Privacy Policy

Sapling Signal is a direct-mail marketing platform operated by Sapling Holding Company, a Delaware corporation (“Sapling Signal,” “Company,” “we,” “us,” or “our”), 611 Gateway Blvd, Suite 120 #1225, South San Francisco, CA 94080. This Privacy Policy describes how we collect, use, disclose, and protect personal information across saplingsignal.com (the “Site”), the Sapling Signal platform (the “Platform”), and the campaign services we operate for our business clients: printed mail, hosted landing and booking pages, tracked phone numbers, and the correction service at saplingsignal.com/fix (together, the “Services”).

It is written for four groups: recipients, homeowners who receive mail prepared through the Platform; respondents, people who visit a landing page, submit a form, book an appointment, call a tracked number, or use the correction form; clients, businesses that use the Platform; and visitors to the Site. By accessing or using the Services you accept the practices described here. This policy is incorporated into and forms part of our Terms of Service. If you do not agree with it, please do not use the Services.

Responses. When you submit a landing-page form or book an appointment, we collect what you enter: name, address, phone, email, appointment details, and your answers to any questions on the form.

Calls. When you call a tracked number, we log the call (caller number, time, duration, routing) and record the call for quality assurance and lead verification, after a recording disclosure is played or where the business has certified that its own phone system provides one.

Corrections. When you use the correction form at saplingsignal.com/fix, we collect the name and address printed on the piece and anything else you tell us. We use this information solely to honor your request (fixing the record or suppressing future mail), never to build a marketing list. Keeping the correction on file is how the request stays honored (see Section 11).

Client accounts. Clients provide account details (email; sign-in credentials are handled by our authentication provider), company and brand information, campaign settings, and business locations. If you save a payment method or pay for a campaign or a mailing, payment is processed by Stripe, our payment processor: card numbers and bank account numbers go directly to Stripe and never reach our servers. A bank account is connected and verified through Stripe Financial Connections, which may ask you to sign in to your bank; Stripe handles that sign-in, and we receive only the confirmation, the bank name, and the last digits of the account. We keep Stripe’s identifiers for your customer record and payment method, the type of method and its last digits, and the amount, date, and outcome of each charge, refund, or dispute. When you sign an agreement or accept terms, we record your name and title, your typed or drawn signature, the exact version you accepted, the time, and your IP address and browser, and we keep them as the signature certificate and as evidence of the acceptance. Clients may also upload their own lists (for example, existing-customer or do-not-mail lists used to exclude homes from campaigns); the client is responsible for having the right to share those lists with us.

Usage and device data. Our hosting provider keeps standard web logs (IP address, browser type, pages requested, timestamps) for security, abuse prevention, and debugging. On public pages we use your IP address only to limit request rates; it is not stored with the page-visit information described next, except in the signature records described in Section 2.

Page-visit measurement. Hosted campaign and booking pages record each page visit with our own, first-party code: the page visited and when; how you arrived: the campaign and mail-piece parameters carried by the web link printed in a mail piece’s QR code, any campaign tags in a link you followed, or the domain (never the full address) of a site that referred you; your device type (phone, tablet, or computer), screen width, and browser language; your approximate region (country and state, derived from your IP address by our hosting provider; the IP itself is not kept); and whether your browser sent a Global Privacy Control signal. When you submit a form, book an appointment, or tap a phone number, the same first-visit details are attached to that response so the business can see which mail piece or link brought it.

QR codes on mail. Most QR codes on mail simply open a web link that includes the campaign and piece number. Some pieces carry a personal QR code, made for the household the piece was mailed to. Scanning one opens a link with a short code that tells us which mailed piece was scanned. We record the scan (when it happened and your device type, never your IP address or location), may fill in the name and mailing address printed on the piece so you can check them before you send anything, and show the business that mailed the piece that your household scanned it, with the name and address printed on the piece. A scan does not give anyone permission to call, text, or email you. If you ask us to stop or correct your mail at saplingsignal.com/fix, the personal codes already printed for your household are switched off: nothing is filled in, scans are no longer linked to your household, and the business is not shown your household.

Page-visit recordings. The Site and hosted campaign pages use session replay to understand how pages are used (scrolling, clicks, navigation). Anything you type into a form on public pages is masked: keystroke content is not captured in the replay. Replays are deleted automatically after about 30 days. Platform pages may also be session-recorded for support and quality purposes.

Cookies and similar technologies. Public campaign pages set no advertising or cross-site tracking cookies. To tell one visit from the next, the page stores a random identifier in your browser’s local storage; it is created by your browser, is not derived from anything about you, is never shared with another site, and is removed when you clear your browser’s site data. The Site and Platform set essential cookies only: sign-in sessions and workspace preferences. We do not run third-party analytics or advertising trackers on public pages; all measurement above is done by us, on our own systems.

Public records. Campaign audiences begin with public records, chiefly building permits and similar public filings about work done at a property.

Licensed data. We combine public records with property and homeowner data licensed from established, regulated data providers: property characteristics, ownership status, owner name and mailing address, and recent-sale or move indicators tied to an address. This is the same category of licensed data used across the direct- mail industry. We do not purchase or use browsing history, app activity, or social-media data to build audiences.

From clients. Exclusion and suppression lists as described in Section 2, and business contact information for client teams.

In the language of the California Consumer Privacy Act, the categories we collect are: identifiers (name, address, phone, email, IP); payment information for client accounts (payment method type, bank name and last digits, our payment processor’s identifiers; never full card or account numbers); commercial information (property records, permits, responses to campaigns); internet activity (page interactions on our Site and hosted pages); audio (recorded calls); professional information (client business contacts); and inferences (an estimate of how well a home fits a given home-services offer). We use them to:

Run campaigns: select the homes a client’s campaign will mail, print and deliver the pieces, and route responses (forms, bookings, calls) to the one business whose campaign you responded to, including confirmations, reminders, and calendar sync for booked appointments.

Measure campaigns: match a response back to the mailed list (attribution) so clients see what worked, and verify recorded calls as genuine leads.

Honor requests: maintain the platform-wide correction and suppression databases so corrections, less-mail, and do-not-mail requests are applied to every future mailing for every business on the Platform, and so the same home is not mailed repeatedly in error.

Improve the Services: compute cross-campaign statistics only over de-identified, aggregated groups. No individual homeowner profile is shared between clients, and we commit to not re-identifying de-identified data.

Protect the Services: secure the Platform, prevent fraud and abuse, enforce our terms, and comply with law.

With the business you contacted. Your form submission, booking, or call is shared with, and belongs to, the one business whose campaign you responded to. Their use of it is governed by their own privacy practices. If you scan a personal QR code, the business that mailed the piece is shown that your household scanned it, with the name and address printed on the piece (Section 3).

With service providers processing data on our behalf under contract: Vercel (hosting), Supabase (database, authentication, file storage), Stripe (payments, saved payment methods, and bank account verification), Twilio (phone numbers, call handling, recordings), Google (calendar sync for booked appointments and address geocoding), Resend (transactional email), our print and mail production partners (recipient name and address only, to print and mail pieces), and our licensed data providers.

Optional ad echo. A client may choose to run a social-media ad alongside a mail campaign so the same households see the same offer online. When a client turns this on, we share hashed (one-way encoded) name, city, state, and ZIP derived from that campaign’s mailing list with the advertising platform, which can match the hashes only against its own users. We never share the underlying list, and we do not do this unless the client runs that feature. To the extent this constitutes “sharing” for cross-context behavioral advertising under California law, you may opt out at any time (Section 9); a do-not-mail request at saplingsignal.com/fix also removes the household from future ad-echo audiences.

Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, personal information may be transferred as part of that transaction, subject to this policy or one at least as protective.

Legal and safety. We may disclose information when we believe it is required by law, subpoena, or legal process, or necessary to protect the rights, property, or safety of Sapling Signal, our users, or the public.

Licensing and your opt-out. We do not sell personal information to data brokers, advertisers, or the public. Businesses that use the Platform license our audience data, inside the Platform, to mail their own campaigns. California treats some licensing like this as a “sale.” You can opt out at any time at saplingsignal.com/fix (“Stop mailing this address entirely”): your household is removed from every business’s future lists and from ad echo. Apart from the client-initiated ad echo described above, we do not share personal information for cross-context behavioral advertising.

Tracked numbers exist so a business can prove which calls its mail generated. Calls are recorded only after a recording disclosure is played to the caller (or where the business has certified its own system provides that disclosure), and recordings are used for lead verification, quality assurance, and dispute resolution. You may request deletion of a recording of your call at any time (Section 9).

Where a client connects a Google Calendar, our access is limited to creating and updating booked-appointment events and checking free/busy availability. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not transfer it except as needed to provide the calendar-sync feature, for security, or to comply with law.

The fast lane for mail. To fix a wrong name or address, correct a detail about your home, get less mail, or stop mail entirely, use saplingsignal.com/fix: one minute, no account. Requests apply to every business that mails through Sapling Signal, are applied before every future mailing, and are keyed to the name printed on the piece so a future owner of the home starts fresh. We honor do-not-mail requests from anyone, in any state.

California residents have the right to: know and access the personal information we have about you (categories, sources, purposes, and specific pieces, in a portable format); correct inaccurate information; delete personal information, subject to legal exceptions; opt out of sale or sharing of personal information (the licensing and the client-initiated ad echo in Section 6; one request at saplingsignal.com/fix opts your household out of both); limit use of sensitive personal information (we do not use sensitive personal information to infer characteristics); and non-discrimination: we will never treat you differently for exercising any right. Residents of other states with comprehensive privacy laws have similar rights where those laws apply, including the right to appeal a refusal by writing to the contact below.

Making a request. Email compliance@saplingsignal.com or use /fix. We verify requests by matching the details you provide against our records (for mail records, the printed name and address are usually sufficient; by design, no account is needed). An authorized agent may submit a request on your behalf with proof of authorization. We respond within 45 days, extendable once by a further 45 days with notice. Global Privacy Control. Because our public pages set no advertising cookies and we do not share data through cookies, a GPC signal finds nothing additional to switch off on the page itself. We record the signal with any form submission or booking made while it is on, and we treat it as an opt-out of the Section 6 ad echo for that household: a home that responds to a campaign is removed from every future mailing and every future ad-echo audience for that business.

Session replays: about 30 days. Page-visit measurement (Section 3): individual visit records for up to 13 months, after which only aggregate counts are kept. Call recordings: while the related client account is active, and deleted on request. Personal QR code scans: kept with the campaign they belong to and deleted with it; the name and address on a personal code fill in a form for 24 months after printing. Leads and bookings: retained for the business you contacted until deleted or the account closes. Campaign mailing lists: client access expires 90 days after the campaign; we retain the underlying records to honor suppression and attribution. Correction and do-not-mail records: retained indefinitely, because remembering the request is what keeps it honored; these records are used for suppression only. Public-record and licensed property data: retained while it remains current for the purposes above. Client account data: for the life of the account plus the period needed for legal, tax, and audit obligations. Billing records (charges, statements, the terms a client accepted and when, approvals of mail pieces, notices sent, approved proofs, printer handoffs, and mail tracking): for the life of the account plus the period needed for legal, tax, and audit obligations, and as evidence while a payment is disputed.

All data is encrypted in transit; each client’s data is isolated at the database layer (row-level security); internal access follows least privilege; payment card and bank account data is handled entirely by Stripe. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as required by applicable law.

The Services are for businesses and homeowners. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.

We may revise this policy from time to time by posting the updated version at this URL with a new “last updated” date, and the updated version is effective when posted. For material changes affecting how we handle homeowner data, we will post the change before it takes effect; for material changes affecting client accounts, we may also notify the email address on the account, and that notice is effective when sent. Your continued use of the Services after the effective date constitutes acceptance of the revised policy.

Privacy questions and requests: compliance@saplingsignal.com, Sapling Holding Company, 611 Gateway Blvd, Suite 120 #1225, South San Francisco, CA 94080.

California residents may also report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs, 1625 North Market Blvd, Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.