Privacy Policy

1. Who We Are

Nomad Holdings LLC is a limited liability company organized under the laws of the State of New York. We operate SellSmith, a B2B sales management application that enables sales representatives to manage orders, invoices, customer accounts, open balances, product catalogs, and related business operations.

For purposes of this Policy, "Subscriber" means a business that has subscribed to the Service. "Authorized User" means an individual (such as a sales representative or administrator) who accesses the Service on behalf of a Subscriber. "End Customer Data" means information about the Subscriber's own customers that is entered into the Service by Authorized Users.

2. Information We Collect

2.1 Account and Subscription Information

• Business name, address, and contact details
• Name, email address, and phone number of account administrators and Authorized Users
• Billing information, including payment card details (processed via Stripe — see Section 6)
• Username, password, and authentication credentials
• Subscription tier and plan details

2.2 Order and Transaction Data

• Sales orders, invoices, line items, product quantities, and pricing
• Payment records, open balances, credits, and returns
• Voided invoice records (permanently retained for audit purposes — invoices cannot be deleted)
• Signatures captured on the Order Summary screen
• Notes and remarks entered on invoices

2.3 End Customer Data

Authorized Users may enter information about their own customers ("End Customers") into the Service, including:

• Business name, DBA, Tax ID, and address
• Contact name, phone, mobile, fax, email, and website
• Account notes, terms, and payment history
• Open balances and invoice history

Subscribers are responsible for ensuring they have the legal right to submit End Customer Data to the Service. Nomad Holdings LLC processes End Customer Data on behalf of the Subscriber as a data processor.

2.4 Device and Usage Data

• Device type, operating system version, and app version
• Login timestamps and session activity
• Features accessed and actions performed within the app
• Crash reports and error logs

2.5 Location Data (GPS)

The Service collects GPS location data from Authorized Users' devices when the app is in use. This data is used to:

• Display customer locations on the map view
• Support route scheduling and sales rep location tracking (Team tier)
• Record GPS breadcrumb trails for Team administrators

Location data is collected only while the app is actively in use and with the device's permission. Users may revoke location permission through their device settings, though doing so will disable map and route features.

2.6 QuickBooks Integration Data

If a Subscriber connects their QuickBooks Online account to the Service, we access customer records, product/item data, and invoice information from QuickBooks solely for the purpose of syncing that data with SellSmith. We do not use QuickBooks data for any other purpose.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery — processing orders, generating invoices, managing customer accounts, and providing all features of the subscription plan
• Account management — creating and maintaining user accounts, authentication, and access control
• Payment processing — billing Subscribers for their subscription and processing payments through Stripe
• Security and fraud prevention — enforcing single-device login restrictions, detecting unauthorized access, and protecting against fraud
• Trial enforcement — disabling app functionality when a free trial expires, including in offline mode
• Customer support — responding to inquiries and resolving issues
• Service improvement — analyzing usage patterns to improve features and performance
• Legal compliance — meeting our obligations under applicable laws and regulations
• Communications — sending account notices, invoices, security alerts, and (with consent) product updates

We do not sell your data or the data of your End Customers to any third party. We do not use your data for advertising purposes.

4. How We Share Your Information

We do not sell, rent, or trade your information. We share information only as follows:

4.1 Service Providers

• Stripe — payment processing. Subject to Stripe's own Privacy Policy at stripe.com/privacy
• Amazon Web Services (AWS) — cloud infrastructure and data hosting
• Google Maps — map and location display features
• QuickBooks / Intuit — only when the Subscriber has authorized the integration
• Any other sub-processors are bound by confidentiality and data protection obligations no less protective than those in this Policy

4.2 Legal Requirements

We may disclose information if required to do so by law, subpoena, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Nomad Holdings LLC, our Subscribers, or the public.

4.3 Business Transfers

If Nomad Holdings LLC is involved in a merger, acquisition, asset sale, or bankruptcy, user information may be transferred as part of that transaction. We will notify Subscribers of any such transfer by email or prominent notice on the Service.

4.4 With Your Consent

We may share information in any other way with your explicit prior consent.

5. Data Retention

We retain information for as long as necessary to provide the Service and as required by law:

• Account data — retained for the duration of the subscription and for 3 years after termination
• Invoice and order records — retained for 7 years to comply with financial recordkeeping requirements. Invoices cannot be deleted — only voided. This is by design for audit integrity.
• GPS location data — retained for 90 days and then deleted, unless the Subscriber's Enterprise plan retains it for a longer period configured by the administrator
• Payment records — retained as required by Stripe and applicable financial regulations
• Crash and usage logs — retained for 30 days

Upon termination of a Subscription, we will delete or anonymize account and End Customer Data within 60 days, unless we are required by law to retain it.

6. Payment Processing and Security

All payment card transactions are processed by Stripe, Inc. Nomad Holdings LLC does not store full credit card numbers, CVV codes, or other sensitive payment card data on our servers. Stripe is a PCI DSS Level 1 certified payment processor. By using payment features in SellSmith, you agree to Stripe's Terms of Service and Privacy Policy.

Standard Stripe processing fees (2.9% + $0.30 per transaction) apply and are in addition to your SellSmith subscription fee.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption of data in transit via SSL/TLS
• Encryption of sensitive data at rest
• Single-device login enforcement — only one device may be logged in per user account at a time
• Password hashing and secure authentication
• Access controls limiting data access to authorized personnel
• Regular security monitoring

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a data breach that is reasonably likely to result in risk to your rights and freedoms, we will notify affected Subscribers without undue delay and within the timeframes required by applicable law.

8. Your Rights and Choices

As a Subscriber or Authorized User, you have the following rights with respect to your information:

• Access — you may request a copy of the personal information we hold about you
• Correction — you may update or correct your account information through the app or by contacting us
• Deletion — you may request deletion of your account and personal information, subject to our legal retention obligations. Note: invoice and order records cannot be deleted as they are required for audit and legal purposes.
• Data portability — you may request an export of your account and order data in a machine-readable format
• Withdraw consent — where we rely on consent to process your information, you may withdraw that consent at any time
• Object — you may object to certain processing of your information

To exercise any of these rights, contact us at legal@sellsmith.co. We will respond within 30 days.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to delete personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information
• The right to non-discrimination for exercising your CCPA rights

We do not sell personal information. To submit a CCPA request, contact us at legal@sellsmith.co. We will verify your identity before processing requests and will respond within 45 days.

10. Children's Privacy

SellSmith is a business-to-business application intended solely for use by adults acting in a professional business capacity. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that a person under 18 has provided us with personal information, we will delete it promptly.

11. Third-Party Links and Integrations

The Service may contain links to or integrations with third-party services (including QuickBooks, Google Maps, and Stripe). We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party service you connect to SellSmith.

12. International Users

SellSmith is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer. We take appropriate safeguards to ensure your information remains protected in accordance with this Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Subscribers by email and by displaying a prominent notice in the app at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy. If you do not agree to the changes, you must discontinue use of the Service.

14. Contact Us

For privacy-related questions, requests, or concerns, contact: