Privacy

Privacy Policy

Effective date: October 9, 2026. Previous version: April 19, 2026.

1. Who we are and what this covers

This Privacy Policy is issued by MediaSignage Inc., a California corporation doing business as DigitalSignage.com ("DigitalSignage.com", "we", "us" or "our"). Our address is 5776-D Lindero Cyn Rd #182, Westlake Village, CA 91362, USA. We have operated digital signage services since 2006.

This policy explains what personal information we collect, how we use and share it, how long we keep it, and the choices and rights you have. It covers all of the following (together, the "Services"):

• digitalsignage.com, our marketing website, including the documentation under /digital_signage/.
• galaxy.signage.me and the other *.signage.me sites, which run the SignStudio web application and the SignPlayer services.
• secure.digitalsignage.com and secure.dynawebs.net, our API and back-end servers.
• The SignPlayer and SignStudio mobile and desktop apps. The app stores also show short app-specific notices (SignPlayer Privacy Policy, SignStudio Privacy Policy). This policy applies to the apps as well and controls if the two differ.

Our customers are businesses and organizations that use the Services to run screens. SignPlayer shows the content a customer assigns to a screen; it does not collect information about the people who look at that screen. What a customer chooses to display, and any data a customer collects through its own content, is the customer's responsibility and is not covered by this policy.

2. Summary

3. Information we collect

The table below lists the categories of personal information we collect, where each comes from and why we collect it. We collect the same categories today as we did in the preceding 12 months.

The marketing website has no forms. Contact goes through the helpdesk and signup happens in the SignStudio app, so the website itself collects only server logs and the cookie and storage items listed in Section 4.

We do not use sensitive personal information beyond what is needed to provide the Services.

4. Cookies and similar technologies

We use a very small number of cookies and browser storage items. None of them is used for advertising or for tracking you across other sites.

What we do not use. We do not use advertising cookies, analytics trackers, tracking pixels, session-replay tools, heat maps or third-party chat widgets on digitalsignage.com. This was verified on October 9, 2026 by scanning every generated page of the site and by capturing its network traffic in a browser.

How to control cookies. Your browser lets you view, block and delete cookies and site storage. Blocking or deleting ds_attrib only affects how we attribute a new account to a marketing channel. The sign-in storage in the SignStudio application is necessary; blocking it will prevent you from signing in. Stripe's cookies appear only on billing pages.

Global Privacy Control. We honor Global Privacy Control (GPC) browser signals as a request to opt out of the sale or sharing of personal information. Because we do not sell or share personal information, a GPC signal does not change what we do with your data.

5. How we use information

We use the information described above to:

• Provide, operate and secure the Services: create accounts, store your content, deliver it to your screens and monitor those screens.
• Process payments, issue invoices and keep the records that accounting and tax law require.
• Send transactional email such as welcome, billing and security messages.
• Send occasional product newsletters to account holders, which you can stop at any time (see Section 12).
• Answer support requests and keep support transcripts to maintain support quality.
• Return the results of the AI features you choose to use.
• Understand which of our own marketing channels bring new accounts (attribution).
• Detect, prevent and investigate fraud, abuse and security incidents, using server logs and payment-processor fraud checks.
• Improve the Services, for example by reviewing error reports and support requests.
• Comply with legal obligations and enforce our agreements.

We do not use personal information for targeted advertising and we do not build advertising profiles.

6. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. We share personal information only as follows.

Service providers (processors)

These companies process data on our behalf, under contract, only to provide their service to us:

• Amazon Web Services: hosting, storage, backups and email delivery (Amazon SES).
• Postmark: transactional email delivery.
• Stripe, Braintree and PayPal: payment processing. Card numbers are entered directly with the processor and never stored by us.
• Anthropic, OpenAI and Google: AI processing for the AI features, used when our own self-hosted model needs them for a request (see Section 7). They process prompts and content only to return the result and, under their API terms, do not use that data to train their models.
• Google: fonts on every website page, Google Maps for the station map, and sign-in, Drive and YouTube when you choose them.
• Dropbox: media import, when you choose it.

