Canonical route: /privacy/
Last updated: [Publication date]
1. Who is responsible for your information?
Custom Sign Forge is a trading name of Taizhou Xunfeng Trading Co., Ltd. (台州巽风贸易有限公司), based at [Business address and country/region]. This operator is responsible for the personal information described in this notice.
Contact: hello@customsignforge.com. Business contact details are also available on our Business Information page.
Review required: Confirm controller identity, operating location and any required EEA/UK representative or data protection officer details. Add applicable regional disclosures before targeting those markets.
2. Information we handle
You must sign in before filling in or submitting the website enquiry form. Customer sign-in uses Google or a one-time email code. We store your verified email, customer account identifier and, if used, a Google account identifier to provide your account and associate your enquiries. Customer accounts and administrator access are separate. You can view only enquiries associated with your customer account.
When you submit a website enquiry, we receive the sign style, intended use, delivery country and project stage you provide. You must provide a phone or WhatsApp number with its international country code and tell us whether drawings or artwork are available. We save your verified account email with the enquiry. Phone and WhatsApp numbers are self-reported and are not verified by SMS. Our team may use the selected contact method to follow up about your project. You may also provide your role, city, preferred timing and short comments. We create an enquiry reference and associate the enquiry with relevant product, example or entry-page details.
Where available and permitted, we may record campaign and referral information associated with your visit or enquiry. We do not assume a source where it cannot be established.
Our website and security providers process technical information needed to deliver and protect the service, such as network, browser, request and security signals. The actual tools and device-storage technologies are described in our Cookie Notice.
If you contact us through WhatsApp or email, we receive the contact information, messages and files you choose to send there. We may maintain necessary project notes, quotation and order records. WhatsApp conversations are not automatically imported into this website's enquiry database.
Please do not include identity documents, payment-card details or unrelated sensitive personal information in an enquiry. A contact number is required for the website enquiry form. You do not need to provide a budget, company name or finished production drawing. You can state that you have no drawings or will provide files later. If you choose to upload drawings, artwork or reference files, we store the original filename, file size and private file linked to your account and submitted enquiry. Files are accessible only through authorised customer or administrator access and are not placed in the public promotional image library.
The enquiry form also collects your contact name, customer type, number of complete signs, approximate dimensions or a request for sizing help, and preferred delivery window. You may optionally share a business or shop name, website or social profile, installation environment, target date and indicative budget. These details help our team review project suitability and prepare follow-up questions. We do not automatically reject enquiries based on missing artwork, budget or business website.
3. Why we use information
We use relevant information to respond to enquiries, clarify requirements, prepare quotations, coordinate confirmed projects and provide support. We also use limited records to protect the website, manage enquiries and understand permitted source and performance information.
Submitting an enquiry does not subscribe you to promotional messages. Any separate marketing activity must have an appropriate basis and an available way to stop it.
Review required: Insert the approved purpose-by-purpose lawful-basis table where required. Distinguish steps requested by an individual before a contract, business-contact legitimate interests where appropriate, legal obligations, security interests and consent for relevant optional activities. Identify the specific interests and complete assessments before relying on them.
4. WhatsApp and external links
Choosing WhatsApp takes you to a separate service. A prepared message may contain your selected style, use, destination country, project stage, reference example, verified contact email, self-reported contact number, drawing status and enquiry reference. Uploaded files are not sent to WhatsApp automatically. You can review and edit it before sending. Opening the link does not send a message automatically.
WhatsApp's own privacy terms apply to its service. We remain responsible for our handling of the information we receive. If you prefer another contact method, email hello@customsignforge.com.
Review required: Link the relevant regional WhatsApp policy and confirm the actual click-to-chat implementation. Do not send full enquiry text or prepared-message URLs to analytics tools.
5. Who may receive information
We use technical providers for hosting, database and file storage, security, administrator access and business communications. Where needed for your project, we may share relevant specifications with manufacturing partners and necessary fulfilment information with logistics or related service providers.
We limit sharing to what is needed for the purpose. Customer artwork is not automatically made public or included in our marketing.
