Signature Suite
1. Who We Are and What This Policy Covers
Signature Detailing Ltd. ("Signature Detailing", "we", "us") is a British Columbia company based in Victoria, BC. We provide Signature Suite (the "Service"), shop-management software for auto-detailing and vehicle-service businesses ("Subscribers"). The Service is offered to businesses located in Canada, excluding Quebec.
This Policy explains how we collect, use, disclose and protect personal information in connection with the Service, in line with the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (BC PIPA) and, for Subscribers located in Alberta, Alberta's Personal Information Protection Act (Alberta PIPA).
This Policy covers the Service only. It does not cover a Subscriber's own privacy practices. Customers of Signature Detailing's own detailing shop are covered by a separate privacy notice.
2. Our Two Roles
| Information | Who is responsible | Our role |
|---|---|---|
| A Subscriber's customers (End Customers): names, contact details, vehicles, bookings, estimates, jobs, payment references | The Subscriber | Service provider: we process it on the Subscriber's behalf and only on its instructions |
| Subscriber staff accounts, Subscriber business contacts, subscription billing, support requests | Signature Detailing | Organization responsible for that information |
Under Canadian private-sector privacy law, the Subscriber is the organization responsible for its End Customers' personal information, and Signature Detailing acts as its service provider. Our commitments as a service provider are set out in Section 9 of our Terms of Service.
If you are a customer of a shop that uses the Service, that shop decides what information it collects about you and how it uses it. Please contact the shop first with questions or requests about your information. We will help the shop respond.
3. Information We Collect
3.1 Subscriber staff (Authorized Users)
- Name, business email, role, and sign-in and multi-factor authentication (MFA) data handled through our identity provider, WorkOS.
- Activity records in the Service, such as which user created or changed a record, and when.
3.2 Subscriber business and billing information
- Business name, contact details and plan. Subscription payments are processed by Stripe. We receive payment status and references, not full card numbers.
3.3 End Customers of Subscribers
- Name, phone number, email address, mailing or service address, and notes the shop records.
- Vehicle information, such as year, make, model, colour, licence plate and VIN.
- Booking, estimate, job and service details, scheduling, photos of vehicles, inspection notes and feedback.
- Payment metadata for deposits and payments: amounts, status and Stripe references. Card payments are entered on Stripe-hosted pages through the Subscriber's own Stripe account. The Service does not receive or store card numbers.
- Online booking information: when an End Customer books online, the information entered in the booking form (name, phone number, email address, vehicle details, requested service, preferred date and time, and any notes) and how they reached the page, such as the referring page and campaign parameters.
3.4 QuickBooks Online data
When available, if a Subscriber chooses to connect its own QuickBooks Online company, the Service accesses that company through the QuickBooks Online Accounting API. It reads company information and reference lists (customers, items, tax codes, accounts and payment methods) and creates invoices and payment records from completed jobs. These records can include End Customer names and contact details. We store an encrypted connection token and company identifier for that Subscriber only.
4. How We Use Information
- To provide the Service to Subscribers on their instructions, including bookings, estimates, jobs, scheduling, deposits and the QuickBooks Online connection.
- To send service-related messages on a Subscriber's behalf, such as booking confirmations, estimates and reminders, where the Subscriber uses those features.
- To create and secure accounts, verify identity at sign-in (including MFA), and prevent fraud and misuse.
- To bill subscriptions, provide support and communicate with Subscribers about the Service.
- To maintain, troubleshoot and improve the Service, and to meet legal, accounting and tax obligations.
We do not sell personal information, and we do not use End Customer information for our own marketing. We may create aggregated or de-identified information about use of the Service, which we use only to operate and improve the Service. We never sell it, and we never use it to identify a Subscriber, an individual or an End Customer.
5. Consent
We rely on the consent of Authorized Users and Subscribers, which may be express or implied as permitted by law, and on the exceptions to consent that the law allows. Subscribers are responsible for giving any notice and obtaining any consent required from their End Customers for information they enter into or collect through the Service.
We use analytics and advertising tags only with the individual's opt-in consent, as described in Section 8.