Sign-in and integration providers you choose

When you sign in with Google or Amazon, or connect Google Drive, Dropbox, YouTube, Google Maps or a social feed, the provider receives the request from your browser or device and its own privacy policy applies to what it collects. These providers are involved only when you use the feature.

Legal requirements

We may disclose personal information when we believe in good faith that it is necessary to comply with a law, regulation, legal process or lawful government request; to enforce our agreements; or to protect the rights, property or safety of MediaSignage Inc., our users or others, including for fraud prevention.

Business transfers

If MediaSignage Inc. is involved in a merger, acquisition, financing or sale of all or part of its assets, personal information may be transferred as part of that transaction. This policy will continue to apply to the transferred information until a new policy is posted.

With your direction

We share information with other parties when you ask us to or direct us to, for example when you ask us to work with a reseller or partner who manages your account.

7. Support chat and AI assistant

Human support chat

The support chat is served from our own servers (secure.digitalsignage.com). No third-party chat vendor is involved. When you start a chat you give an email address and a message. The chat records the conversation, your IP address, your operating system and your approximate location (country and city). Transcripts are stored for support quality, can be replayed to you and to our support agents, and are kept for up to 24 months unless you ask us to delete them earlier.

AI assistant and AI content features

The AI assistant chat and the AI content features (scene wizard, video builder and image generation) process the prompts and content you provide. They are processed first by our own self-hosted model. When needed, they are sent to third-party AI providers (Anthropic, OpenAI and Google) acting as our processors. These providers process the data only to return the result and, under their API terms, do not use it to train their models.

The AI assistant's chat history is held in memory for your session only, limited to the last 20 messages, and you can download the transcript. Please do not enter passwords, card numbers or other sensitive information in the support chat or the AI assistant.

8. Data retention

We keep personal information only as long as needed for the purposes described in this policy:

• Account data: for the life of your account.
• Content you upload: for the life of your account. When an account is closed, its content is kept for 30 days (so you can ask for restoration or export) and then deleted.
• Billing records (invoices, amounts, payment status): 7 years, as accounting and tax law require.
• Server logs: about 90 days.
• Support chat transcripts: up to 24 months, or earlier if you ask us to delete them.
• AI assistant chat history: in memory for the session only (last 20 messages).
• Attribution data: the ds_attrib cookie lives 90 days in your browser; the attribution record created at signup is kept with the account.

Copies in routine backups are removed as those backups age out. We may keep aggregated or de-identified information that no longer identifies you.

9. Security

We protect personal information with measures appropriate to its sensitivity: all connections use HTTPS, passwords are stored hashed, access to personal information is limited to staff who need it for their work, and data is backed up in Amazon Web Services. Card numbers are handled entirely by our payment processors. No system is completely secure, so please choose a strong password, keep it to yourself and contact us right away at mstech@mediasignage.com if you believe your account has been compromised.

10. Your privacy rights

(a) All users

Whatever your location, you can:

• Access the personal information we hold about you.
• Correct inaccurate information. Most account details can be edited in SignStudio under Account.
• Delete your account and its data. See how to cancel or close your account, or send us a request.
• Export (port) your account data in a commonly used format.
• Unsubscribe from newsletters using the link in any email.

To make a request, email mstech@mediasignage.com with the subject "Privacy request", open a helpdesk ticket, or write to 5776-D Lindero Cyn Rd #182, Westlake Village, CA 91362, USA. We verify requests through the email address registered on the account. Requests are free of charge and we will not treat you differently for making one. The page Your Privacy Choices summarizes these options.

(b) California residents

If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) gives you the following rights:

• The right to know what personal information we collect, use and disclose about you, including the categories, sources, purposes and recipients described in Sections 3 to 6.
• The right to delete personal information we collected from you, subject to legal exceptions (for example, billing records we must keep).
• The right to correct inaccurate personal information.
• The right to data portability: to receive a copy of your personal information in a portable format.
• The right to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of.
• The right to limit the use of sensitive personal information. We do not use sensitive personal information beyond what is needed to provide the Services.
• The right to non-discrimination: we will not deny you service, charge a different price or provide a different level of service because you exercised your rights.

Do Not Sell or Share My Personal Information. We do not sell or share personal information and have not done so in the preceding 12 months. Our Your Privacy Choices page explains this and how to exercise your other rights. We honor Global Privacy Control signals; because we do not sell or share, a GPC signal does not change how we treat your data.

How to submit a request. Email mstech@mediasignage.com with the subject "Privacy request", open a helpdesk ticket, or mail 5776-D Lindero Cyn Rd #182, Westlake Village, CA 91362, USA. Tell us which right you want to exercise and the email address on your account.

Verification. We verify your identity through the email address registered on your account. If a request does not come from that address we may ask you to confirm it from there before we act.

Authorized agents. You may use an authorized agent to make a request on your behalf. We require the agent's written permission from you, and we may still verify the request with you directly.

Timing. We respond within 45 days of receiving a verifiable request. If we need more time, we will tell you why and extend the period once by up to 45 more days.

Sections 3 and 6 describe the categories of personal information we collected and disclosed for a business purpose in the preceding 12 months. We did not sell or share any category of personal information in that period.

(c) European Union, United Kingdom and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, MediaSignage Inc. is the controller of the personal information described in this policy, except for the content and screen data we process on a customer's behalf, where the customer is the controller and we are its processor. We process personal information under the following legal bases:

• Performance of a contract: to provide the Services you signed up for.
• Legitimate interests: security, product improvement and attribution of our own marketing, balanced against your rights.
• Consent: optional integrations (sign-in providers, Drive, Dropbox, YouTube, Maps, social feeds) and newsletters. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation: keeping billing and tax records.

You have the right to access, rectify and erase your personal information, to restrict or object to its processing, to receive it in a portable format, to withdraw consent, and to lodge a complaint with the supervisory authority in your country (in the UK, the Information Commissioner's Office). To exercise these rights, contact us as described above.

International transfers. We are based in the United States and process personal information there. Where the GDPR or UK GDPR applies, transfers to the United States rely on Standard Contractual Clauses together with the safeguards our service providers offer for the data they process.

(d) Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states with privacy laws have rights similar to those listed above, including access, correction, deletion, portability and opting out of targeted advertising and the sale of personal data (neither of which we do). We offer the same rights to every user regardless of where you live, using the same request process and timing described in this section.

11. Children

The Services are for businesses and adults aged 18 or over. They are not directed to children under 16, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us at mstech@mediasignage.com and we will delete it.

12. Email communications

We send two kinds of email. Transactional messages (welcome, billing, security and service notices) are part of running your account and continue while you have one. Product newsletters are sent occasionally to account holders; every one includes a personal unsubscribe link, and one click stops them. Our emails contain no open-tracking pixels and no click tracking.

13. YouTube API Services

If you add YouTube content to a scene, SignStudio uses YouTube API Services to play it. By using this feature you agree to be bound by the YouTube Terms of Service, and Google's collection and use of your information is governed by the Google Privacy Policy. We use YouTube API Services only to play the videos you select; we do not use them to collect data about you, to share data with third parties or to serve advertising. You can revoke our access to your Google account at any time from the Google security settings page.

14. Third-party sites and links

The Services contain links to other websites and to the providers named in this policy. We are not responsible for the privacy practices or content of sites we do not operate. When you follow a link or connect a third-party service, that party's privacy policy applies to the data it collects.

15. Changes to this policy

We may update this policy as the Services change. When we do, we post the new version here with a new effective date. For material changes we also email account holders before the change takes effect. Your continued use of the Services after the effective date means the updated policy applies.

16. Contact