Privacy Policy

SIGNBRO FABRICATION LLC ("SignBro," "we," "us," or "our") is a New York limited liability company operating sign-bro.com (the "Site"). This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have to access or delete it.

We comply with applicable U.S. privacy laws including the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), the New York Stop Hacks and Improve Electronic Data Security Act ("NY SHIELD Act"), and - where applicable - the EU General Data Protection Regulation ("GDPR") and UK GDPR.

This policy applies to information collected through the Site, our customer cabinet, our admin chat, our transactional emails, our SMS order updates, and our B2B partner portal. It does not apply to third-party websites that we link to.

Account information you provide: full name, email address, password (stored only as a bcrypt hash), phone number, billing address, shipping address, business details for B2B partners (company name, role, tax ID where requested), and preferred language.

Order information: sign configurations, dimensions, fonts, colors, uploaded reference images, project notes, design previews, production photographs, and order status.

Payment information: payment is processed by Stripe, Inc. For card payments, SignBro receives only the last four digits of the card, the card brand, the Stripe charge / payment-intent identifier, and (where Stripe returns it) the issuing country. We never see, store, or transmit full card numbers, expiration dates, or CVV codes. If you pay over time with Klarna or Afterpay, we receive only the payment method name, the amount, and the Stripe identifiers, not your application, credit decision, or loan terms (see the Paying Over Time section below).

SMS order updates (only if you opt in): the mobile number you gave us, the date and time of your consent, the IP address it came from and where you gave it (checkout or your account Profile), whether you have opted out (STOP) or back in (START), any replies you text to us (these go to our staff), and a log of the order texts we sent you (type of message, delivery status, and time).

Communications: chat messages exchanged with our support and production team, support email correspondence, B2B request descriptions and uploaded drawings.

Automatically collected: Internet Protocol (IP) address, browser user-agent string, device type, pages visited, referring URL, language preference, and session timing. We use these signals for security (rate limiting, fraud detection) and to improve the Site.

Cookies and analytics: essential cookies keep you logged in (session cookie "signbro_token"), remember your language, and hold your cart. We also use Google Analytics 4 to understand site traffic and the Meta (Facebook) Pixel to measure the effectiveness of our Instagram / Facebook advertising. These tools set their own cookies and receive event-level usage data - such as pages viewed, add-to-cart, and purchases - to report on and improve our marketing; they do not receive your name, email, or the contents of your order. Links in our emails can carry your email address or a one-time security token in the web address; these tools do not start and do not record a page view while such details are in the address bar. You can opt out through your browser controls, the Google Analytics opt-out add-on (https://tools.google.com/dlpage/gaoptout), your Meta ad preferences, and the advertising-measurement opt-out in the Your Rights section below. On pages that show a price, we may also load Stripe's script (Stripe.js) to display pay-over-time messages from Klarna and Afterpay. Stripe may set its own cookies (such as __stripe_mid and __stripe_sid) and collect device and browser information for fraud prevention, under its own privacy policy (https://stripe.com/privacy).

To create and operate your account.

To configure, price, fabricate, ship, and install signage you order.

To process payments and prevent fraud (in cooperation with Stripe).

To send transactional emails - order confirmations, quote updates, production progress photos, shipping updates, payment receipts, and password-reset codes.

To send order-update text messages, only if you asked for them (see the Text Messages (SMS) section below).

To respond to your inquiries through chat, email, or the contact form.

To comply with our legal and tax obligations (we are required to keep order and tax records for up to 7 years under New York law).

To improve the Site, the AI Sign Designer, and the configurator based on aggregated and anonymized usage patterns.

To send marketing communications - but only if you opt in. Every marketing email tells you how to unsubscribe, and we honor every request.

When a SignBro customer enters your email address to invite you, we send you that one invitation email with their referral link, and we keep your address so a later signup can be credited to them. Every invitation includes a way to unsubscribe from further invitations. If you unsubscribe, we keep your address on a do-not-email list only so we can honor that request.

We do NOT sell your personal information, and we do NOT share it with data brokers. We use Google Analytics and the Meta Pixel for website analytics and advertising measurement; these receive event-level usage data (not your name, email, or order contents) as described in the Cookies and analytics section above.

We share only the minimum data necessary with the following service providers, each contractually bound to confidentiality:

• Stripe, Inc. - payment processing and, on pages that show a price, the pay-over-time messages described in Cookies and analytics above (https://stripe.com/privacy).

• Google LLC - Google Analytics 4, aggregated website traffic and event analytics (https://policies.google.com/privacy).

• Meta Platforms, Inc. - the Meta Pixel measures the effectiveness of our Facebook / Instagram advertising using events such as page views, add-to-cart, and purchases (https://www.facebook.com/privacy/policy).

• Cloudinary, Inc. - secure storage of uploaded reference images, design previews, and progress photos (https://cloudinary.com/privacy).

• Twilio SendGrid, Inc. - delivery of transactional and verification emails (https://www.twilio.com/legal/privacy).

• Twilio Inc. - delivery of SMS order updates, only if you opt in. Twilio receives your mobile number and the text of each message (https://www.twilio.com/legal/privacy).

• MongoDB Atlas (MongoDB, Inc.) - encrypted database hosting for orders, accounts, and configurations (https://www.mongodb.com/legal/privacy/privacy-policy).

• Vercel, Inc. - website and API hosting (https://vercel.com/legal/privacy-policy).

• Anthropic, PBC - the AI Sign Designer and the automated support-chat assistant send the text you type (for the chat, also the recent messages of that conversation) to Anthropic's Claude API to generate a reply. We do not add your name or email to these requests, but anything you type yourself, such as a phone number or address, is included, so please do not enter sensitive information in the chat (https://www.anthropic.com/legal/privacy).

• Telegram (Telegram Messenger Inc.) - internal notifications to our staff, so we can respond quickly. They may include your name, email address, or phone number, order or request numbers and amounts, the text of messages you send to our team in the live support chat or as a reply to one of our order texts, and the details of a referral payout request (https://telegram.org/privacy).

If you choose to pay over time with Klarna Inc. or Afterpay US, Inc. on the Stripe checkout page, that provider receives the information needed to process your payment and uses it as an independent company under its own privacy policy (see the Paying Over Time section below).

We may also disclose information in response to a valid subpoena, court order, or other legal process; to protect our rights, property, or safety, or that of our customers or the public; or in connection with a merger, acquisition, or sale of all or part of our business (with reasonable notice to affected customers).

All of the categories and disclosures above exclude text-messaging originator opt-in data and consent: that information is not shared with any third parties, except Twilio Inc., which delivers our texts as described in the Text Messages (SMS) section below.

SignBro Order Updates is an optional SMS program. We text you only if you tick the unchecked "Text me order updates at this number" box at checkout or turn on "Text me order updates" in your account Profile. If you opt in at checkout, your consent covers that order and your later orders with us (including orders our team places for you); if you opt in from your Profile, it covers your open and later orders. Either way it lasts until you opt out (reply STOP or switch texts off in your Profile). Consent is not a condition of any purchase. Program terms, including how to opt out, are in the SMS Order Updates section of our Terms of Service.

We use your mobile number and SMS opt-in data only to send the order-status texts you asked for (order received, quote ready, payment received, and production and delivery updates). We do not send marketing texts.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We never sell, rent, or trade mobile numbers or SMS opt-in data. Text-messaging originator opt-in data and consent are not shared with any third parties, except Twilio Inc., which delivers the messages for us under its own confidentiality and data-protection obligations. Your phone number may still appear in our own order tools, including the staff notifications described above, so our team can reach you about your order.

Opting out. Reply STOP to any of our texts, or turn order texts off in your account Profile. We keep a record of the opt-out so that we do not text that number again until you reply START, UNSTOP, or YES, or, if you switched texts off in your Profile, until you switch them back on there. A STOP reply can only be lifted by a START, UNSTOP, or YES reply. Reply HELP for help, or email privacy@sign-bro.com. Message and data rates may apply.

Where offered, you can choose Klarna or Afterpay on the Stripe checkout page to pay over time. These providers receive your payment information only if you choose them there: Stripe then passes them the payment amount and the details needed to process your payment (such as your name, email address, and billing or shipping address), and you give them any further information they ask for directly. The pay-over-time messages shown next to our prices are served by Stripe (see Cookies and analytics above).

Klarna and Afterpay make their own eligibility and credit decisions and use your information under their own privacy policies: Klarna Inc. (https://www.klarna.com/us/privacy/) and Afterpay US, Inc. (https://www.afterpay.com/en-US/privacy-policy). SignBro does not receive your application details, credit score, credit decision, or loan terms; we receive only the payment method name, the amount paid, and the Stripe identifiers of the payment.

Order, invoice, and payment records - 7 years from order completion (New York State tax and accounting recordkeeping requirement).

Account information for active accounts - until you request deletion or your account becomes inactive for more than 36 consecutive months.

Chat messages and B2B requests - until you delete them, close your account, or 3 years after the last activity, whichever comes first.

Audit logs of administrator actions - 7 years for compliance and dispute resolution.

Unsubscribe (do-not-email) records - kept for as long as we send email, so the opt-out keeps working, including after an account is deleted.

SMS consent records and the log of order texts we sent - kept with the order for the order-record period above, as proof that you asked for the texts. SMS opt-out (STOP) records - kept for as long as we send texts, including after an account is deleted, so the opt-out keeps working.

When you delete your account, we hard-delete saved designs, chat history, and B2B requests; we anonymize the customer block of your past orders (we keep order numbers, line items, and amounts for accounting integrity, but unlink them from your name, email, phone number (including the mobile number used for SMS order updates), and address).

Every customer can, at any time, sign in to /cabinet and:

• Update name, phone, email, address, and password from the Profile tab.

• Turn SMS order updates on or off from the Profile tab, where offered (or reply STOP to any text).

• Download a complete JSON export of all data we hold on you (GET /api/auth/me/export).

• Delete the account permanently (POST /api/auth/me/delete with password confirmation).

California residents (CCPA/CPRA) additionally have:

• Right to know what categories of personal information we have collected, the sources, and the business purpose for collection.

• Right to delete personal information, subject to legal exceptions for tax records and ongoing transactions.

• Right to correct inaccurate personal information.

• Right to opt out of "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information. Our use of the Meta Pixel to measure our Facebook / Instagram advertising may be treated as "sharing" under the CPRA, so you can opt out at any time: use the button at the end of this section, or turn on Global Privacy Control (GPC) in your browser - we treat a GPC signal as an opt-out and do not load the Meta Pixel. You can also email privacy@sign-bro.com.

• Right to limit use of sensitive personal information - we do not collect "sensitive personal information" as defined by CPRA.

• Right to non-discrimination for exercising any of the above rights.

EU and UK residents (GDPR / UK GDPR) additionally have:

• Right of access, rectification, and erasure.

• Right to data portability - covered by the JSON export endpoint.

• Right to restrict or object to processing.

• Right to lodge a complaint with your local supervisory authority.

To exercise any right not covered by the cabinet self-service tools above, email privacy@sign-bro.com from the email on file. We respond within 30 days (45 for complex California requests, as allowed by CCPA).

Advertising measurement opt-out (Meta Pixel):

Checking your advertising-measurement setting…

The Site is intended for adult business customers and is not directed at children under 13. We do not knowingly collect information from anyone under 13. If you believe we have inadvertently collected information from a child, please contact privacy@sign-bro.com and we will delete it promptly.

We implement reasonable administrative, technical, and physical safeguards including: TLS encryption for all data in transit, bcrypt password hashing, JWT-based authentication with revocable sessions, hardened HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options), strict rate limiting on authentication endpoints, EXIF stripping on uploaded images, prototype-pollution sanitization on user-supplied JSON, and a tamper-evident audit log of administrator actions.

No security measures are perfect. If you suspect that your account has been compromised, sign in at /cabinet and change your password immediately from the Profile tab, then email security@sign-bro.com.

In the event of a data breach affecting your personal information, we will notify you by email and any applicable regulator within the time frame required by law (in New York, the NY SHIELD Act requires notification "in the most expedient time possible and without unreasonable delay").

Our service providers (Vercel, MongoDB Atlas, Stripe, Cloudinary, SendGrid, Twilio, Anthropic, Google, Meta) and, if you choose them, Klarna and Afterpay host primarily within the United States; Telegram processes data on servers in several countries outside the U.S., and Klarna (part of a Sweden-based group) and Afterpay (part of Block, Inc., with operations in Australia) may also process data outside the U.S. If you access the Site from outside the U.S., your information will be transferred to, stored in, and processed in the United States, where data-protection laws may differ from those in your country.

For transfers from the EU/EEA, the UK, or Switzerland, we rely on the Standard Contractual Clauses adopted by the European Commission and the UK International Data Transfer Addendum, as incorporated into each provider's data-processing agreement.

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page reflects the most recent revision. Material changes will be announced by email to all account holders at least 30 days before they take effect. Continued use of the Site after the effective date constitutes acceptance.

Questions, requests to exercise your privacy rights, or complaints:

SIGNBRO FABRICATION LLC

742 Liberty Ave

Brooklyn, NY 11208

United States

Privacy inquiries: privacy@sign-bro.com

General inquiries: info@sign-bro.com

Security disclosures: security@sign-bro.com