Privacy Policy

a. Information You Provide Directly

• Account Information: Name, email address, and password when you register.
• Business Data: Inventory records, customer names, sale transactions, and other data you enter into the Service.
• Payment Information: Billing details (e.g., card number, billing address) collected and processed by Stripe. We do not store full payment card numbers on our servers.
• Communications: Messages or inquiries you send to our support team.

b. Information Collected Automatically

• Usage Data: Pages visited, features used, timestamps, and actions taken within the Service.
• Device & Log Data: IP address, browser type, operating system, referring URLs, and crash reports.
• Cookies & Similar Technologies: Session cookies required for authentication and functionality. We do not use third-party advertising cookies.

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Process subscription payments and send billing receipts via Resend.
• Authenticate users and maintain account security.
• Send transactional emails (e.g., sale receipts, password resets, trial expiration notices).
• Respond to support requests and communicate with you about your account.
• Monitor and analyze usage to improve the Service.
• Comply with legal obligations and enforce our Terms of Service.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide the Service you subscribed to.
• Legitimate Interests: Improving the Service, preventing fraud, and maintaining security.
• Legal Obligation: Complying with applicable laws and regulations.
• Consent: Where we have obtained your explicit consent (e.g., optional marketing communications).

We do not sell your personal data. We may share your information with:

• Supabase: Our database and authentication provider. Your data is stored on Supabase-managed servers. See Supabase Privacy Policy.
• Stripe: Our payment processor. Payment data is governed by Stripe's Privacy Policy.
• Resend: Our transactional email provider used to deliver receipts and notifications. See Resend's Privacy Policy.
• Legal Authorities: When required by law, court order, or to protect the rights and safety of our users or the public.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to affected users.

All third-party service providers are contractually obligated to protect your data and use it only for the purposes we specify.

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain data for up to 90 days for backup and legal compliance purposes, after which it is permanently deleted. Stripe retains payment records as required by financial regulations.

We implement industry-standard security measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit.
• Encrypted storage of passwords (bcrypt hashing via Supabase Auth).
• Row-Level Security (RLS) policies on all database tables to ensure users can only access their own data.
• Regular security reviews and access controls.

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we are committed to protecting your data using commercially reasonable means.

We use essential cookies to:

• Maintain your authenticated session.
• Remember your preferences within the Service.

We do not use cookies for advertising or cross-site tracking. You may disable cookies in your browser settings, but this may prevent certain features from functioning correctly.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Objection / Restriction: Object to or request restriction of certain processing activities.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time.
• California Residents (CCPA): You have the right to know what personal information is collected, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising your rights.

To exercise any of these rights, contact us at legal@freezerbooks.com. We will respond within 30 days.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will delete it promptly.

Your data may be processed and stored in the United States and other countries where our service providers operate. If you are located in the EEA or UK, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) for any international transfers of your personal data.

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice within the Service at least 14 days before the changes take effect. The "Effective Date" at the top of this page indicates when the policy was last revised. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team: