Privacy Policy

1.1 Personal Information You Provide

When you register for an account or use our services, we may collect:

• **Name** - Your full name for account identification
• **Email Address** - For account creation, communication, and password recovery
• **Password** - Encrypted and securely stored using industry-standard bcrypt hashing
• **Business Information** - Business name, address, and tax identification details
• **Property Information** - Home address and property details for tax calculations
• **Meeting Records** - Business meeting dates, attendees, and purposes
• **Payment Information** - Processed securely through Stripe (we do not store credit card numbers)

1.2 Automatically Collected Information

When you access our services, we automatically collect:

• **Login Activity** - IP address, device type, browser, operating system, and timestamps
• **Usage Data** - Pages visited, features used, and interaction patterns
• **Cookies** - Session cookies for authentication (HTTP-only, secure)
• **Analytics Data** - Aggregated usage statistics to improve our services

1.3 Third-Party Authentication

If you sign in using Google OAuth, we receive:

• Your Google account email address
• Your Google profile name
• Your Google user ID (for account linking)

We do not have access to your Google password or other Google account information.

2.1 Service Delivery

• Create and manage your account
• Calculate Augusta Rule tax deductions
• Generate tax-compliant documentation
• Process payments and manage subscriptions
• Provide customer support

2.2 Security & Fraud Prevention

• Monitor login activity for unauthorized access
• Detect and prevent fraudulent transactions
• Enforce our Terms of Service
• Comply with legal obligations

2.3 Service Improvement

• Analyze usage patterns to improve features
• Develop new functionality based on user needs
• Optimize application performance
• Conduct research and analytics

2.4 Communication

• Send service-related notifications
• Respond to your inquiries and support requests
• Provide updates about new features (with your consent)
• Send important account or security alerts

3.1 Service Providers

We share data with trusted third-party service providers who assist us in operating our services:

• **Stripe** - Payment processing (PCI-DSS compliant)
• **Google** - OAuth authentication and Maps API
• **Railway** - Database hosting (encrypted connections)
• **Render** - Application hosting (HTTPS enforced)
• **AWS S3** - Secure file storage

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

3.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or subpoenas
• Government or regulatory requests
• Legal proceedings or investigations
• Protection of our rights, property, or safety

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email and/or prominent notice on our website before your information is transferred.

3.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

4.1 Technical Safeguards

• **Encryption in Transit** - All data transmitted over HTTPS/TLS
• **Encryption at Rest** - Database connections encrypted with SSL
• **Password Hashing** - Bcrypt with salt (10 rounds)
• **Secure Sessions** - HTTP-only, SameSite cookies with JWT tokens
• **SQL Injection Prevention** - Parameterized queries via ORM
• **XSS Protection** - React auto-escaping and Content Security Policy

4.2 Operational Safeguards

• Regular security audits and vulnerability assessments
• Access controls and role-based permissions
• Login activity monitoring and alerts
• Automated backups and disaster recovery
• Employee training on data protection

4.3 Limitations

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your information using industry best practices.

5.1 Access and Portability

You can access your account information at any time through your profile page. You may request a copy of your data by contacting us at privacy@augustarule.org.

5.2 Correction and Update

You can update your name, email, and password directly in your profile settings. For other corrections, contact our support team.

5.3 Deletion

You can delete your account at any time through the profile page. This will permanently remove your personal information from our active databases. Note that we may retain certain information as required by law or for legitimate business purposes (e.g., transaction records for tax compliance).

5.4 Opt-Out of Marketing

You can opt out of promotional emails by clicking the "unsubscribe" link in any marketing email or by updating your preferences in your account settings.

5.5 Do Not Track

Our service does not currently respond to "Do Not Track" browser signals, but we do not track users across third-party websites.