Current technical services include Cloudflare Workers (hosting), D1 (website records), R2 (promotional media and private enquiry uploads), Turnstile (enquiry security) and Cloudflare email sending for authorised administrator sign-in. Domain business email is handled through our existing mail system. Optional first-party event analytics are stored in D1 only after your choice. For signed-in customers who allow analytics, we use a server-generated pseudonymous account key to count each account once per action within the selected reporting period and source, including across devices. Names, emails, phone numbers and enquiry content are not included in analytics events. Administrator activity and signed-out visits are excluded; events expire after 90 days. WhatsApp is an external contact service. Google is used when you choose Google sign-in; we request identity and email information only, not access to your Gmail messages or files. Cloudflare email sending is also used for requested customer sign-in codes. With your Analytics permission, public marketing pages also use Google Analytics 4 for traffic and contact-button statistics, Microsoft Clarity for heatmaps and session recordings, and Shipsolo-hosted Plausible for traffic and engagement statistics. These external tools can measure signed-out visits and process technical visitor/session information. We exclude administrator, sign-in, account, enquiry-form and policy pages, and do not send contact fields, drawing files or enquiry references as custom analytics data. Advertising tracking remains disabled. External services follow their own retention settings. See our Cookie Notice for activation, cookies, withdrawal and provider information. See Google's Privacy Policy.
Review required: Confirm provider contracts, manufacturing and fulfilment recipient categories, any applicable sale/sharing analysis and regional disclosures before the policy is approved.
6. International processing
Information may be accessed or processed in [Actual countries/regions] by us and our providers. Where applicable law requires protection for international transfers, we use [Verified mechanism and safeguards]. You can contact hello@customsignforge.com for relevant information or a copy of applicable safeguards, subject to lawful redaction.
Review required: Complete actual locations, remote access and safeguards; a provider contract alone is not a completed transfer assessment.
7. How long information is kept
We keep information only for the relevant purpose and applicable legal requirements. Our retention rules are:
| Record | Retention period or criteria |
|---|---|
| Customer account and account-linked enquiry records | [Approved period, account closure and applicable order-retention criteria] |
| Unsubmitted drawing uploads | Access expires after 24 hours; expired files are removed by scheduled cleanup |
| Files attached to submitted enquiries | Kept with the relevant enquiry under its retention criteria; removed when that enquiry is deleted |
| Enquiries without established contact | [Approved period and starting point] |
| Active enquiries and project communication | [Approved period or clear criteria] |
| Orders, financial and dispute records | [Applicable obligations and periods] |
| Security and technical logs | [Approved period and incident exceptions] |
| Optional first-party analytics events | Scheduled deletion after 90 days |
| Privacy choices on your device | Valid for 180 days; browser storage remains until replaced or cleared |
| Optional first-source attribution on your device | Up to 90 days of use; removed on withdrawal |
| Backups | [Rotation and deletion period] |
When a record is no longer needed, we delete it or make it no longer identifiable, subject to applicable retention requirements. Backup deletion follows the stated rotation process.
8. Your choices and rights
Depending on the law that applies, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict processing or request portability. Some rights depend on the purpose and legal basis of the processing.
You may object to processing based on legitimate interests where applicable. You may also object to direct marketing. Where processing is based on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Contact hello@customsignforge.com to make a request. We may ask for proportionate information to verify your identity. An enquiry reference alone does not authorise access to personal information.
You may complain to the relevant data protection authority. [Add applicable authority details; for UK individuals, include a link to the ICO where appropriate.]
For account or personal-data requests, contact the privacy email above. Deleting or correcting account data requires identity verification and consideration of any applicable order or legal retention duties; signing out alone does not delete an account.
Optional tracking choices can be managed through Cookie Settings. Declining optional tracking does not prevent you from browsing products or contacting us.
9. Security and automated decisions
We use appropriate technical and organisational measures to protect information. No method of transmission or storage can be guaranteed completely secure.
We do not use an AI score to decide whether to accept your project. Project suitability and quotation decisions are reviewed by people.
Review required: Verify actual access controls, retention/deletion procedures and automated processing before publication.
10. Changes
We may update this notice to reflect changes in our practices or requirements. The date above identifies the current version. Where required, we will provide additional notice or obtain a new choice before materially different processing begins.