Privacy Notice

The personal data we collect falls into four buckets:

• Account data. Admin email, display name, role (admin / operator / viewer), Supabase user ID, IP address of sign-in, and last-active timestamp.
• Tenant configuration. Brand assets you upload (logos, color preferences) and master-data records you enter (terminals, products, carriers, business partners). Some of these contain third-party personal data such as carrier driver names — see "Customer Data" in the terms.
• Operational metadata. Audit log of actions taken in the console (who triggered which run, who edited which allocation control), timestamped.
• Diagnostic data. Server logs that may contain user-agent strings, request paths, and error stack traces. Personal data in logs is minimized but cannot be guaranteed absent.

• To operate the Service (authentication, tenant isolation, audit).
• To diagnose and fix issues you report.
• To communicate about your account (transactional emails — magic-link sign-in, invite emails).
• To improve the Service. We do not use Customer Data to train shared models or for marketing to third parties.

We share personal data only with the following sub-processors, each contractually bound to a confidentiality and data-protection standard at least as strong as this notice:

• Supabase — authentication, database hosting (us-east-1 by default).
• Amazon Web Services — UI hosting (Amplify), application servers (Lightsail), secrets, backups (us-east-1).
• Vercel (Next.js telemetry) — anonymized framework usage. Disabled in our build configuration.

We do not share personal data with advertising networks, analytics brokers, or data resellers.

By default, all personal data is stored in AWS us-east-1 (Northern Virginia). EU residency on AWS eu-west-1 is available on request but is not currently enforced automatically by the sign-up flow. If you need EU residency for GDPR compliance, contact us at legal@terminaliq.io before activating your tenant.

We retain personal data for as long as your tenant is active. On tenant termination we delete or anonymize personal data within ninety (90) days, except where retention is required by law (tax records, audit logs subject to legal hold). Backups containing deleted data age out over thirty (30) days.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Delete your personal data (subject to legal retention requirements).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Lodge a complaint with a supervisory authority (EEA / UK residents).

To exercise these rights, email privacy@terminaliq.io. We will respond within thirty (30) days.

We use TLS in transit, AES-256 at rest (via AWS-managed encryption), per-tenant database isolation, and the principle of least privilege for internal access. Authentication is via Supabase magic-link; passwords are hashed with bcrypt and never logged. See the Security page for our current security posture.

If you believe your tenant has been compromised, contact security@terminaliq.io immediately.

We use strictly-necessary cookies for authentication (Supabase session) and to remember your tenant slug. We do not use third-party tracking cookies or advertising pixels. Cookie duration: session cookies expire on sign-out; the Supabase refresh token persists for one (1) week unless you sign out.

We may update this notice with at least ten (10) business days notice via email to your tenant admin. The current version is always available at this URL; prior versions are archived under /legal.

Calabash Financials, Inc.
Privacy: privacy@terminaliq.io
General: support@terminaliq.io