How we handle your data.

Data residency

US-East by default.

Customer data is hosted on Supabase in us-east-2 and served through Vercel's global edge. EU residency is a planned enterprise-tier option once we provision an EU Supabase project — until then, all customer data sits in us-east-2. Email security@tailroster.com if EU residency is a hard requirement for your facility and we'll share the current timeline.

• Primary database: Supabase us-east-2
• Application + static assets: Vercel global edge
• Backups: continuous point-in-time recovery (PITR), 7-day window

Encryption

AES-256 at rest. TLS 1.3 in flight.

Your data is encrypted on disk with AES-256 (Supabase managed) and in transit with TLS 1.3 (terminated at Vercel's edge). HSTS preload registration is on the roadmap; once the header is shipped and the domain is registered at hstspreload.org, we'll publish the proof here.

• At rest: AES-256, Supabase-managed keys
• In transit: TLS 1.3 terminated at Vercel's edge
• Card data: tokenized by Stripe; never stored on our servers

GDPR

For EU residents and the UK: you can request access, correction, deletion, or export of your personal data. We process operator data as a controller and pet-parent data as a processor on behalf of the facility. Cross-border transfers will be governed by the EU's Standard Contractual Clauses incorporated into our forthcoming Data Processing Addendum — see the Documents section below for how to request the current draft.

Email privacy@tailroster.com to exercise your rights. We respond within 30 days.

CCPA / CPRA

California residents can request a copy of personal data collected in the past 12 months, deletion of that data, and correction of inaccuracies. We do not sell personal information and we do not share it for cross-context behavioral advertising.

See the full privacy policy for the formal language.