Individuals may withdraw consent on reasonable notice, subject to legal or contractual restrictions. Withdrawing consent may mean we or the shop cannot provide certain services.
6. Service Providers and Cross-Border Storage
We use the following service providers to run the Service. They may access personal information only to perform services for us, and we require them to protect it.
| Provider | Purpose |
|---|---|
| Cloudflare | Hosting, application servers and database; website delivery and security |
| WorkOS | Staff sign-in and multi-factor authentication |
| Stripe | Subscription billing for the Service; Stripe-hosted payment pages for deposits and payments taken through each Subscriber's own Stripe account |
| Intuit (QuickBooks Online) | When available, the accounting connection a Subscriber chooses to make to its own QuickBooks Online company, under the Subscriber's own agreement with Intuit |
Some of our service providers store or process information outside Canada, including in the United States. While it is outside Canada, the information is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities.
We may also disclose information where required or permitted by law, or in connection with a merger, reorganization or sale of our business, subject to appropriate protections.
7. Security Safeguards
We protect personal information with safeguards appropriate to its sensitivity, including:
- mandatory multi-factor authentication for all staff sign-ins;
- logical separation of each Subscriber's data, so one Subscriber cannot access another Subscriber's records or connected accounts;
- encryption of QuickBooks Online connection tokens on our servers. Tokens are never sent to the browser, and disconnecting revokes only that Subscriber's connection;
- payment card details handled only on Stripe-hosted pages;
- encryption in transit (HTTPS), and access limited to personnel who need it.
No method of storage or transmission is completely secure. We do not currently hold independent security certifications (such as SOC 2).
8. Cookies, Analytics and Advertising
The Service uses cookies and similar technologies that are strictly necessary for sign-in and security.
We do not place our own analytics or advertising tags on Subscribers' booking pages.
On Signature Detailing's own booking page, we use Google Analytics, Google Ads and Meta Pixel to measure visits and booking conversions, but only if you opt in through the consent banner. Until you opt in, these tags do not set cookies or send event data to Google or Meta. You can change your choice at any time through the consent settings on the page. Analytics data is kept for no more than 14 months.
9. Retention
We keep personal information only as long as needed for the purposes described in this Policy or as required by law:
| Category | Retention |
|---|---|
| Subscriber Data (including End Customer information) | While the Subscriber's account is active and for 30 days after cancellation, so the Subscriber can export it; then deleted or de-identified |
| Billing, accounting and tax records | 6 years after the end of the tax year they relate to |
| Authorized User account and audit records | While the account is active and for 1 year after it is closed |
| Booking-page analytics data (with consent) | No more than 14 months |
| Support correspondence | 2 years |
Backups expire within 30 days. Where personal information is used to make a decision that directly affects an individual, we keep it for at least one year after that decision, as BC PIPA requires. Information we must keep for legal, accounting or tax reasons is kept for the period the law requires.
10. Access and Correction
You may ask for access to personal information we hold about you and ask us to correct it. Send requests to the privacy contact in Section 14. We will verify your identity before acting, respond within 30 days, and explain any reason we cannot fully grant a request.
If your information is held on behalf of a shop that uses the Service, we will forward your request to that shop within 5 business days and help it respond.
11. Breach Notification
If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as required by applicable law. We keep a record of every breach of security safeguards, as the law requires.
If a breach affects information we hold on behalf of a Subscriber, we will notify that Subscriber without unreasonable delay, with a target of 72 hours after we confirm the breach. The notice will describe what happened, the information involved, the steps we have taken and a contact person, so the Subscriber can meet its own obligations. We follow a written incident-response plan.
12. Children
The Service is a business tool and is not directed at children.
13. Changes to this Policy
We may update this Policy. We will post the updated version with a new "Last updated" date. For material changes, we will also notify Subscribers by email at least 30 days before the change takes effect, where practical.
14. Contact and Complaints
Our privacy contact, who is responsible for our compliance with this Policy:
Drew Thomas, Signature Detailing Ltd., #4-3131 Delta Street, Victoria, BC V8Z 1A6, Canada. Email: [email protected]
If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.