US Sales Tax Rates Privacy Policy

What we collect

• Your email address. You enter it at checkout, and it becomes your account. We send sign-in links and report emails to it.
• Purchase records. For each purchase we keep the plan, the states you chose, the quarter, the plan price, the date, the Stripe ids for your customer record, payment, and subscription, and whether the purchase is active, refunded, or disputed.
• Your watchlists. This is the name of each watchlist and the states on it.
• Locations you upload. This is the store ID and address text in your file and the jurisdiction we match it to. The location data page at /privacy/locations explains this in full.
• Feedback and bug reports. If you send one, we receive your message, the note type you picked, the address of the page you were on, and any name or email you choose to add. Name and email are optional. Sign-in tokens and other values that look like secrets are removed from the page address before it is sent.
• Sign-in records. When you ask for a sign-in link, we store a one-time link record. When you open it, we store a session record. To stop abuse, we count sign-in requests using a scrambled (hashed) form of your email address.
• A scrambled (hashed) form of your IP address when you send feedback. We use it only to limit how many notes one address can send in 10 minutes. It is deleted when that window ends.
• Usage data typical of a website (for example IP address, browser type, pages viewed, and approximate time of visit), collected by our hosting provider as part of operating the site.
• Page views and visits. The site uses Vercel Web Analytics to count page views and visits, without cookies. We do not use it to identify individual visitors.

Card details

You enter card details on Stripe’s checkout page. They go to Stripe and never touch our site or our servers. We do not see or store your card number. From Stripe we receive your email, the result of the payment, and Stripe’s ids for the customer, payment, and subscription.

Cookies

• ustr_session keeps you signed in after you open a sign-in link. It holds a random token, not your email or card. It lasts up to 30 days, and signing out clears it. Page scripts cannot read it.
• ustr_unlock is used only by the site operator to review the product. It is not set for customers.
• We do not set advertising cookies.

How we use it

• To run your account and open what you paid for.
• To send sign-in links, and report emails you ask for.
• To handle cancellations, failed payments, refunds, and disputes.
• To match your uploaded locations to jurisdictions on your plan.
• To read and, if needed, reply to feedback you send.
• To operate, secure, and improve the site.

Who processes it

• Stripe takes payments, holds card details, and runs the billing page where you manage or cancel a subscription.
• Resend sends our email. That includes sign-in links, report emails, and the feedback notes you send us.
• Vercel hosts the site and collects the usage data described above.
• A Redis database service connected through our host, Vercel, stores accounts, sign-in records, purchase records, watchlists, and uploaded locations.
• We do not sell your personal information. We may disclose information if required by law.

Retention

• Account, purchase, and watchlist records: we keep these while your account is open. After that, we keep purchase records as long as tax and accounting law requires, usually up to 7 years, and delete the rest when you ask.
• Sign-in links expire after 15 minutes. Sign-in sessions end after 30 days. The expired sign-in records are kept with your account records and deleted with them.
• Uploaded locations stay until you delete or replace them, as the location data page explains.
• Feedback notes arrive in our email inbox. We keep feedback emails as long as we need them to handle your note and improve the site, and delete them when you ask.
• Vercel keeps hosting logs for a limited time under its own policy.
• Stripe keeps its own payment records under its own privacy policy.

Your choices

To ask what we hold about you, or to ask us to correct it, email feedback@ussalestaxrates.com. To delete your account, email us from the address on your account. We will delete your account, watchlists, and uploaded locations within 30 days and confirm by email. We keep purchase records that tax and accounting law requires. There is no self-serve account deletion, so we do this by hand. You can also delete uploaded locations yourself at any time on the locations page.

Contact

Questions about this policy: feedback@ussalestaxrates.com

Changes

We may update this policy. The “Last updated” date will change when we do.