Sazi Privacy Policy
Effective: 2026-09-10 · Version: 1.0
This policy explains what information Sazi LLC ("Sazi", "we") handles when you visit usesazi.com, when your business uses the Sazi service (the "Service"), and when you contact us. It is written for the businesses that are our customers and for the people — owners, staff, and contacts — whose information those businesses enter into the Service.
1. Who we are and how to reach us
Sazi is the software product and trade name of Sazi LLC, a an Illinois limited liability company. Privacy requests: privacy@sazierp.com. Security reports: admin@sazierp.com. General support: support@sazierp.com, (847) 999-3169. Sales: sales@sazierp.com. Mailing address: available on request.
2. Two roles: your business's records, and our own
Most information in the Service is your business's records — inventory, production, compliance, customer, vendor, invoicing, accounting, and reconciliation data, and the files you upload. For those records the customer decides why and how they are used; Sazi processes them on the customer's instructions and under the Customer Agreement (in privacy-law terms, the customer is the controller and Sazi is the processor). If you are a person whose details appear in a customer's tenant — for example a contact at a distributor — the customer is responsible for that data and for answering your requests about it; we will help the customer do so.
For a smaller set of records Sazi acts for its own purposes: your account with us, subscription billing, security and audit logs, and records we must keep by law. Section 6 says how long we keep each kind.
3. Information we handle
Account and identity. Name, work email, tenant membership, roles, and authentication records for each authorized user. Sign-in is operated by an identity provider (Section 5); Sazi stores the provider's user reference, not your password.
Tenant business records. Whatever an authorized user enters or generates in the Service. This can include personal information about the customer's staff, customers, and vendors (names, work contact details, order history) and regulated business records (production, gauging, TTB and state reports, invoices, ledgers).
Uploaded files and documents. Attachments, documents, and generated exports, stored as opaque objects.
Usage, diagnostic, and security records. Request logs, IP address, browser and device type, timestamps, feature usage, error reports, and an audit trail of significant actions (who did what, when). We use these to run and secure the Service and to investigate problems.
Subscription and billing records. Order details, invoices, payment status, and payment-provider event records for Sazi's own fees. Where a card is used, the payment processor holds the card details; Sazi does not directly store full card numbers.
Connected-provider data — only when you enable it. If a customer connects an integration, we exchange the data that integration needs: payment-status events from the customer's own payment-processor account, or, when an accounting connector is offered, invoice and payment records with an accounting system. (Today Sazi produces a journal-entry CSV the customer uploads to its own accounting system; no accounting provider receives data from Sazi.) When bank connection is enabled, an authorized customer may consent to connect its own business bank account for bookkeeping and reconciliation; the intended scope is transactions and the minimum non-sensitive account metadata needed to match them, and does not include balances, account-ownership verification, instant verification, lending, or underwriting. Nothing is connected without the customer's express action.
Website visitors. If you only browse usesazi.com, we receive standard server logs (IP address, pages requested, user agent). The public site sets no advertising or cross-site tracking cookies. The public site loads no analytics or tracking scripts.
We do not knowingly collect information from anyone under 18, and the Service is not directed to them.
4. Why we use information
- to provide the Service: authenticate users, isolate tenants, run the workflows and integrations a customer has enabled, store and return files, and produce exports;
- to support customers and respond to requests;
- to secure the Service and investigate incidents, fraud, or misuse;
- to administer subscriptions and invoice our fees;
- to meet legal obligations, including tax and accounting record-keeping;
- to understand reliability and improve the Service, using diagnostic data and de-identified aggregate statistics.
We process tenant business records on the customer's instructions; we act for our own purposes only for security, fraud prevention, subscription billing, and legal compliance records.
5. How we share information
Service providers. We use providers for application hosting, data storage, authentication, and, where a customer enables them, payment processing and customer-requested integrations. Each provider processes information only as needed to perform its function, under contract, and is listed by name in the subprocessor roster we supply to customers on request and in our data-processing addendum. All current providers store the Service's data in the United States.
