Privacy Policy

The privacy of your data — and it is your data, not ours! — is a big deal to us. We promise we never sell your data: never have, never will.

What We Collect and Why

Identity & Access

When you sign up for Sufficiently Advanced Magic, we ask for your name, email address, and company name. That's so you can personalize your account and we can send you invoices, updates, and other essential information. We may also give you the option to add a profile picture, but we never sell this data to third parties.

Billing Information

When you pay for Sufficiently Advanced Magic, we ask for your credit card and billing address. That's so we can charge you, send you invoices, and so you can avoid fraud. Your credit card is passed directly to our payment processor (Stripe) and doesn't ever go through our servers.

Geolocation Data

We log access requests to our servers, which includes your IP address. We keep these logs for no more than 30 days.

Website Interactions

When you browse our marketing pages or use the application, your browser automatically shares certain information such as which operating system and browser version you are using. We track that information, along with the pages you are visiting, page load timing, and which website referred you for statistical purposes like conversion rates and to test new designs.

Cookies

We use session cookies to keep you logged in. They are temporary; once you close your browser, they expire. We do not use third-party tracking cookies. We do not honor Do Not Track signals from your browser — there is no cross-site tracking to opt out of.

Voluntary Correspondence

When you email us with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future.

Information We Do Not Collect

We don't collect any characteristics of protected classifications including age, race, gender, religion, sexual orientation, gender identity, gender expression, national origin, veteran status, or disability status. We don't collect biometric data.

When We Access or Share Your Information

Our default is to not access your information. The only times we'll ever access or share your info are:

• To provide products or services you've requested. We do use some third-party services to run our applications and only to the extent necessary.
• To help you troubleshoot or fix a bug. When you ask for help, we may need to access your account to identify or replicate the problem. We'll always ask for permission before looking at your account.
• When required by law. If authorities served us with a valid court order, we would be required to comply. We'll always try to notify you, unless legally prohibited.
• We never sell your data. Not now. Not ever.

Your Rights

We strive to apply the same data rights to all customers, regardless of their location. Currently some of these rights only apply in certain regions:

• Right to Know. You have the right to know what personal information is collected, used, shared, or sold.
• Right of Access. This includes your right to access the personal information we gather about you.
• Right to Correction. You have the right to request that we correct inaccurate personal information.
• Right to Erasure. You have the right to ask that your personal information be deleted.
• Right to Complain. You have the right to make a complaint regarding our handling of your personal information with the appropriate supervisory authority.
• Right to Restrict Processing. You have the right to request that we stop processing your data.
• Right to Object. You have the right to object to our processing of your data.
• Right to Portability. As an intermediary service, your sales data resides in your POS system and your journal entries reside in your accounting software — you can access them directly there. For a copy of the personal information we hold about you (account details, preferences, import history), contact us at the address below and we will fulfill your request.
• Right to Non-Discrimination. We will not discriminate against you for exercising your rights.

To exercise any of these rights, please email us at YourFriends@sufficientlyadvancedmagic.com.

Data Retention

We keep your information for as long as your account is active or as needed to provide you services. Sales report data and processed import records are retained for 730 days (2 years) from the date they were retrieved. If you close your account, we'll delete your data within 30 days from our servers and within 60 days from our backups.

Location of Data

All data we collect is processed and stored in the United States, on Amazon Web Services infrastructure.

Security

All data is encrypted via SSL/TLS when transmitted from your browser. Any files we store are encrypted at rest. We use Auth0 for secure authentication.

Changes & Questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. You can always find the current version at this URL.

Have a question, concern, or complaint about this policy? Please get in touch and we'll do our best to answer it.

Adapted from the Basecamp open-source policies / CC BY 4.0