to support@signcustomiser.com, or use the contact page.