Scope of This Policy
This Privacy Policy covers personal information that The SMB Tool("we," "us," or "our") collects through our website, application, emails, and related services (the "Service"). It does not cover websites or services operated by other companies, including government agencies and third-party filing portals that we link to from the Service. When you leave the Service through a link, the destination site's privacy practices apply, not ours.
Information We Collect
We collect the following categories of information:
- Account information — name, email address, and authentication identifiers (managed by our authentication provider). Optional profile fields you choose to provide.
- Business profile — entity type, state, city, industry, number of employees, formation date, and any custom fields or notes you add to a business profile.
- Uploaded content — documents, filings, licenses, permits, insurance certificates, W-9 forms, contractor records, and other files you upload to the Service.
- Communications — support tickets, feedback, feature requests, accuracy reports, and other messages you send us.
- Usage data — pages visited, features used, interaction timestamps, referring URLs, approximate location (from IP address), device type, browser, and performance metrics. We use this data in aggregate to improve the Service.
- Payment data — if you subscribe to a paid plan, billing information is collected and processed by our payment processor. We do not store full payment card numbers on our systems.
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service, including generating your personalized compliance calendar and obligations;
- Send compliance reminders, weekly digests, account notifications, and product updates according to your preferences;
- Respond to support requests and communicate with you about your account;
- Measure and improve the Service, diagnose problems, and develop new features;
- Prevent fraud, abuse, and security incidents;
- Process payments (via our payment processor) for paid subscriptions; and
- Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.
Legal Bases for Processing
Where applicable privacy laws (including the EU/UK GDPR) require a legal basis for processing, we rely on one or more of the following: (a) your consent; (b) performance of a contract with you (providing the Service you requested); (c) our legitimate interests in operating, securing, and improving the Service, where those interests are not overridden by your rights; and (d) compliance with a legal obligation.
Third-Party Service Providers
We use the following categories of third-party providers to operate the Service:
- Authentication provider — account creation, sign-in, and session management
- Email delivery provider — transactional and reminder emails
- Payment processor — subscription billing and card processing
- Cloud storage provider — document uploads (encrypted at rest)
- Hosting & infrastructure — application hosting, database, edge delivery, analytics, and error monitoring
- Queue & job runner — scheduled tasks and reminder dispatch
Each provider operates under its own privacy policy and is bound by data processing agreements with us. A current list of specific sub-processors is available upon request by contacting us at support@thesmbtool.com. We are not responsible for the privacy or security practices of any third-party provider beyond the protections required by our contracts with them.
Data Storage & Security
We use commercially reasonable physical, technical, and administrative safeguards designed to protect your information, including HTTPS in transit, encryption at rest for uploaded documents, role-based access controls, environment-level secrets management, and regular security reviews of our infrastructure.
However, no method of electronic transmission or storage is 100% secure. We cannot and do not guarantee the absolute security of your information. You are responsible for protecting your own login credentials, keeping your devices and software up to date, and promptly notifying us of any suspected unauthorized access to your account.
Data Retention
We retain your account data for as long as your account is active and as needed to provide the Service. If you delete your account, we will remove your personal data and uploaded documents within thirty (30) days, except where we are required or permitted to retain certain records longer to comply with legal, accounting, tax, or regulatory obligations, resolve disputes, detect fraud, or enforce our agreements.
Aggregated or de-identified data that cannot reasonably be used to identify you may be retained indefinitely for analytics, research, and product improvement.
Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your account and associated data;
- Export your data in a portable format;
- Object to or restrict certain processing;
- Withdraw consent where processing is based on consent; and
- Opt out of non-essential email communications at any time via account settings or by using the unsubscribe link in any such email.
To exercise any of these rights, contact us at support@thesmbtool.com. We will verify your identity before processing your request and will respond within the timeframes required by applicable law (typically within 30 days).
California & State Privacy Rights
If you are a resident of California, Virginia, Colorado, Connecticut, Texas, Utah, or another US state with an applicable consumer-privacy law, you may have additional rights, including:
- The right to know the categories of personal information we collect and the purposes for which it is used;
- The right to request deletion of your personal information;
- The right to opt out of the "sale" or "sharing" of personal information. The SMB Tool does not sell or share your personal information as defined by these laws;
- The right to correct inaccurate personal information; and
- The right to non-discrimination for exercising your privacy rights.
To submit a verifiable consumer request, contact us at support@thesmbtool.com. We will verify your identity before processing your request.
International Data Transfers
The SMB Tool is operated in the United States. If you access the Service from outside the US, your information will be transferred to, stored, and processed in the United States or other countries where our service providers operate. US privacy laws may differ from those in your country of residence. By using the Service, you consent to the transfer of your information to the United States and other jurisdictions.
Data Breach Notification
If we become aware of a data breach that compromises your personal information, we will notify affected users by email without undue delay, and in any event within the timeframe required by applicable law. Notifications may be delayed where necessary to avoid interfering with a law-enforcement investigation or to complete investigative and remediation steps.
Our notification will describe the nature of the breach, the categories of data affected, the steps we are taking, and steps you can take to protect yourself. Notification itself does not constitute an admission of liability.
Children's Privacy
The Service is intended for use by adult business owners, operators, and professionals. It is not directed at children, and we do not knowingly collect personal information from individuals under the age of 13 (or under 16 where a higher age applies under local law). If you believe we have collected data from a child, please contact us and we will promptly delete it.
Limits of This Policy
This policy describes our practices as of the effective date above and is provided for informational purposes. It does not create contractual rights in excess of those set out in our Terms of Service and does not limit the disclaimers, warranties, or limitations of liability set out there. To the maximum extent permitted by law, our total aggregate liability for any claim arising out of or related to this policy or the Service is subject to the limitations in our Terms of Service.
Changes to This Policy
We may update this policy from time to time. When we make material changes, we will notify registered users by email or by a prominent notice in the Service and will update the "Effective date" at the top. Your continued use of the Service after the effective date of a revised policy constitutes your acceptance of the revised policy.
Governing Law
This policy and any disputes arising from it are governed by the laws of the State of Washington, United States, without regard to conflict-of-law principles. Any action related to this policy is subject to the jurisdiction-and-venue provisions of our Terms of Service.
Contact
If you have questions about this privacy policy or how we handle your data, contact us at support@thesmbtool.com.