Privacy Policy

This policy explains what TaxesRadar collects, why, and how we protect it. We collect the minimum needed to run the Service and we never sell your data.

What we collect

• Account data: your email address and account settings.
• Connection credentials: the read-only API keys you connect (used only to read your sales).
• Sales metadata: transaction amounts, currency, and buyer country/state - used to compute thresholds. We do not need or store buyer names or card details.
• Product analytics: cookieless usage metrics - which pages were viewed and which actions were taken - via Vercel Analytics and PostHog. No cookie or device identifier is set and your IP address is discarded at ingestion, so we cannot recognise you across visits and do not try to.

The threshold check

The free threshold check runs entirely in your browser. A file you drop on it is read, parsed and evaluated locally and is never uploaded - not to us and not to our analytics. We record that a check was run and how many jurisdictions came back crossed or approaching; we do not record your figures, your file, or which jurisdictions they were.

The nexus study is the same. It is built in your browser from the file already there, and it is complete before you are asked for an address - the email unlocks a document that exists, it does not send anything away to fetch one. If you give us the address we store it with the same two counts, and nothing from the report.

How we use it

Solely to provide the Service: aggregating your sales by jurisdiction, comparing them to registration thresholds, and sending you alerts. We do not use your sales data for advertising and we do not sell it.

Access is read-only

TaxesRadar connects with read-only, restricted keys. It cannot move money, issue refunds, or change your billing. You can revoke access from your platform (e.g. Stripe) at any time.

Where your data lives

Data is stored on our infrastructure providers and protected with row-level security so each account can only access its own data. We rely on these sub-processors:

• Supabase - authentication and database.
• Vercel - hosting and cookieless traffic analytics.
• PostHog - cookieless product analytics, processed in the United States.
• Stripe / Paddle - the platforms you connect (read-only).
• Resend - sending alert emails (only if you enable email alerts).

Your rights

You can disconnect any platform, export or correct your data, and delete your account - which removes your profile, connections, and alert history. Email us to make a request.

Business customers

If you are connecting a business account and need the processor-side detail (what a stored sale row actually holds, the sub-processor list, security measures, breach handling, and how to get a signed DPA), that is set out on the data processing page.

Contact

Privacy questions or requests: privacy@taxesradar.com