Privacy Policy

Last updated: October 9, 2026

Hello Sales ("we," "us," or "our") runs the hellosales.co and hellosalestax.com websites and the Hello Sales service. This policy says what information we collect, how we use it, and the choices you have. How long we keep it is in our Data Retention Policy.

Geographic scope

Hello Sales is for use in the United States only. We process U.S. state tax exemption certificates for U.S. businesses. We do not target, and do not knowingly collect information from, people outside the United States. If you are outside the U.S., please do not use our services.

Information we collect

Information you give us

  • Account information. When you sign up, we collect your name and email address.
  • Certificates you upload. When you upload a certificate, we receive the file. What happens to it depends on whether you have an account; see "Free validator" and the Data Retention Policy.
  • Your email at the free validator. After a free check, you can enter your email to see the full result and download a PDF. We collect the email address you enter, the part after the @ (your email domain), and your answer to one optional question about how many resale certificates your business receives each year. We use the email domain to work out which company you are with. We do not ask for your company name.
  • State notification requests. If the validator cannot process your document and you ask us to tell you when we support your state, we collect the email address you enter and the state.
  • Messages you send us. If you contact us, we keep the message and your contact details.

Information collected automatically

  • Usage data. We use Google Analytics 4 (GA4) to see how people use the site: pages visited, time on page, where visitors came from, and which of our own links they clicked (a short src tag in the web address). In the validator we also record events such as choosing or dragging in a file, a check finishing, the email form appearing, an email being submitted (with the optional answer, if given), and a PDF being downloaded. Google Analytics never receives your email address or anything from your certificate.
  • Cookies. We use cookies for analytics and to keep you logged in. See "Cookies" below.
  • Device information. Browser type, operating system and screen size, through our analytics tool.
  • A rate-limiting identifier. When you use the free validator, we compute a one-way hash (a scrambled code that cannot be turned back into the original) from your IP address, browser type and language. We use it only to limit how many checks one visitor can run in an hour. We do not store your IP address or browser details in readable form. The hash is deleted within 90 days.

A summary of your free check

When you enter your email at the free validator, we save a summary of the check, which we call a determination record. If you checked more than one certificate on the same visit, we save a summary of each of them under that email. Each summary contains: which state form it was (for example, New York ST-120), which version of our rules we used, the result (valid, not valid, partly valid, verification required, or couldn't confirm), the result sentence you saw, a list of the problems found (the name of the field and the message, not the value we read), which checks ran and what they found, and the time of the check.

It does not contain the values we read from the certificate — the buyer's name, address, tax ID or signature — and it does not contain the file. If you do not enter an email, we save no summary; only the anonymous usage metrics described in the Data Retention Policy.

Documents we cannot process

If the free validator cannot recognize your document, we record which state, and where possible which published form, it appears to be. We pick these from our own fixed list of state names, form names, form numbers and agency names. We do not record any text from your document.

How we use your information

  • To run the service. We read certificates with optical character recognition (OCR, which turns an image into text) and check them against each state's rules. For Texas and Pennsylvania we also compare the registration number on the certificate against a copy we hold of the state's public list of registered sellers. We do not send your certificate to any state agency.
  • To send you your determination. If you enter your email, we may email you the PDF of each result. These emails come from determinations@send.hellosales.co and replies go to matt@hellosales.co.
  • To follow up. We may email you about your check or about Hello Sales. You can stop at any time by replying to the email or using the unsubscribe link.
  • To communicate with you. Service updates and answers to your questions.
  • To improve the service. We study usage patterns and the check summaries to see which forms and which problems come up most, and to fix what is not working.
  • To measure what works. Whether visitors sign up, and how our advertising and content perform.

We do not sell your personal information, and we do not share it with anyone for advertising.

Free validator

The free validator lets you check a certificate without an account. When you use it:

  • Your file is sent to our OCR provider (AWS Textract), checked, and deleted right away. We never store the file.
  • Your result is shown in your browser. While the result page is open, your browser holds an encrypted copy of the result that only our server can open. That is how you can see the details and download a PDF without us storing your certificate data. It expires after 24 hours, or sooner if you leave the page.
  • You can see the result headline and the number of problems found without giving us anything.
  • If you enter your email, we keep your email, your email domain, your optional answer, and a summary of the check, as described above. We do not keep the contents of your certificate.
  • The PDF you download shows the values we read from your certificate. It is drawn from the copy your browser holds; we do not store the PDF. If we email you the PDF, that email passes through our email provider (see "Third-party services"), and a copy stays in your inbox.

Third-party services

We use these services to run Hello Sales. Each has its own privacy policy.

Cookies

  • Analytics cookies. Set by Google Analytics to tell visitors apart and to see return visits.
  • Login cookies. Set when you log in, to keep your session.

Most browsers let you control cookies in their settings. Blocking cookies may stop parts of the service from working.

Data security

We protect your information with encryption in transit (TLS) and at rest. The copy of your result held by your browser while the result page is open is encrypted with a key only our server has. No method of storage or transmission is completely secure, and we cannot promise absolute security.

Your rights

You may:

  • Ask what personal information we hold about you.
  • Ask us to correct it.
  • Ask us to delete your account and its data.
  • Ask us to delete the email you entered at the free validator and the check summaries linked to it.
  • Unsubscribe from our emails at any time.
  • Opt out of analytics by blocking cookies in your browser or using a tool such as the Google Analytics Opt-out add-on.

To do any of these, email privacy@hellosales.co. If you live in California, you have rights under the California Consumer Privacy Act (CCPA), including the right to know and the right to delete. We do not sell or share your personal information as those terms are defined in the CCPA.

Children's privacy

Hello Sales is not for anyone under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this policy. Material changes will be posted here with a new "Last updated" date.

Contact us

Questions about this policy or your data: privacy@hellosales.co.