Privacy Notice

SulSul handles the following information to provide SulSul Sales, authenticate users, share records and respond to incidents.

Information and purposes

We store email addresses, names, one-way password hashes, consent dates, workspace and team memberships and permissions, sales, expenses, notes, products, goals and operation/correction history. Workspace currency, business time zone and week start define how records are interpreted. Email addresses are used for verification and password resets. Confirmation codes are not stored as plaintext in the database. Identifiers derived from email addresses and connection sources limit abusive attempts. Server access logs may contain source IP addresses and access times.

Sharing between users

Workspace administrators and authorized members can view results within assigned permissions. Others’ amounts may be inferred by subtracting personal amounts from exact team totals. Administrators should check sharing permissions. Information already exported or shared, including CSV files, cannot be recalled through the app.

Storage and service providers

Records are managed on a contracted VPS using TLS communications. Verification email is delivered through Muumuu Mail SMTP, which receives the recipient and message content. The iPhone app is distributed through Apple’s TestFlight and App Store. We do not use advertising SDKs, location collection or advertising tracking. Attendance accounts and records are not automatically retrieved or combined.

Purchase and people-limit verification

To verify subscriptions and enforce people limits, we store the workspace, purchasing owner, a random app account token shared with Apple, original transaction ID, product ID, production/test environment, subscription state, expiry and last verification time. We verify Apple-signed information and send the transaction ID to Apple to check current status. We do not receive card numbers or Apple Account passwords. Signed payload bodies are not stored in the subscription ledger.

Account deletion removes the link to the purchasing owner. Workspace deletion removes its subscription status. To prevent the same purchase being reused for another workspace, we retain a minimal mapping of original transaction ID, environment and random app account token. This mapping contains no name, email or sales amounts and has no automatic expiry. Apple controls its own purchase and billing records.

Information on devices

The iPhone app stores sign-in information, drafts and pending records in this app’s device-only Keychain. Completion of account deletion clears that Keychain on this device. The selected interface language is stored separately in app preferences. It does not change workspace currency or dates.

Web login and ordinary drafts

Web sign-in uses an HttpOnly cookie. Ordinary drafts are stored in sessionStorage by user, workspace, sales/expense type, team and credited member. They include amounts, dates, notes, products and quantities and display snapshots. Discarding a draft, completing its save or signing out in that tab (including after account deletion) removes the ordinary draft. Other tabs’ or devices’ storage cannot be erased by this action alone.

Web pending operations, completion markers and diagnostics

Before sending, the Web client retains each operation in localStorage to prevent duplicates: operation ID, user/workspace/scope, entry method, amounts, dates, notes, products, quantities, price versions, permission version, business currency/calendar and display snapshots. Unknown results or failed verification remain stored so the same user can sign into the same workspace and check save status. Unlike ordinary drafts, pending operations are not uniformly removed when a tab closes, the browser restarts, the user signs out or account-deletion sign-out completes.

When the server confirms saved or not saved and local completion succeeds, a completion marker is retained in localStorage and that operation’s pending body is removed. A confirmed not-saved operation leaves an editable ordinary draft; confirmed saved removes its ordinary draft. Markers prevent an old tab from resurrecting the same pending operation.

Errors may retain a diagnostic code, user ID and operation ID in localStorage. Completion markers and diagnostics have no automatic expiry and remain after ordinary sign-out, account-deletion cleanup and completed saves. Legacy pending storage may remain to protect recovery. Browser settings or storage limits can cause storage failures or browser-initiated deletion. Interface language is stored separately per user in localStorage, including for signed-out use; it does not alter pending operation content.

Shared devices and clearing storage

Signing another device out revokes its server session; it does not remotely erase browser storage. Pending records, legacy entries, markers and diagnostics may remain after account deletion. Use separate browser profiles on shared devices. Clearing site data also removes information needed for save verification. Resolve pending saves or contact support first; do not simply enter the transaction again. After account deletion, the same account cannot sign back in to reconcile its pending records.

Retention and deletion

Active accounts and business records are retained to provide the service. Delete account in Settings removes the email, name, credentials, consent history and personal memberships, and invalidates all sessions. Workspaces you alone manage are deleted with their records. Shared workspaces retain amounts as shared business records after identifying links and associated notes are removed. Only the deleted internal ID and deletion time are kept to reapply deletion during recovery.

Verification email processing information is normally removed within a day after expiry. Daily backups expire within a maximum of 30 days. Restoring a backup reapplies later account deletions and invalidates old sessions and verification codes.

Contact and information requests

For access, correction, deletion or other questions, contact info@sulsul.jp. Identity verification may be required. Do not email passwords or confirmation codes. Support is not real-time.

Document version: 2026-09-20-billing