Privacy Policy

Signage Me Up ("SMU," "we," "us") is a CRM and brokerage marketplace for sign shops (design, build, and install). This Privacy Policy explains what we collect, how we use it, and the choices you have. It is written in plain English for shop owners and teams — not legal theater.

1. Who this covers

This policy applies to the Signage Me Up website and app at signagemeup.com, including company accounts, CRM data, brokerage listings and bids, vendor profiles, and related support channels. Gallardo Signs operates Signage Me Up; customer CRM data belongs to each shop's company account, not to other shops.

2. Information we collect

• Account & company: name, email, phone, business name, address, website, capabilities (design / build / install), role, and password (stored hashed — we never store plaintext passwords).
• CRM & job data: customers, leads, quotes, sales orders, invoices, payments records, vendors, workflow cards, time clock punches, files you upload, and related notes — scoped to your company.
• Brokerage: job listings you publish, bids, award decisions, and messages between posting shops and bidding vendors.
• Payments: billing and payout status via Stripe (subscriptions, job payments, Connect vendor payouts). We do not store full card numbers, CVV, or bank account numbers on our servers — Stripe handles card and bank data.
• Technical: IP address, browser/device info, session cookies, and basic usage logs needed to run and secure the service.
• Support: messages you send via contact forms, in-app chat, or email.

3. How we use information

• Provide CRM, brokerage, billing, and vendor tools you signed up for.
• Authenticate sessions, prevent abuse, and investigate security incidents.
• Send transactional email (bids, job updates, billing, security notices).
• Improve product reliability and features (aggregated / de-identified where practical).
• Comply with law and enforce our Terms of Service.

We do not sell your personal information. We do not use your private CRM customer lists to market Signage Me Up to those customers.

4. Brokerage visibility

Public brokerage listings only show details you choose to publish for bidding. Bid amounts and private notes are limited to the posting company and the relevant bidding shop. Other shops cannot see your internal CRM work orders, margins, or client contact lists through the brokerage feed.

5. Payments (Stripe)

Subscriptions, job payments, and vendor Connect payouts are processed by Stripe. Card and bank details are entered in Stripe-hosted fields or Checkout; Signage Me Up stores Stripe customer / account / payment intent identifiers and status — not raw card data. Stripe's own privacy policy applies to data Stripe processes as a payment provider.

6. Cookies & sessions

We use essential session cookies (NextAuth) to keep you logged in. "Remember me" extends session lifetime for shop convenience; passwords are never stored in the browser. We may remember your login email locally when you opt in. We do not use third-party advertising trackers as part of the core product experience.

7. Sharing

We share data only as needed to run the service:

• Stripe (payments & Connect)
• Hosting / database providers (e.g. Vercel, Neon) under contract
• Email delivery providers for transactional mail
• Other shops, only when you publish listings, place bids, or message them
• Law enforcement or regulators when legally required

8. Retention & your data

We retain account and CRM data while your company account is active. You can update profile and notification settings after login. For account closure, data export, or privacy questions, contact us. You remain responsible for backing up critical business files you upload (see Terms).

9. Security

We use HTTPS, hashed passwords, session cookies with secure flags in production, and company-scoped access for CRM APIs. No system is perfect — report suspected incidents to support@signagemeup.com. Signage Me Up is not SOC 2 certified at this time; we are building toward stronger formal controls (see our internal security checklist).

10. Children

The service is for business users who can form contracts (typically 18+). We do not knowingly collect information from children.

11. Changes

We may update this policy by posting a new version on this page with an updated date. Continued use after changes means you accept the updated policy.

12. Contact

Privacy questions: support@signagemeup.com or Contact Us. Related: Terms of Service.