Privacy Policy
Template: review with a lawyer in Barbados. It is written to cover the main privacy laws customers ask about (the EU/UK GDPR, US state laws such as California's CCPA/CPRA, and Caribbean data-protection acts such as Barbados' Data Protection Act 2019).
This policy explains what personal data Shared Media ("SignageLite", "we") collects when you use SignageLite, why, and the choices you have. SignageLite is a business service; it is not meant for children and we do not knowingly collect data about anyone under 16.
1. Who is responsible
For account, billing and website data, Shared Media is the data controller. For personal data inside the content you put on your screens (for example staff names or customer photos), you are the controller and we act as your processor, handling it only to provide the service and following your instructions (see section 9).
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Business name, email address, password (stored only as a salted hash), time zone, sign-in times | To create and secure your account and contact you about it |
| Billing | Plan, number of screens, PayPal subscription ID and payment status | To charge for the service. Card and bank details are handled by PayPal; we never see or store them |
| Your content | Photos, videos, menus, prices, layouts, schedules, linked web pages, feeds and spreadsheets | To show it on your screens |
| Screen and device data | Device ID (for a Raspberry Pi, its serial number), model, app version, IP address, what is playing, a small screenshot of the screen (the latest one only, refreshed while the screen is online) | To pair screens, show you their status and help you fix problems |
| Raspberry Pi remote control | Wi-Fi network name and signal strength, nearby network names (only when you scan), temperature, power, memory, disk and uptime. Wi-Fi passwords you enter are passed to the device and deleted from our database once delivered | To let you reboot devices and manage their Wi-Fi from the dashboard |
| Connected services | If you link Canva: an access token and your Canva display name | To import and update your designs |
| Helper and support | Questions you type into the SignageLite helper, the replies, and messages you send us. For signed-in customers the helper also reads a short summary of your account (business name, plan, screen names and whether they are online) to answer about your setup | To answer your questions and solve problems. Conversations are not stored unless they become a support request; the request, your email and the conversation are then kept so we can help you |
| Ideas | Suggestions and feature requests you post, and your votes | To plan improvements and tell you when an idea you voted for is planned or done |
| Technical logs | IP address, browser type, requests and errors | Security, abuse prevention and fixing faults |
3. Legal bases (GDPR and similar laws)
- Contract: running your account, screens and billing.
- Legitimate interests: security, fraud and abuse prevention, improving the service, and limited service emails.
- Legal obligation: keeping billing records for tax purposes.
- Consent: anything optional we ask you to agree to. You can withdraw consent at any time.
4. Cookies
SignageLite uses one essential cookie to keep you signed in (and a second one only while an administrator from SignageLite is helping you inside your account). The dashboard also remembers small display preferences (such as grid or list view) in your browser. We do not use advertising or cross-site tracking cookies, and our fonts and icons are served from our own servers.
5. Who we share data with
We do not sell personal data or share it for advertising. We use these service providers ("sub-processors"):
| Provider | Purpose | Data |
|---|---|---|
| Shared Media (self-hosted) | Hosting and storage | All service data |
| Cloudflare, Inc. | Secure connection, network protection | Traffic to and from the service, IP addresses |
| PayPal | Payments and subscriptions | Billing contact and payment data you give PayPal |
| Anthropic, PBC (Claude) | The AI helper that answers questions on our website and in the dashboard, and sorts support requests and ideas | What you type into the helper, the conversation so far and, for signed-in customers, the short account summary described above. Under Anthropic's commercial terms this data is not used to train their models |
| Resend | Sending emails (sign-up, password reset, onboarding, support replies) | Your email address and the email's content |
| Canva (only if you connect it) | Design import | Your Canva designs and account name |
| Google (only if you link a Google Sheet) | Menu syncing | The sheet address you provide |
| Open-Meteo (weather zones) | Weather forecasts | The location you set for the zone (fetched by our server, not your screens) |
| YouTube (only if you add a YouTube zone) | Video playback | Your screen loads the video directly from YouTube (privacy-enhanced mode) |
We may also disclose data if required by law, to protect the rights and safety of our users or the public, or as part of a merger or sale of the business (with notice to you).
6. International transfers
Our providers may process data outside your country. Where the law requires, we rely on appropriate safeguards such as the EU Standard Contractual Clauses offered by those providers.
7. How long we keep data
- Account data and content: for as long as your account is open. When you delete your account it is removed from live systems promptly and from backups within 60 days.
- Screen screenshots: only the latest one per screen is kept.
- Billing records: as long as tax law requires (typically 7 years).
- Support requests and ideas: up to 24 months after they are closed, or until you ask us to delete them.
- Helper conversations: not kept on our servers unless they become a support request. Daily message counters (by account or IP address) are deleted after 3 days.
- Technical logs: up to 90 days, unless needed to investigate abuse.
8. Your rights
Depending on where you live you can ask to access, correct, download (portability), delete or restrict use of your personal data, and object to processing. You can download your account data and delete your account yourself under Settings, or email [email protected]. We reply within 30 days. California residents: we do not sell or share personal information for cross-context behavioural advertising. You can also complain to your local data-protection authority.
9. When we process data for you (processor terms)
For personal data inside your content we: process it only to provide SignageLite and on your documented instructions; keep it confidential; protect it with appropriate security; use the sub-processors listed above (and tell you before adding new ones); help you answer data-subject requests; notify you without undue delay of a personal-data breach affecting it; and delete it when your account ends. Business customers who need a signed Data Processing Agreement can request one at [email protected].
10. Security
Connections are encrypted (HTTPS). Passwords are stored as salted hashes, sign-in attempts are rate-limited, each device has its own key, and data is backed up nightly. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
11. Changes
We will post updates here and tell you by email or in the dashboard about significant changes.
12. Contact
Shared Media
114 Farmers, St Thomas, Barbados
Privacy questions: [email protected]