1. Who We Are and What This Policy Covers
Signature Detailing Ltd. ("Signature Detailing", "we", "us") is a company incorporated in British Columbia. We provide Signature Suite (the "Service"), shop-management software for auto-detailing and vehicle-service businesses ("Subscribers"). This United States policy applies to businesses and visitors in the United States, including through signaturesuite.app.
This Policy explains how we collect, use, disclose and protect personal information in connection with the Service, including under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other applicable U.S. state privacy laws.
This Policy covers the Service only. It does not cover a Subscriber's own privacy practices. Customers of Signature Detailing's own detailing shop are covered by a separate privacy notice.
2. Our Two Roles
| Information | Who is responsible | Our role |
|---|---|---|
| A Subscriber's customers (End Customers): names, contact details, vehicles, bookings, estimates, jobs, payment references | The Subscriber | Service provider or processor: we process it on the Subscriber's behalf and only on its instructions |
| Subscriber staff accounts, Subscriber business contacts, subscription billing, Open Beta applications, support requests | Signature Detailing | The business responsible for that information |
Under applicable U.S. state privacy laws, the Subscriber is the business responsible for its End Customers' personal information, and Signature Detailing acts as its service provider or processor. Our commitments as a service provider are set out in Section 9 of our Terms of Service.
If you are a customer of a shop that uses the Service, that shop decides what information it collects about you and how it uses it. Please contact the shop first with questions or requests about your information. We will help the shop respond.
3. Information We Collect
3.1 Subscriber staff (Authorized Users)
- Name, business email, role, and sign-in and multi-factor authentication (MFA) data handled through our identity provider, WorkOS.
- Activity records in the Service, such as which user created or changed a record, and when.
3.2 Subscriber business and billing information
- Business name, contact details and plan. Subscription payments are processed by Stripe. We receive payment status and references, not full card numbers.
3.3 Open Beta and other applications
- When you apply for Open Beta or otherwise inquire about the Service, we collect the business legal name, contact name, email address, phone number, country, state or province, business license number, business tax ID (EIN for U.S. applicants, or an equivalent business tax number if you apply from another country), number of bays or staff, plan interest and, if you choose to provide it, current software.
We do not collect Social Security numbers, government-issued photo identification, or copies of identity documents. Application forms do not ask you to upload an ID or similar document.
3.4 End Customers of Subscribers
- Name, phone number, email address, mailing or service address, and notes the shop records.
- Vehicle information, such as year, make, model, color, license plate and VIN.
- Booking, estimate, job and service details, scheduling, photos of vehicles, inspection notes and feedback.
- Payment metadata for deposits and payments: amounts, status and Stripe references. Card payments are entered on Stripe-hosted pages through the Subscriber's own Stripe account. The Service does not receive or store card numbers.
- Online booking information: when an End Customer books online, the information entered in the booking form (name, phone number, email address, vehicle details, requested service, preferred date and time, and any notes) and how they reached the page, such as the referring page and campaign parameters.
3.5 QuickBooks Online data
If a Subscriber chooses to connect its own QuickBooks Online (US) company, the Service accesses that company through the QuickBooks Online Accounting API. It reads company information and reference lists (customers, items, tax codes, accounts and payment methods) and creates invoices and payment records from completed jobs. These records can include End Customer names and contact details. We store an encrypted connection token and company identifier for that Subscriber only.
4. How We Use Information
- To provide the Service to Subscribers on their instructions, including bookings, estimates, jobs, scheduling, deposits and the QuickBooks Online connection.
- To send service-related messages on a Subscriber's behalf, such as booking confirmations, estimates and reminders, where the Subscriber uses those features.
- To create and secure accounts, verify identity at sign-in (including MFA), and prevent fraud and misuse.
- To review Open Beta and other applications, contact applicants, and set up accepted shops.
- To bill subscriptions, provide support and communicate with Subscribers about the Service.
- To maintain, troubleshoot and improve the Service, and to meet legal, accounting and tax obligations.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use End Customer information for our own marketing. We may create aggregated or de-identified information about use of the Service, which we use only to operate and improve the Service. We never sell it, and we never use it to identify a Subscriber, an individual or an End Customer.
5. How We Disclose Information
We disclose personal information to the service providers listed in Section 6, to a Subscriber when the information belongs to that Subscriber's account, and as needed to provide the Service. We may also disclose information where required or permitted by law, or in connection with a merger, reorganization or sale of our business, subject to appropriate protections.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA.
6. Service Providers and International Transfers
We use the following service providers to run the Service. They may access personal information only to perform services for us, and we require them to protect it.
