Privacy policy

1. Who we are

Signborn is a brokerage platform that connects independent sign makers with clients (sign and advertising agencies and businesses). Signborn is not an employer, staffing agency, insurer or payment service provider.

Controller: Solano Sign and Print, general partnership (vennootschap onder firma), trading as Signborn. Pletterijkade 8, 2515 SE The Hague, the Netherlands. Registered with the Netherlands Chamber of Commerce under number 75803933. VAT identification number NL860401820B01.

Privacy contact: hello@signborn.com

2. What data we process

Account (everyone):

• Email address, postcode, role (sign maker or client), language preference
• Password if you set one (stored encrypted)
• How you found us: an invitation or referral link, and, only if you accept cookies, the referring website and campaign parameters
• Which agreements you accepted, with name, time and version

Independent sign maker:

• Name, phone number, address, work radius, specialisations, experience, equipment, portfolio
• Certificates and your liability insurance policy with its end date (uploads, visible only to you and Signborn). Clients only see whether your insurance is valid.
• Chamber of Commerce number, VAT number, IBAN and invoice details
• Date of birth, if you enter it (needed for the statutory report of platform income, see section 4)
• Rate and availability; optionally a link to your Google Calendar

Client:

• Company name, contact person, Chamber of Commerce number, VAT number, billing address
• Jobs, including location and description

Invited by a client:

• Your name and email address, as the client entered them

During a job:

• Applications, selections and chat messages
• GPS location and time at check-in and on delivery photos
• Hours worked, travel time, kilometres, extra costs and receipts
• Objections and the messages about them
• Reviews and the Trust Score (see section 5)
• Invoices

Lounge (only if you post there):

• Your posts, photos, replies and likes. Other sign makers see them with your name. In the lounge for clients, other clients see your company name.

End customer on site (at delivery):

• Name, signature, time and GPS location. This person sees a short notice on screen before signing.

Technical and security:

• IP address, browser and device at login, to detect abuse and logins from an unknown device
• Error reports, without IP address, email address, cookies or login details
• Push notifications, if you switch them on: the address your browser provides for them. The notification goes through the push service of your browser or phone (for example Apple or Google). If you switch notifications off, we delete that address.

Conversations with Rakel, the AI assistant, and with our support.

Partner offers: which offer you saw or clicked, with your role and province. We use a code per day, not your name. You can switch partner offers off in your settings.

Newsletter (only if you sign up for it):

• Whether you want to receive news, with when and where you said so (registration or settings)

3. Purposes

• Running your account and reviewing your registration: VAT number via the EU VIES service, insurance policy with end date and portfolio. You enter your Chamber of Commerce number and certificates yourself; we do not verify them
• Matching and ranking jobs and sign makers
• Enabling communication between client and sign maker
• Recording delivery as evidence, and preparing draft invoices and the fee invoice
• Preventing circumvention of the platform and abuse
• Providing support, including via Rakel
• Improving the platform with statistics. With your consent linked to your account, without consent only as an anonymous count
• Sending news about Signborn, such as new regions and features, only if you signed up for it
• Meeting legal obligations (tax record-keeping, platform operator reporting)

We do not sell your data and do not send marketing emails without consent.

4. Legal bases

• Performance of our agreement with you: account, profile, matching, chat, delivery, invoicing, support.
• Legitimate interest: registration checks, security, abuse and circumvention detection, the Trust Score, and recording delivery (including the end customer's data) as evidence for client and sign maker. You can object to this (section 9).
• Legal obligation: keeping invoices (7 years) and, to the extent Signborn is subject to it, reporting sign makers' data to the Dutch Tax Administration under the EU reporting obligation for platform operators (DAC7).
• Consent: analytics cookies, recording the referring website and the newsletter. You can withdraw consent at any time (section 8); for the newsletter via the unsubscribe link in every email or in your settings.

5. Automated ranking and AI

Matching: for each job the platform automatically ranks suitable sign makers on skills, availability, travel distance, reviews, experience, certificates and reputation. The weight of each factor is published at signborn.com/voorwaarden. The client makes the choice; the ranking is an aid.

Trust Score: a score from 0 to 100 based on behaviour after accepting jobs (completion, punctuality, reviews, objections, cancellations, response speed). It counts lightly in the ranking. It is never used to block, suspend or exclude an account. A staff member reviews low scores. You can see your own score and its components.

Score for clients: Signborn also calculates a score from 0 to 100 for clients, based on payment behaviour, objections, cancellations, repeat use and reviews by sign makers. Only the client itself and Signborn see that score. Sign makers do not see it. A measure never follows from this score alone.

No decisions are made that are based solely on automated processing and produce legal or similarly significant effects for you. If you want an explanation or a human review of your situation, email hello@signborn.com.

AI: we use language models from Anthropic for (a) Rakel, the in-app AI assistant, (b) checking chat messages and lounge posts for contact details shared to bypass the platform (first an automatic filter; the language model only reviews the message in case of doubt), and (c) texts marked as AI-generated, such as the explanation of a match, tips for sign makers to match more often and a suggestion for a better job description. Anthropic does not use this data to train its models.