The customer and its authorized users. Data in a tenant is visible to the users that customer authorizes, according to the roles the customer assigns.
Integrations you connect. When a customer connects a third-party account, the data that integration requires flows to that provider under the provider's own terms.
Legal and protective disclosures. We may disclose information when required by law or legal process, to protect the rights, safety, or property of Sazi, our customers, or others, or to enforce our agreements. Where lawful, we will tell the affected customer before disclosing its records in response to a legal demand.
Business transfers. If Sazi is acquired or reorganized, information may transfer to the successor, who will be bound by this policy for the data it receives.
We do not sell, license, or distribute customer or personal information, and do not share it for targeted advertising. We do not use customer or tenant data to train machine-learning models. Your data remains yours.
6. Retention and deletion
Retention follows the Sazi data-retention matrix. In summary:
| Data | Retained | Why |
|---|---|---|
| Paid customer's tenant business records, files, documents | Three years after account closure, or earlier through the verified deletion process | The customer's own record-keeping (TTB records must be kept three years); aligned to craft-beverage software practice |
| Never-converted trial or demo tenant | Leaves live systems 30 calendar days after trial access ends | No paid-custody expectation |
| TTB and other regulated records inside a tenant | May follow the record-specific regulatory schedule | Regulatory |
| Integration credentials and mappings | Life of the connection; revoked at the provider and removed on disconnection or deletion | Only needed while connected |
| Security and audit records (Sazi's own) | Three years | Security, fraud, dispute defense |
| Subscription billing and tax/accounting records (Sazi's own) | Seven years | Legal obligation |
| Deletion evidence (counts and digests only, no content or identifiers) | Three years | Accountability |
Erasing sooner. A tenant administrator can request deletion before the three-year window ends. Because deletion is permanent, we require the verified process described in the Customer Agreement: download a complete export or expressly decline one, acknowledge that Sazi will not retain the records, pass a multi-factor step-up, confirm the tenant name, and let the seven-day withdrawal window lapse. Every active administrator is notified. Deletion removes the tenant's business records, files, documents, and integration credentials from live systems and revokes provider access; Sazi keeps only its own billing, security, and audit records listed above, which contain no business content.
Backups. Backups rotate under infrastructure schedules and are not selectively edited; deleted data is not restored into live service without deletion reconciliation. We do not promise a fixed backup-deletion deadline.
Legal holds. A subpoena, litigation hold, or record-specific regulatory duty can extend retention of the affected records.
7. Your choices and requests
An authorized customer can request access, export, correction, provider disconnection, or deletion through the privacy contact, and can run an export or start deletion from the Service directly. We verify authority before acting and explain when a request is limited by another customer's instructions or a legal retention duty.
If you are an individual whose information a customer entered, contact that customer first; if you contact us, we will forward your request to the customer and assist. Where a state or national privacy law gives you rights against Sazi directly (for example to know, correct, delete, or opt out), you may exercise them through the privacy contact. We will not treat you differently for doing so. Anyone can unsubscribe from non-essential email with the link in the message.
If you are not satisfied with our response, tell us and we will escalate it to the owner within five business days; you may also contact your state attorney general or the applicable supervisory authority.
A data-processing addendum, including the named subprocessor roster, is available to customers on request.
8. Security and incidents
We use administrative, technical, and organizational safeguards designed for the nature of the Service: tenant isolation enforced at the database, encryption in transit and at rest at our providers, multi-factor authentication for administrative actions, role-based access, audit logging, and restricted operator access. No system can promise absolute security.
If we confirm a security incident affecting your tenant, we will notify your tenant administrators by email without undue delay after confirming it, describe what we know, and update you as we learn more. Report a suspected incident or vulnerability to admin@sazierp.com with the subject line \"Security\".
9. Where data is processed
Sazi and its providers process and store Service data in the United States. If a customer or user is outside the United States, using the Service transfers data to the United States.
10. Changes
We will post changes here with a new effective date and, for material changes, email tenant administrators at least 30 days before they take effect. Changes do not shorten a retention or export commitment that was in effect when a subscription closed.