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, application servers and database; website delivery and security |
| WorkOS | Staff sign-in and multi-factor authentication |
| Stripe | Subscription billing for the Service; Stripe-hosted payment pages for deposits and payments taken through each Subscriber's own Stripe account |
| Intuit (QuickBooks Online) | The accounting connection a Subscriber chooses to make to its own QuickBooks Online (US) company, under the Subscriber's own agreement with Intuit |
Some of our service providers, and Signature Detailing itself, may store or process information outside the United States, including where Signature Detailing Ltd. is incorporated. While it is outside the United States, the information is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities.
7. Security Safeguards
We protect personal information with safeguards appropriate to its sensitivity, including:
- mandatory multi-factor authentication for all staff sign-ins;
- logical separation of each Subscriber's data, so one Subscriber cannot access another Subscriber's records or connected accounts;
- encryption of QuickBooks Online connection tokens on our servers. Tokens are never sent to the browser, and disconnecting revokes only that Subscriber's connection;
- payment card details handled only on Stripe-hosted pages;
- encryption in transit (HTTPS), and access limited to personnel who need it.
No method of storage or transmission is completely secure. We do not currently hold independent security certifications (such as SOC 2).
8. Cookies, Analytics and Advertising
This website and the Service use cookies and similar technologies that are strictly necessary, including to remember your theme preference, keep you signed in and protect the Service.
We do not currently place our own analytics or advertising cookies on this website, and we do not place our own analytics or advertising tags on Subscribers' booking pages.
9. Retention
We keep personal information only as long as needed for the purposes described in this Policy or as required by law:
| Category | Retention |
|---|---|
| Subscriber Data (including End Customer information) | While the Subscriber's account is active and for 30 days after cancellation, so the Subscriber can export it; then deleted or de-identified |
| Billing, accounting and tax records | As required by applicable law, typically up to 7 years after the end of the tax year they relate to |
| Authorized User account and audit records | While the account is active and for 1 year after it is closed |
| Open Beta and sales applications | While we review them and for 2 years after we close the request, unless we open an account |
| Support correspondence | 2 years |
Backups expire within 30 days. Information we must keep for legal, accounting or tax reasons is kept for the period the law requires.
10. Your Privacy Rights
Residents of California and of other states with consumer privacy laws may have some or all of the following rights, subject to legal exceptions:
- Access or know: to request the personal information we have collected about you, including the categories of information and the purposes for which we use it.
- Correction: to ask us to correct inaccurate personal information.
- Deletion: to ask us to delete personal information we hold about you.
- Opt out of sale or sharing: to opt out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- Limit the use of sensitive personal information: where the law gives you this right. We use sensitive information only as needed to provide the Service and review applications (for example a business tax ID or account login data). We do not use it to infer characteristics about you.
- Non-discrimination: we will not deny the Service, charge a different price, or provide a different quality of service because you exercised a privacy right, except as the law allows.
You may also designate an authorized agent to make a request on your behalf. We will need to verify the agent's authority and your identity.
To make a request, email or write to the privacy contact in Section 14. We will verify your request using the contact or account information we already have, such as your email address. We will not ask you to upload a government-issued ID or other identity document. We will respond within 45 days, or longer if the law allows and we let you know. If we cannot fully grant a request, we will explain why.
If your information is held on behalf of a shop that uses the Service, we will forward your request to that shop within 5 business days and help it respond.
These rights also reflect, as applicable, similar rights under other U.S. state privacy laws. Where a state law gives you a right that this Policy does not describe in the same words, we will honor that right as the law requires.
11. Breach Notification
If a breach of security involving personal information under our control requires notice under applicable law, we will notify affected individuals and, where required, regulators or state attorneys general.
If a breach affects information we hold on behalf of a Subscriber, we will notify that Subscriber without unreasonable delay, with a target of 72 hours after we confirm the breach. The notice will describe what happened, the information involved, the steps we have taken and a contact person, so the Subscriber can meet its own obligations. We follow a written incident-response plan.
12. Children
The Service is a business tool and is not directed at children. We do not knowingly collect personal information from children under 13.
13. Changes to this Policy
We may update this Policy. We will post the updated version with a new "Last updated" date. For material changes, we will also notify Subscribers by email at least 30 days before the change takes effect, where practical.
14. Contact and Complaints
Our privacy contact, who is responsible for our compliance with this Policy:
Drew Thomas, Signature Detailing Ltd., #4-3131 Delta Street, Victoria, BC V8Z 1A6. Email: Drew@signaturedetailing.ca
If you are not satisfied with our response, you may contact your state attorney general or, where applicable, your state privacy regulator.