Privacy Policy

Effective 27 September 2026

This policy explains how OrderSignoff handles information when sellers create proof links and buyers review custom-order designs.

Who operates OrderSignoff

OrderSignoff is operated by JWC Eternal Limited, company number 16660044, registered office 128 City Road, London, United Kingdom, EC1V 2NX. For privacy questions or requests, use our support form.

Our role

For seller account, security, trial and billing information, JWC Eternal Limited is the data controller. When a seller uploads order information and asks a buyer to respond, the seller decides why that information is used. For that buyer information, the seller is normally the controller and OrderSignoff acts as its service provider.

Information we process

• Seller account information: email address, authentication records and support correspondence.
• Business and trial information: sales channel, shop or business name, shop identifier and trial usage.
• Proof information: uploaded artwork, product name, order reference, seller instructions, buyer-submitted name, decision, comments and timestamps.
• Security information: limited browser and device characteristics used to create a one-way HMAC device identifier, plus a one-way network identifier and request-rate counters. We do not store the raw fingerprint characteristics or raw IP address in the trial-control tables.
• Billing information: Stripe customer and subscription identifiers and subscription status. OrderSignoff does not receive or store full card details.
• Technical information: security logs, browser type, timestamps and information needed to diagnose errors and protect the service.

How we use information

We use information to provide proof links, record buyer decisions, authenticate sellers, operate subscriptions, answer support requests, prevent repeat-trial abuse, secure the service, meet legal obligations and improve reliability. Our legal bases include performing our contract, legitimate interests in operating and protecting the service, consent where required and compliance with law.

Proof links and files

A buyer proof link works like a private access link: anyone who receives it may open that proof. Sellers must send it only to the intended buyer and must not upload payment details, addresses, health information or other unnecessary sensitive information. Proof files are kept in private storage and displayed using short-lived file addresses after a valid proof link is checked.

Service providers

We use specialist providers to operate OrderSignoff, including Supabase for authentication, database and file storage; Stripe for subscriptions; Resend for service email; and hosting and infrastructure providers. They process information under their own security and data-protection obligations. Information may be processed outside the United Kingdom using appropriate safeguards.

Retention

• Account, proof and approval information is retained while the account is active and may be retained for up to 90 days after account closure or a verified deletion request, unless it must be kept longer for disputes, security or legal obligations.
• Trial device and network identifiers are retained for up to 12 months after the last trial activity to prevent repeated free-trial abuse.
• Billing and transaction records may be retained for up to six years where required for tax, accounting or legal purposes.
• Backups and security logs are deleted or overwritten according to operational retention schedules.

Your choices and rights

Depending on the law that applies, you may ask to access, correct, delete or restrict your personal information, object to certain processing or receive a portable copy. Buyers should normally contact their seller first because the seller controls the order relationship. You may also contact us, and you may complain to the UK Information Commissioner's Office.

Local storage and cookies

OrderSignoff uses essential browser storage for sign-in and security. We do not use advertising cookies on the OrderSignoff website. Stripe may use necessary technologies on its hosted checkout and billing pages.

Security

We use access controls, private file storage, short-lived file links, encryption in transit, restricted server credentials, rate limits and one-way identifiers. No online service can guarantee absolute security, so sellers should keep proof content limited to what the buyer needs to review.

Changes to this policy

We may update this policy when the service or law changes. The effective date above will show the latest material revision.