Data Retention Policy

This policy says how long Hello Sales keeps data and when we delete it.

Free validator (no account)

Your file. Your uploaded certificate is sent to our OCR provider (AWS Textract), checked, and deleted as soon as processing finishes. We never store the file.

Your result. The result is returned to your browser. While the result page is open, your browser holds an encrypted copy of the full result so you can see the details and download the PDF. Only our server can read that copy, and only when your browser sends it back. We do not store it. It expires after 24 hours, or sooner if you leave the page; to get the result again, check the file again.

If you do not enter an email. We keep anonymous usage metrics only: file type, page count, which state and form was identified (or, for documents we cannot process, which state and which published form it appears to be, picked from our own fixed list of state names, form names, form numbers and agency names), whether the check passed, how many problems were found, and processing time. These metrics never include the contents of your certificate, and never include your IP address or browser details in readable form.

Rate-limiting identifier. A one-way hash of your IP address, browser type and language is stored with the usage metrics to limit checks per visitor. It is deleted within 90 days.

If you enter your email. We keep:

• Your email address, your email domain, whether the domain is a free mail service (such as gmail.com), your answer to the optional question, and the date.
• A summary of each check linked to that email: the state form, the version of our rules, the result, the result sentence, the list of problems found (field name and message, not the value we read), which checks ran and what they found (including whether the registration number matched the state's public list, for Texas and Pennsylvania), and the time of the check.

We do not keep the values read from the certificate (buyer name, address, tax ID, signature), the file, or the PDF. The PDF is drawn fresh each time you download it and is not stored.

We keep your email and the summaries linked to it until you ask us to delete them, or 24 months after your last check, whichever comes first. Email privacy@hellosales.co to delete them sooner. Deletion is completed within 30 days.

Emailed PDFs. If we email you your determination PDF, our email provider (Resend) keeps a copy of that email, including the PDF, for 30 days, then deletes it. The copy in your inbox is yours.

State notification requests. If you ask us to tell you when we support your state, the email address you provide is kept until we contact you or you ask us to delete it. It is stored on its own and is not linked to any certificate you uploaded.

Account users

When you create an account and use Hello Sales to manage certificates:

Certificate files. Uploaded files (PDFs, images) are stored securely, encrypted at rest, for as long as your account is active.

Extracted data. Field values read from certificates (names, addresses, tax IDs, exemption types and so on) are stored in our database with your account. Validation results, and any edits you make, are kept with a full audit trail.

Account information. Your name, email address and settings are kept for as long as your account is active.

Data deletion

Individual certificates. You may delete any certificate from your account at any time. It is marked as removed straight away and permanently purged within 30 days.

Your account. Email privacy@hellosales.co to delete your account. Within 30 days we delete all certificate files, all extracted data and validation results, and your account information.

Free-validator email and summaries. Email privacy@hellosales.co. Within 30 days we delete your email and every check summary linked to it.

Backup and recovery

Database backups are kept for up to 30 days for disaster recovery. Deleted data may remain in a backup during that time. It is not reachable in normal operation and disappears as backups rotate.

Third-party data retention

• AWS Textract. Does not keep the content of processed documents after returning results, under its service terms.
• Resend. Keeps sent emails, including attachments, for 30 days.
• Google Analytics. Under our settings, event data is kept for 2 months and user-level data for 14 months. It never includes certificate content or your email address.

Legal obligations

We may keep some data longer if the law or a legal proceeding requires it, and only for as long as that requirement lasts.

Changes to this policy

We may update this policy. Changes will be posted here with a new "Last updated" date.

Contact us

Questions about retention, or to request deletion: privacy@hellosales.co.