This Privacy Policy explains what information AfterTax collects when you use the calculator and purchase the report, and how we handle it. We deliberately collect as little as possible.
1. What we collect
- Email address at the results gate. Before the calculator shows you any results, we ask for your email address and store it (along with a one-way hashed IP for abuse prevention) in our own database. We use it only to send you the report link if you purchase, to help you recover access if you lose it, and occasionally to follow up on the analysis. You can request deletion at any time — see section 5.
- Financial inputs you type into the calculator (property values, rent, mortgage terms, tax bracket, state, etc.). These are used in-browser to produce your Report and are saved to your browser's local storage so you can come back to them. We do not send these inputs to our servers linked to your email or Stripe record; they never leave your device except transiently during a single calculation.
- Email address at checkout. If you proceed to purchase, Stripe also collects your email during payment so we can send you a receipt and resend the unlock link. Stored associated with your Stripe session ID in a separate purchases table.
- Payment information. Card details are collected and processed entirely by Stripe. We never see or store your card number, CVC, or full card details. We store only the Stripe session ID, payment status, tier, amount, and currency for our purchase records.
- Minimal request metadata for abuse prevention. We store a one-way hashed IP address (not the raw IP) with a short timestamp to rate-limit the email gate and checkout attempts. Records older than one hour are deleted automatically.
2. What we do not collect
- No accounts, no passwords, no login.
- No advertising cookies, no third-party analytics trackers, no cross-site tracking pixels.
- No property addresses, names, phone numbers, or SSNs. The calculator does not ask for them and we do not want them.
3. Who we share with (subprocessors)
- Stripe, Inc. — payment processing and tax handling. See stripe.com/privacy.
- Lovable / Supabase — application hosting and database that stores the minimal purchase records described above.
We do not sell your data. We do not share it for advertising.
4. How long we keep it
- Purchase records (session ID, email, amount, status): kept as long as needed for tax, accounting, and dispute purposes.
- Rate-limit hashes: automatically deleted after one hour.
- Financial inputs you typed: only exist for the duration of your browser session; not stored server-side.
5. Your rights
Depending on where you live (GDPR, UK GDPR, CCPA/CPRA, and similar), you may have the right to access, correct, delete, or export the personal data we hold about you (in practice: your email address and purchase record). Email remerterasmus.work@gmail.com and we will respond within 30 days.
6. Security
Data is transmitted over TLS. Payment card data never touches our systems. Purchase records are stored in a managed database with row-level access controls. No system is perfectly secure; you use the Service at your own risk.
7. Children
The Service is not directed at children under 16 and we do not knowingly collect data from them.
8. Changes
We may update this Policy from time to time. The “last updated” date reflects the most recent change.
9. Contact
Privacy questions or data requests: remerterasmus.work@gmail.com.
Note: This Policy reflects what the app actually does today. If you later add analytics, third-party cookies, email marketing, or additional subprocessors, this page must be updated before those go live. GDPR/CCPA-specific disclosure requirements (legal basis, DPO contact, EU representative, right-to-appeal language) should be reviewed by a lawyer if you have meaningful EU/UK or California traffic.