1. Introduction

Sails ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our sales tax calculation and compliance service.

Please read this Privacy Policy carefully. By using Sails, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, password (stored in hashed form)
Business Information: Business name, address, EIN (optional), business type
Tax-Related Data: Nexus registrations, state registration numbers, filing history
Transaction Data: Sale amounts, product categories, state information for tax calculations
Payment Information: Billing details are collected and processed by Stripe. Sails never sees or stores your full card number.

2.2 Store and Order Data

When you connect a store or upload an order report, Sails imports only what sales tax work needs: order number and date, amounts, tax collected, order status, the items sold, and the ship-to city, state, ZIP and country. We do not store your buyers' names, email addresses, phone numbers or street addresses, even when the platform provides them.

Store connections only ask for read access. The keys that let Sails read your orders are encrypted (AES-256) before they are saved, and you can disconnect a store at any time. While a Shopify or WooCommerce store is connected, Sails checks it for new orders once a day, as well as whenever you click Sync.

2.3 Information Collected Automatically

Log Data: IP address, access times, browser type and pages requested, kept by our hosting provider for security and troubleshooting
Error Reports: When something breaks, our error-monitoring service (Sentry) records technical details about the error, like the page address, your browser and the code that failed. It doesn't record your screen.

2.4 Cookies and Tracking

Sails uses one cookie, to keep you signed in. We don't use tracking or advertising cookies. See our Cookie Policy for details.

3. How We Use Your Information

We use your information to:

Provide, maintain, and improve our sales tax calculation services
Process tax calculations and generate compliance reports
Send you the emails you've asked for, like threshold alerts (you can turn these off in Settings)
Respond to your inquiries and provide customer support
Detect, prevent, and address technical issues and fraud
Comply with legal obligations and enforce our terms
Understand how the service is used, in aggregate, so we can improve it

4. Data Sharing and Disclosure

We may share your information with:

Service Providers: The companies listed in section 10, only as needed to run Sails
Legal Requirements: When required by law, court order, or government request
Business Transfers: In connection with a merger, acquisition, or sale of assets
With Your Consent: For any other purpose with your explicit permission

We do not sell your personal information to third parties for marketing purposes.

5. Data Security

We protect your data with these measures:

Encryption in transit (TLS) for every connection to Sails
Encryption at rest by our database provider, plus an extra layer of AES-256 encryption on store connection keys
Passwords stored only as bcrypt hashes
Read-only access to your store — Sails can't change your orders or settings
Rate limiting on sign-in and on our API
Hosting on established cloud providers (Vercel and Neon) with physical security controls

No system is perfectly secure. If you believe you've found a security problem, please email support@sails.tax.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Specifically:

Account, business and order data: Kept while your account is open, because nexus is measured over the previous and current year. Deleting your account (Settings → Data & Privacy) permanently deletes this data right away.
Billing records: Kept by Stripe as required for tax and accounting law
Server logs and error reports: Kept by our hosting and monitoring providers for a limited period
Email preferences: Kept until you change them or delete your account

7. Your Rights

7.1 GDPR Rights (EU/EEA Residents)

Under the General Data Protection Regulation, you have the right to:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Restriction: Request limitation of processing
Objection: Object to certain types of processing
Withdraw Consent: Withdraw consent at any time

7.2 CCPA Rights (California Residents)

Under the California Consumer Privacy Act, you have the right to:

Know what personal information is collected about you
Know whether your personal information is sold or disclosed and to whom
Say no to the sale of personal information
Access your personal information
Request deletion of your personal information
Not be discriminated against for exercising your privacy rights

7.3 Exercising Your Rights

To exercise any of these rights, please visit your Account Settings or contact us at support@sails.tax.

8. International Data Transfers

Sails is operated from the United States, and our service providers process data primarily in the United States. If you use Sails from outside the US, your information will be transferred to the US.

9. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal data, please contact us.

10. Third-Party Services

Sails uses these service providers to run the service:

Vercel — website and application hosting. Everything the app handles passes through it; request logs are kept for a limited time.
Neon — database hosting. Your account, business details, imported orders and filing records.
Stripe — subscription billing and payments. Your email and billing details. Card numbers go straight to Stripe; Sails never sees them.
Resend — sending account emails and the alerts you've turned on. Your email address and the content of the email.
Sentry — error monitoring. Technical details about errors. Personal details are left out by default.
Upstash — rate limiting. Sign-in email addresses, IP addresses or account IDs, kept briefly to count requests.
TaxJar — tax rate lookups for some calculations. The destination address and amount of the sale being calculated.
Your store platform (for example Shopify or WooCommerce) — only when you connect it

See our security page for how your data is protected.

Each provider has its own privacy policy governing the information it processes for us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For material changes, we will provide more prominent notice (including email notification for account holders).

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at support@sails.tax or visit our Contact page.