Privacy Policy

Account data: name, email address, phone number, profile photo, and role (agent or driver).

Agent data: brokerage name, office address, MLS ID (if provided), sign style preferences, and delivery history.

Driver data: vehicle make/model/year, driver's license (for background check), Stripe Express account details, GPS location during active deliveries, and delivery photos.

Payment data: payment method tokens (stored by Stripe — we never store raw card numbers), payout history, and earnings records.

Usage data: pages visited, feature interactions, device type, browser, and IP address.

• To match Agents with available Drivers for delivery requests
• To process payments and driver payouts via Stripe
• To conduct background checks through our third-party provider
• To send in-app, email, and SMS notifications about delivery activity
• To comply with tax reporting obligations (1099-NEC for qualifying Drivers)
• To detect fraud and enforce our Terms of Service
• To improve Platform features and performance

Drivers' GPS coordinates are recorded during active delivery checklists to verify sign placements. Location data is stored with each placement record and is visible to the Agent who posted the delivery request. We do not track Driver location continuously outside of active delivery sessions.

Agents' office addresses are used to calculate proximity for delivery matching and are visible to Drivers who accept their delivery requests.

We share information only as described below:

• Between users: Agents can see Driver profiles, ratings, and delivery photos for deliveries they posted. Drivers can see Agent name and property address for gigs they accept.
• Stripe: Payment and identity data required to process transactions and conduct KYC for Stripe Express accounts.
• Stripe: Driver identity verification data (SSN, document images) for KYC compliance via Stripe Identity — handled directly by Stripe.
• Twilio / Resend: Phone number and email address for notification delivery. These providers do not use your data for their own marketing.
• Legal compliance: We may disclose information if required by law, court order, or to protect the rights and safety of users or the public.

We do not sell personal information to third parties.

We retain each category of data for the minimum period required for the stated purpose, then delete or anonymise it:

Automated deletion is enforced in our database via scheduled jobs. To request manual deletion of your account and all associated data, email privacy@signstops.com — we will respond within 30 days. Note that data required for tax or legal compliance cannot be deleted before the applicable retention period expires.

We use the following types of browser storage:

• Strictly necessary: Authentication tokens stored by Supabase in localStorage to keep you logged in. These cannot be disabled without breaking login.
• First-party analytics: Before you answer the cookie banner we count an anonymous page view (page path only, no identifier). If you choose “Accept all” we also record page views, UTM campaign tags, product events (for example, sign-up steps) and Core Web Vitals in our own database. If you decline, none of this is recorded.
• PostHog product analytics (optional): We may use PostHog (posthog.com, US hosting) to understand how the product is used. It runs only on SignStops pages, never records sessions or autocaptures input, and stores cookies or local storage only after you choose “Accept all.” Until you choose “Accept all” it isn’t loaded and nothing is sent to PostHog; if you decline, or your browser sends Global Privacy Control, it is never loaded.
• SignTaps retargeting pixels (agent-configured): On a SignTaps sign page (the page a buyer opens by scanning an agent’s sign), the listing agent may add a Meta, LinkedIn or Pinterest pixel. These load only after the visitor chooses “Accept all” on that page, and never when Global Privacy Control is on. When they load, the ad platform receives the visit (including your IP address and browser details) and the agent can use it to show you ads for that listing. SignStops does not receive anything back from these platforms.

Apart from the agent-configured SignTaps pixels above, SignStops does not use advertising cookies or cross-site trackers. You can change your choice at any time with “Manage cookie preferences” below, or by emailing privacy@signstops.com.

Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as an opt-out: optional analytics, PostHog and SignTaps pixels stay off, regardless of any earlier cookie choice on that browser.

Depending on your state of residence, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your data (subject to legal retention requirements)
• Opt out of non-essential analytics
• Data portability (receive a copy of your data in a machine-readable format)

To exercise these rights, email privacy@signstops.com. We will respond within 45 days.

We do not sell your personal information. The only “sharing” for cross-context behavioral advertising under the CPRA is the optional, consent-gated SignTaps retargeting pixel described in Section 6, which an agent may add to a sign page. You can opt out of it as described in Section 12.

Your CPRA rights:

• Know what personal data we collect and how we use it (this policy)
• Correct inaccurate personal information we hold about you
• Request deletion of your personal data (subject to legal retention requirements)
• Data portability — receive a copy of your data in a machine-readable format
• Non-discrimination — exercising privacy rights will not affect your access to the Platform

Sensitive Personal Information (CPRA §1798.121)

We collect the following categories of Sensitive Personal Information (SPI) solely to deliver our core service. We do not use SPI for advertising, profiling, or secondary purposes beyond what is necessary to perform the Platform's functions:

• Precise geolocation — used to route delivery drivers to sign installation addresses
• Government ID (driver's license) — used to verify driver identity and eligibility to work
• SSN / EIN preference flag — used solely to select the correct 1099 tax form type
• Financial account data — held by Stripe; only card brand and last 4 digits are stored

Biometric information. SignStops itself does not collect, store or process biometric identifiers. Two features involve biometrics handled by others:

• Driver identity verification (Stripe Identity): drivers take a selfie that Stripe compares with the photo on their government ID. Stripe performs the face matching and keeps the images under its own privacy policy; SignStops receives the verification result, not a face template.
• Face ID / Touch ID / fingerprint sign-in (mobile app, optional): this uses your phone’s built-in biometric unlock. The check happens on your device; SignStops never receives your fingerprint or face data.

You have the right to limit our use of your SPI to what is necessary for the service. Because we do not use SPI beyond service delivery, this right is automatically satisfied. If you believe we are using your SPI beyond these purposes, email us or use the "Limit My Sensitive PI" control in your Driver Settings (Privacy tab) to flag your preference for our review. The control is also accessible at the bottom of this page.

Automated Decision-Making Technology (ADMT) — CPPA Regs effective Jan 1, 2026

SignStops uses an automated gig-matching feature ("auto-approve") that may automatically accept a driver's work offer without manual agent review. This constitutes Automated Decision-Making Technology (ADMT) under California's CPPA regulations because it affects a driver's access to economic opportunity.

What it does: When a property's auto-approve setting is enabled, the Platform automatically accepts the first qualifying offer submitted. No human reviews the decision before acceptance.

Your opt-out right: California residents (and all users) may opt out of automated matching at any time. When opted out, all your offers are routed to manual agent review, regardless of the property's setting. This may reduce the speed at which your offers are accepted but does not affect your ability to use the Platform.

To opt out: go to Driver Settings → Privacy tab and toggle "Opt out of automated gig matching." You can opt back in at any time. Logged-in drivers can also toggle this preference at the Privacy Settings page.

To submit any verifiable privacy request, email privacy@signstops.com from the address associated with your account. We will respond within 45 days.

Virginia residents have similar rights under the Virginia Consumer Data Protection Act, including the right to correct inaccurate data, opt out of automated profiling that produces legal or similarly significant effects, and to appeal our response to a privacy request. Contact privacy@signstops.com to exercise these rights.

We use industry-standard measures including TLS encryption in transit, row-level security on our database, and access controls to protect your information. Payment data is handled exclusively by Stripe and is never stored on our servers.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@signstops.com.

The Platform is not directed to children under 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, please contact us immediately.

We may update this Privacy Policy from time to time. Changes take effect when the updated policy is posted on this page, and the "Last updated" date at the top reflects the most recent change.

Do Not Sell or Share My Personal Information (CPRA §1798.120)

We do not sell personal information. SignTaps retargeting pixels (Section 6) may count as “sharing” for cross-context behavioral advertising, and they are off unless you choose “Accept all.” To opt out at any time: (1) choose “Decline” on the cookie banner, or use “Manage cookie preferences” below and decline; (2) turn on Global Privacy Control in your browser, which we honor automatically; or (3) email privacy@signstops.com. Opting out doesn’t affect your use of SignStops.

Limit My Sensitive Personal Information (CPRA §1798.121)

If you are a driver, you can flag a preference to limit secondary uses of your sensitive PI (precise GPS, government ID) in Driver Settings. Because we only use SPI for service delivery, this flag triggers a manual review of your account to confirm compliance. Logged-in drivers: use the button below or go to Driver Settings → Privacy.

Opt out of automated gig matching (ADMT)

Logged-in drivers can opt out of the auto-approve gig-matching feature at any time. Driver Settings → Privacy.

Analytics cookies are optional. Update your preference at any time:

Privacy questions or data requests: privacy@signstops.com

Related documents: Terms of Service · Data Processing Agreement · Security