This policy tells you which information find sign makers collects at www.findsignmakers.com. It also tells you why we collect the information, who processes it for us, and how long we keep it.
The policy covers three groups of people:
- Visitors who browse the directory.
- Buyers who send a quote request or a message.
- Sign manufacturers who register an account or claim a profile.
Read the Terms of Use.
What we collect from visitors
You can browse each directory page without giving us information.
Cloudflare hosts this site. Cloudflare sees the IP address of each request. The site sends that IP address to our application server. The server uses the IP address for two purposes only. It applies rate limits, and it runs the Cloudflare Turnstile anti-abuse check on the contact form. We do not keep your IP address in our database.
We record interaction events. These events show a manufacturer how its listing performs. An event record contains four items only:
- The event type.
- The type of page where the event occurred.
- The manufacturer that the event applies to, when it applies to one.
- The time of the event.
There are five event types: a profile view, a click on a website link, a click on an email address, a click on a telephone number, and the start of a quote request.
An event record contains no IP address, no device information and no identifier that identifies you. A manufacturer sees totals only.
What we collect when you contact a manufacturer
A quote request collects this information:
- Your name.
- Your email address.
- Your telephone number, if you give one.
- The sign type that you want.
- The destination country.
- Your description of the project. This includes the date that you need the sign and any sizes that you give.
You can attach a maximum of five files. Each file can be a maximum of 5 MB, in JPEG, PNG, GIF or PDF format.
We send the quote request to a maximum of three matched manufacturers. Each manufacturer receives an email that contains the information above and links to your attachments. The quote request also shows in that manufacturer's dashboard. We send a confirmation email to you.
We keep attachments in a public storage bucket. A person who has the link to an attachment can open it. Do not attach confidential material.
What we collect when you use the contact form or the newsletter
The contact form collects your name, a reply email address, a topic and your message. Cloudflare Turnstile checks the submission to prevent automated abuse.
When our mail provider accepts the message, we remove your name, your reply address and your message from our database. We keep a delivery receipt that contains no personal information. We delete that receipt after 30 days.
You can select the marketing checkbox on the contact form. We then add your name and your email address to our mailing list in Klaviyo. The newsletter box in the footer adds your email address only. Each marketing email contains an unsubscribe link.
What we collect from manufacturers
Registration collects your email address and a password. A profile claim collects your password and your verification evidence. A profile claim uses the email address that received the invitation.
We hash each password. We do not keep the password that you typed, and we cannot read it. A password change or a password reset ends each of your sessions.
Your public profile contains the business information that you enter:
- Business name, short description and full description.
- Website, business email address and business telephone number.
- Address, city, region, postal code and country.
- Specialities, sign types and qualifications.
- Shipping origins, shipping destinations, shipping distance and freight methods.
- Production time and minimum order.
- Business registration identifier and year established.
- Your profile completeness score and the profile fields that are incomplete.
- Your project gallery.
We publish all of this information. We keep gallery images in a public storage bucket.
Verification evidence
Verification evidence is one of two items. It is a business-domain email address that agrees with the address that received your invitation, or it is a company registry reference.
We encrypt the reference in our database. We exclude it from each API response and from each profile view, public and internal. We never publish it.
The badge decision asks only if an evidence record exists. It never decrypts the reference. Of the verification data, a visitor sees only the badge and the date when we recorded the evidence.
The business registration identifier in your profile is different. It is a profile field, and we publish it with the other profile fields above.
Read the verification criteria.
Payments
Pro is an optional paid subscription for a claimed profile. Stripe processes these payments.
You pay on a page that Stripe hosts. You manage your card and your subscription in the Stripe billing portal. We do not see or keep your card number, its expiry date or its security code. The Stripe JavaScript does not run on this site.
We keep these Stripe references for your profile:
- The customer reference and the subscription reference.
- A billing history of invoice, charge and payment references. Each entry shows the amount, the currency, the status and the date.
The Stripe privacy policy tells you what Stripe does with your payment details. The Terms of Use give the subscription terms.
Paid placement
A Pro subscription changes where a profile shows. We give a maximum of two of the three quote request matches to Pro profiles first. On the hub listing pages we put a publicly verified Pro profile above a publicly verified free profile. Public verification comes before Pro in that order, thus a free profile that keeps its verification can show above a Pro profile that loses it.
Paid placement does not change the verified badge. Verification is free. Evidence and profile completeness decide it. A manufacturer cannot buy a verified badge.
On 13 September 2026 we announced more profile changes for a subsequent release. One of these changes will mark the website link of a Pro profile as a sponsored link. These changes are not live.
Cookies
We set one cookie, sign_directory_session. It contains your manufacturer sign-in token in encrypted form. We set it when you sign in or when you register.
The cookie is HttpOnly, thus no script on the page can read it. It is SameSite=Lax, and it is Secure in production. It expires after 7 days. It expires after 30 days if you selected the option to stay signed in.
We set no advertising cookie and no analytics cookie. This site does not use Google Analytics.
Cloudflare can set its own security cookies, such as __cf_bm, because it protects this site and supplies the Turnstile check. Those cookies are Cloudflare's, and the Cloudflare privacy policy covers them.
Who processes information for us
- Cloudflare serves the site and supplies the Turnstile anti-abuse check.
- Heroku runs our application server, our database and our job queue. Each record in this policy is kept there.
- Amazon Web Services keeps gallery images and quote-request attachments.
- Stripe processes Pro payments.
- Klaviyo sends our newsletter and our marketing email.
- Postmark delivers our transactional email.
- Sentry receives our error reports. An error report contains a correlation identifier, the route, the HTTP method, the error message and a stack trace. We do not put your name, your address or your message text into an error report.
- Google Fonts supplies the site typefaces. Your browser requests them from fonts.googleapis.com and fonts.gstatic.com.
We do not sell your information. We do not give it to advertisers.
How long we keep information
- Contact form messages. We remove the message when the mail provider accepts it. We delete the delivery receipt after 30 days.
- Sign-in sessions. 7 days, or 30 days if you selected the option to stay signed in.
- Repeat-request records. We keep the fingerprint of a submitted form for 24 hours, so that a retry does not record your message twice.
- Quote requests, attachments, interaction events, manufacturer accounts and gallery images. We keep these until you ask us to remove them. We do not run an automatic deletion schedule for this information.
- When we delete a manufacturer profile, we delete the copies of the quote requests that we sent to it and its interaction events. We keep the original quote request record and its attachments until you ask us to remove them.
Your choices
- Ask us for a copy of the information that we hold about you.
- Ask us to correct the information. A manufacturer can correct most of it in the dashboard.
- Ask us to delete the information. We do this manually. Give us the profile URL or the email address that you used.
- Cancel marketing email with the unsubscribe link in the email.
- Report an incorrect listing on the contact page.
Changes to this policy
We update this page when our practices change. We also change the date below.
Contact us
Send an email to legal@findsignmakers.com, or use the contact page.
Last updated: September 2026