Privacy Policy | Tacobase

1. Who We Are

Tacobase ("we", "our", "us") operates the platform at tacobase.dev. We provide managed backend infrastructure — database, auth, realtime, and storage — to developers and their end users.

Questions? Reach us at support@tacobase.dev.

2. What We Collect

Account information

When you sign up we collect your email address and a hashed password. If you pay, we collect billing details through our payment processor (Stripe). We never store raw card numbers.

Usage data

We log API requests, request counts, storage usage, and error rates to operate the service and enforce plan limits. Logs are retained for 30 days then automatically deleted.

Your application data

Data you write into your tacobase instances (records, files, user accounts) is yours. We access it only to operate the service — backups, migrations, incident response — never for marketing or analytics.

Cookies & analytics

We use Vercel Analytics (privacy-friendly, no cross-site tracking) and a session cookie required to keep you signed in. We do not use third-party ad cookies.

3. How We Use Your Data

Provide and operate the tacobase platform
Process payments and send receipts
Send product and security updates (opt-out any time)
Investigate abuse and enforce our Terms of Service
Improve reliability and performance

We do not sell your data. Ever.

4. Who We Share Data With

We share data only with the vendors we need to run the service:

Stripe — payment processing
Railway — infrastructure hosting for tenant instances
Turso — platform metadata database
Vercel — dashboard hosting and edge functions

All vendors are bound by data processing agreements and may not use your data for their own purposes.

5. Data Retention

Account data is kept while your account is active. If you delete your account, we delete your data within 30 days, except where we are legally required to retain it (e.g., billing records for 7 years in some jurisdictions).

Instance backups are retained for 7 days on the Soft tier and 30 days on higher tiers.

6. Your Rights

Depending on where you live, you may have the right to:

Access a copy of your personal data
Correct inaccurate data
Delete your account and data
Object to or restrict certain processing
Data portability (export your data)

To exercise any of these rights, email support@tacobase.dev. We will respond within 30 days.

7. Security

We encrypt data in transit (TLS 1.2+) and at rest. API keys are hashed before storage. We conduct regular dependency audits and follow responsible disclosure practices. No system is perfectly secure — if you find a vulnerability, please report it to support@tacobase.dev.

8. Children

Tacobase is not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this policy. When we do, we will update the "Last updated" date at the top and, for material changes, notify you by email or a banner in the dashboard.