Privacy Policy

We collect information in three ways:

a. Information you give us

• Account information — your name and email address when you register. Your password is stored only as a salted one-way hash; we never see or store it in plain text.
• Billing information — when you subscribe, payment is processed by Stripe. Your card number is entered directly with Stripe and is never transmitted to or stored on our servers. We retain only non-sensitive billing metadata such as your plan, subscription status, renewal date, and a Stripe customer reference.
• Communications — information you provide when you email us, request support, or respond to a survey.

b. Information collected automatically

• Usage & device data — pages viewed, searches run, approximate location (derived from IP), browser type, device type, and referring pages. This helps us keep the Service reliable and understand how it’s used.
• Log & security data — IP address, timestamps, and event records used to operate the Service, prevent fraud and abuse, and maintain an audit trail of account and billing activity.
• Cookies & analytics — see Cookies & analytics below.

c. Information about Texas properties

The hotel and mixed-beverage tax records in the Service are public records published by the Texas Comptroller of Public Accounts. They describe businesses and properties, not you as a visitor, and are not personal information about our users.

We use the information we collect to:

• Provide, maintain, and operate the Service and your account.
• Process subscriptions, payments, and renewals through Stripe.
• Authenticate sign-ins and protect against fraud, abuse, and bots.
• Respond to your support requests and communicate with you about your account.
• Understand and improve how the Service is used, and develop new features.
• Send service messages (e.g. receipts, security and billing notices) and — where permitted — occasional product updates you can opt out of at any time.
• Comply with legal obligations and enforce our terms.

We do not use your personal information for third-party advertising, and we do not engage in automated decision-making that produces legal or similarly significant effects about you.

Cookies are small files stored by your browser. We use a small, purpose-limited set:

• Essential cookies — keep you signed in and secure your session. The Service can’t function without these, so they aren’t optional.
• Bot-protection — we use Cloudflare Turnstile on our sign-in, registration, and password forms to block automated abuse.
• Analytics cookies — we use Google Analytics 4 to understand aggregate traffic and usage (for example, which pages are most useful). Google sets cookies and processes usage data on our behalf. We have not enabled Google advertising features, remarketing, or ad personalization.

You can control analytics and cookies:

• Adjust or block cookies in your browser settings. Blocking essential cookies may break sign-in and other features.
• Opt out of Google Analytics across all sites with Google’s Analytics Opt-out Browser Add-on.
• We honor recognized browser privacy signals, including Global Privacy Control (GPC) — see Do Not Track & GPC.

We do not sell, rent, or trade your personal information. We share it only in these limited circumstances:

• Service providers who process data on our behalf under contract and only as needed to run the Service:Supabase (database & authentication), Stripe (payments), Vercel (hosting), Google (analytics and maps), and Cloudflare (bot protection). Each is bound to keep the information confidential and use it only for the services they provide to us.
• Legal & safety — when we reasonably believe disclosure is required to comply with law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of our users or others.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We’ll notify you of any change in ownership or use of your personal information.

All payments are handled by Stripe, a PCI-DSS Level 1 certified payment processor. Your full card details are entered directly into Stripe’s secure fields and are not stored or processed on our servers. Stripe’s handling of your payment data is governed by Stripe’s Privacy Policy. You can review invoices and manage your payment method through the billing portal in your account settings.

We keep your account information for as long as your account is active and as needed to provide the Service. After you close your account, we retain limited records where necessary to comply with legal, tax, and accounting obligations, resolve disputes, prevent fraud, and enforce our agreements — then delete or de-identify the rest. Aggregated or de-identified analytics data that can no longer be linked to you may be retained indefinitely.

We use a range of safeguards to keep your information secure:

• All traffic is encrypted in transit with TLS/SSL.
• Passwords are stored only as salted one-way hashes — never in plain text.
• Access to personal data is restricted to authorized personnel and enforced at the database level with row-level security.
• Card data is isolated with Stripe and never touches our servers.
• We monitor for vulnerabilities and abuse on an ongoing basis.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us right away at compliance@searchtexastax.com.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request a copy, to request correction or deletion, and to not be discriminated against for exercising these rights. We do not sell or “share” your personal information (as those terms are defined under California law), so there is no need to opt out of a sale — but we still honor opt-out preference signals such as Global Privacy Control. To make a request, email compliance@searchtexastax.com. We will verify your request through your account email before acting on it.

California “Shine the Light” & CalOPPA

We do not share personal information with third parties for their own direct marketing. You may browse the Site without creating an account, this policy is linked from every page, and we’ll post any changes here as described in Changes to this policy.

EEA & UK residents (GDPR)

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. Our legal bases for processing are performance of our contract with you (providing the Service), your consent (e.g. analytics cookies and optional marketing), and our legitimate interests in securing and improving the Service. You may withdraw consent at any time and have the right to lodge a complaint with your local data protection authority. Contact compliance@searchtexastax.com to exercise these rights.

The Service is a professional research tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18 (and never from children under 13, consistent with the Children’s Online Privacy Protection Act). If you believe a child has provided us personal information, contact us and we will delete it.

Some browsers offer “Do Not Track” (DNT) and Global Privacy Control (GPC) signals. Because there is no industry-wide standard for DNT, we treat a recognized GPC signal as a valid request to opt out of any sale or sharing of personal information for cross-context behavioral advertising. As noted above, we don’t sell or share your personal information and we run no advertising, so this is already our baseline practice.

We use your email address to send account, billing, and security messages related to your subscription, and — only where permitted — occasional product news. In accordance with the CAN-SPAM Act, we will not use false or misleading subject lines or sender information, we identify promotional messages as such, we include our physical mailing address, and we honor unsubscribe requests promptly. You can opt out of non-essential email using the unsubscribe link in any such message or by emailing compliance@searchtexastax.com. Transactional messages necessary to operate your account will still be sent.

The Site may link to third-party websites we don’t control. Their privacy practices are governed by their own policies, and we are not responsible for their content or how they handle your information. We encourage you to review the privacy policy of any site you visit.

If a data breach affects your personal information, we will notify affected users without undue delay — by email and, where appropriate, by notice within the Service — and will comply with applicable breach-notification laws. You retain the right to pursue any legal remedies available to you under those laws.

We operate in the United States, and our service providers may process and store data in the United States and other countries. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S., where data-protection laws may differ from those in your country.

We may update this Privacy Policy from time to time. When we do, we’ll revise the “Last updated” date at the top of this page and, for material changes, provide a more prominent notice (such as an email or an in-Service notice). Your continued use of the Service after an update means you accept the revised policy.

If you have questions about this Privacy Policy or your personal information, contact us: