Privacy
Not yet reviewed. This is accurate as far as it goes and has not been through a lawyer. It must be before the service takes payment.
Who operates this service
situs.tax is operated by Tributary & Co., LLC, 3992 Foothills Blvd, Ste 100 #100, Roseville, CA 95747, USA. Write to hello@situs.tax about anything on this page, including a request to see or delete what is held about you.
What this service holds
- Your account: email address, a password hash, and a billing reference once billing exists.
- Your API keys: a SHA-256 hash of each key, never the key itself. We cannot show you a key again after you create it, because we do not have it.
- Usage counts: how many lookups each account made, by day and by month.
- An audit log: sign-ins, key creation and revocation, with the originating IP address.
Addresses you look up
A rate lookup carries an address, and it is usually somebody else’s customer rather than yours. This is what happens to it.
What leaves this service
One thing, to one place. When a lookup gives a street and our own address index does not already hold it, the street, city, state and ZIP go to the United States Census Bureau’s public geocoding service to be placed on a map. It is the only outbound request the rate API makes to anyone, and a lookup by ZIP alone never leaves our server.
That endpoint is anonymous and public. It takes no key and we hold no account with it, which also means there is no contract and no data processing agreement standing behind it.
What we keep, and for how long
- A placed address is cached for 180 days, keyed on the address, and a job deletes expired entries daily. Two things about that window are worth saying plainly rather than leaving you to find them. The clock starts when we first place an address, not when it was last used, so an address looked up every week still ages out and is re-geocoded. And if it is submitted again after that, it is stored again with a fresh 180 days. The window bounds how long any one record lives. It does not bound how long a recurring address stays known to us.
- The street and the city are removed from the service’s own logs before the line is written. What it keeps on purpose is the path, the state, the ZIP, the date requested and the calling IP address, in three files of ten megabytes per running container, rotated away, with no archive behind them.
- The web server in front of it records the path only. It used to keep the whole request line, and the address is in the request line. It now writes to a log of its own, which holds the method, the path, the status and the calling IP, and is rotated away after a fortnight.
- Our error tracker receives no request data at all — no address, no ZIP, no query string, no headers or cookies. That is not a reading of the configuration: the payload that actually leaves the process was captured and checked, and it carries no request section.
Asking us to delete something
Write to hello@situs.tax and a person will do it. There is no button for this, and we would rather say so than imply a self-service control that does not exist.
Where it lives
All of it is on our own server, in one database. Encrypted backups of that database are kept in AWS S3. Nothing is sold, and no advertising or analytics third party is embedded in these pages.