Privacy Policy

This Privacy Policy explains how Ohio Sales Tax Calculator (operated by CalcWorks Media LLC, "we," "us," or "our") collects, uses, protects, and discloses information when you use our website (ohiosalestaxcalculator.com) and our authenticated cloud workspace application ("Ohio Sales Tax Pro" or the "Platform").

We understand that sales tax compliance involves highly sensitive business records, customer tax identification numbers, and legally binding exemption certificates. We adhere to strict data minimization, tenant-level security isolation, and transparent data processing standards.

We strictly do not sell, rent, trade, or monetize your exemption certificates, customer tax identification numbers, or business transaction figures to advertisers, data brokers, or commercial third parties.

We collect information in two distinct contexts depending on how you interact with the Service:

A. Public Calculator Visitors (No Account Required):

• When you use our public tax estimators, calculations run locally in your web browser via client-side JavaScript. Transaction amounts, product categories, and county selections are processed in volatile browser memory and are never transmitted to our servers or stored in any database.

• We collect basic, anonymous server logs (IP address, browser type, referring URL, timestamp) for security monitoring, DDoS mitigation, and hosting infrastructure stability.

B. Registered Platform & Workspace Users (Ohio Sales Tax Pro):

• Account & Identity Information: When you create a workspace account, we collect your work email address, full name, organization legal name, entity type (commercial vendor or CPA firm), Ohio Vendor's License number, home county, and designated workspace role.

• Exemption Certificates & Customer Records: When you upload documents to the Certificate Vault, we collect and store digital certificate files (PDF, PNG, JPG format) representing Ohio Forms STEC-B, STEC-U, STEC-CO, SST forms, or resale certificates. These documents contain customer business names, physical addresses, authorized signatures, exemption statutory reasons, sales covered, and effective dates.

• Customer Tax Identification Numbers: Exemption certificate documents and records deposited in your vault may contain customer Tax Identification Numbers, including Federal Employer Identification Numbers (FEIN/EIN), Ohio Vendor's License numbers, or out-of-state sales tax resale numbers provided by purchasers to verify statutory tax exemptions.

• Tax Schedules & Filing Summaries: We record gross sales, exempt sales, county-by-county sales breakdowns, and UST-1 return preparation logs created within your workspace to assist with Ohio Department of Taxation filing preparation.

• Authentication & Security Data: Session tokens, encrypted password hashes, and Cloudflare Turnstile bot verification challenge tokens.

We use collected information solely to provide, maintain, and secure the Platform, including:

• Operating the Certificate Vault to organize exemption records, verify expiration windows, and generate consolidated Audit Defense Packs.

• Calculating accurate Ohio Department of Taxation permissive and transit tax breakdowns across all 88 counties.

• Computing statutory timely filing discounts (0.75% discount under R.C. 5739.12) and assembling UST-1 return summaries.

• Dispatching transactional email notifications, including statutory rate change alerts, UST-1 filing cutoff reminders, security verification OTP codes, and password reset links.

• Enforcing multi-tenant security boundaries, preventing automated bot abuse, and diagnosing system performance issues.

To provide high-availability enterprise infrastructure and reliable compliance automation, we partner with specialized, vetted cloud service providers ('Subprocessors'). Your data is processed by and transmitted to the following subprocessors strictly to fulfill application functionality:

• Supabase Inc. (Delaware, USA): Primary database and encrypted cloud object storage infrastructure. Supabase hosts user authentication records, relational compliance tables, and stores uploaded certificate files in access-controlled storage buckets enforced by PostgreSQL Row-Level Security (RLS).

• Resend, Inc. (California, USA): Transactional email infrastructure utilized to deliver county rate change alerts, UST-1 filing deadline notifications, security verification codes, and password recovery emails. Resend receives the recipient email address and notification content.

• Cloudflare, Inc. (California, USA): Cloudflare Turnstile automated anti-bot verification to protect authentication forms from credential stuffing and spam.

• Vercel Inc. (California, USA): Global cloud hosting, content delivery network (CDN), serverless compute runtime, and edge network execution.

• Google LLC (California, USA): Google Analytics 4 (GA4) aggregated traffic measurement and performance monitoring with strict IP masking.

• PostHog, Inc. (Delaware, USA): Workspace telemetry and system error tracking, configured with IP address masking and personal data minimization.

• Accounting & Point-of-Sale Connectors (Optional / Planned): If you choose to connect third-party point-of-sale or accounting software when available, sales totals are retrieved solely to populate county sales breakdowns in your workspace.

All subprocessors are contractually bound by confidentiality and security obligations consistent with applicable data protection laws.

We implement comprehensive administrative, technical, and physical safeguards designed to protect exemption certificates, customer tax IDs, and compliance data against unauthorized access, loss, or alteration:

• Encryption in Transit: All communications between your browser, our web servers, and third-party APIs are encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS).

• Storage Encryption at Rest: Certificate files deposited in the Certificate Vault and database volumes are encrypted at rest using industry-standard AES-256 encryption.

• Strict Tenant Isolation (Row-Level Security): We utilize database-level PostgreSQL Row-Level Security (RLS) policies. Every database query and certificate storage access request is cryptographically scoped to your authenticated organization. No user or organization can view, query, or access another tenant's certificates, customer tax IDs, or filing data.

• Access Control: Workspace access is restricted based on authenticated credentials, multi-factor verification codes, and assigned organization roles.

Under Ohio Revised Code (R.C.) § 5703.58 and standard Ohio Department of Taxation audit rules, vendors are required to maintain sales and use tax exemption certificates and filing records for a statutory period of four (4) years (48 months) from the date of the transaction or return filing.

We retain your workspace records, certificate documents, and tax ID information for as long as your workspace remains active, allowing you to satisfy these state compliance mandates.

If you choose to close your account, you have the right to download and export your complete certificate archive (Audit Defense Pack). Upon account termination, your stored files and organization records are permanently purged from active production databases in accordance with our standard deletion schedules.

Regardless of your location, we provide you with comprehensive control over your compliance data:

• Access & Review: You can inspect all uploaded certificates, customer records, and filing figures directly within your workspace dashboard.

• Export: You can export certificates and tax breakdown worksheets at any time in standard formats (PDF archives, CSV, JSON).

• Correction & Update: You can update customer tax IDs, replace expired exemption certificates, and revise organization details directly in the app.

• Deletion: You can delete individual certificates from your vault or submit a request to delete your entire workspace account by contacting our privacy team.

Our website and business compliance software are designed exclusively for commercial vendors, tax professionals, and adult business owners. We do not knowingly collect or solicit personal information from children under 16.

We may update this Privacy Policy from time to time to reflect modifications in our software features, subprocessor integrations, or statutory tax regulations. When updates are published, the revised effective date at the top of this page will be updated.

If you have questions, concerns, or requests regarding this Privacy Policy, your certificate records, or the security of your customer tax IDs, please contact us:

Email: privacy@ohiosalestaxcalculator.com

Web Contact Form: ohiosalestaxcalculator.com/contact

Mailing Address: CalcWorks Media LLC, Attention: Privacy & Compliance, Columbus, OH.