6. How long we keep data

• Check-in GPS locations: 2 years
• Signature and delivery evidence (photos): 3 years after approval
• Objections and related messages: 3 years
• Invoices and the data they require: 7 years (statutory), also after your account is deleted
• Security logs: 180 days, serious incidents 2 years
• Colleague nominations that were not accepted: 12 months
• Client invitations nobody responded to: the link expires after 30 days, and we delete the name and email address 12 months later
• The first contact between a client and a sign maker through the platform, with the sign maker's Chamber of Commerce and VAT number: just over 13 months. This keeps the right rate in place, also if someone creates a new account.
• Sign-up whose login link you never opened: we delete the account after 14 days. You get an email about it a week before.
• Partner offers you saw or clicked: 13 months
• Newsletter without confirmation, or after unsubscribing: 30 days
• Other account, profile and job data, including chat messages: as long as your account exists

If you delete your account, we erase or anonymise your data, except what we are legally required to keep.

7. Who we share data with

Within the platform: client and sign maker see what they need from each other for the job. A sign maker never sees the commission or the total amount the client pays. A public sign maker profile exists only if you switch it on, and never shows your surname, town or rate.

Processors acting on our behalf:

• Supabase (Supabase Pte. Ltd., Singapore): database, login and file storage. The data is stored in the EU (Ireland); access from abroad is covered by standard contractual clauses
• Vercel (Vercel Inc., United States): website hosting and cookieless visitor statistics (Vercel Web Analytics)
• Resend (Plus Five Five, Inc., United States): sending email
• Anthropic (Anthropic Ireland, Limited, Ireland): AI (see section 5)
• Cloudflare (Cloudflare, Inc., United States): checking that a form is filled in by a human (Turnstile)
• Upstash (Upstash, Inc., United States): protection against overload (rate limiting)
• Hetzner (Hetzner Online GmbH, Germany): server for calculating travel times; coordinates only, no names
• Sentry (Functional Software, Inc., United States): error reports
• PostHog (PostHog, Inc., United States; stored in the EU, Frankfurt): usage statistics. With your consent linked to your account, otherwise only anonymous counts not linked to you
• Stripe (Stripe Payments Europe, Limited, Ireland): payment processing, only if active for your account. Payments for jobs go directly between client and sign maker, not through Signborn.

Data processing agreements apply with processors. To convert postcodes into coordinates we use PDOK (Dutch Land Registry), sending only the postcode. For the maps in the app your browser loads map tiles from CARTO; CARTO sees your IP address, not your account details. For the weather forecast we send a rounded location (about 1 km) to the Norwegian Meteorological Institute (MET Norway), without name or account details.

Authorities: we check VAT numbers with the European Commission (VIES) and provide data to the Dutch Tax Administration where the law requires it.

If you connect your Google Calendar yourself, Google is responsible for that itself (Google Ireland Limited).

Transfers outside the European Economic Area: Vercel, Resend, Cloudflare, Upstash, Sentry and PostHog participate in the EU-US Data Privacy Framework, and their data processing agreements also contain the European Commission's standard contractual clauses. For Supabase and for Anthropic (transfers to the United States) the standard contractual clauses apply. CARTO (United States) participates in the EU-US Data Privacy Framework.

8. Cookies and local storage

Always on (needed for the site to work):

• Login session (Supabase), language choice (NEXT_LOCALE), your cookie choice (sb_consent), collapsed partner offers (sb_ad_min) and a temporary check code when you connect your Google Calendar (sb_gcal_state)
• Referral link (signborn_ref, 30 days): only if you arrive via another user's invitation link, so the invitation is credited to the right person
• Settings in your browser, such as theme, drafts and collapsed menus (local storage, stays on your device)

Only with consent:

• Origin (sb_attr, 30 days): the website you came from and campaign parameters, linked to your account when you sign up
• Usage statistics via PostHog (local storage)

You can change your choice at any time via "Cookie settings" at the bottom of the website, or in the app under Settings. If you withdraw consent, statistics stop and we delete the origin cookie.

9. Your rights

You have the right to:

• access your data and get a copy (export from your settings)
• have incorrect data corrected (usually directly in your profile)
• have your data deleted (button in your settings), except what we must keep by law
• restrict processing
• receive your data in a common format (portability)
• object to processing based on legitimate interest
• withdraw consent, without affecting earlier processing
• ask for a human review and explanation of the ranking or the Trust Score

Email hello@signborn.com if something cannot be done from your account. We respond within one month.

10. Security

Login uses a one-time login link or a password of at least 12 characters, with an uppercase letter, a lowercase letter and a digit. Sessions use secure cookies that only the server can read. In the database each user sees only their own data (row level security). Documents such as insurance policies are kept in restricted storage. If you log in from an unknown device, you receive an email notification.

11. Complaints

If you are unhappy with how we handle your data, contact hello@signborn.com. You can always lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

12. Changes

We update this policy when the platform changes. The current version is always at signborn.com/privacy. We notify registered users of significant changes.