Privacy Policy

Version 2026-10-14.1. This draft is not in effect and is not legal advice. It will be replaced after counsel reviews it. Questions and support: legal@myprotrack.app.

DRAFT — NOT LEGAL ADVICE. Must be reviewed by a licensed attorney before publication. Version 2026-10-14.1. Effective October 13, 2026.

LSR Consulting ("ProTrack", "we"), [ADDRESS], operates www.myprotrack.app. This policy explains how we handle personal information.

1. Whose information

Account holders: owners, sales reps and others who sign in.
Homeowners and their co-applicants: people whose information a customer company enters. They do not use ProTrack. For this data the customer company is the business/controller and ProTrack is its service provider/processor; homeowners should direct requests to that company first.

2. Information we process

Account data (we are controller): name, email, phone (optional), password hash and authentication records, workspace role, Terms acceptance version and time, theme preference, Google Calendar connection tokens if connected. Customer Data (we are processor): homeowner and co-applicant names, phone numbers, email, home address and home coordinates; appointments, project, contract, financing/funding and commission details; marital status where recorded; records of communications and call logs (type, date, and notes — ProTrack does not itself call or text); notes; uploaded files, including contracts, paperwork, loan and finance documents, check images, photos, and credit application images that may show Social Security numbers, dates of birth, income and government ID. Billing data: plan, billing interval, seat counts, subscription and trial status, Stripe customer and subscription IDs, and the payer's email; card details are collected and stored by Stripe, not ProTrack. Technical data: IP address, device/browser data and server logs (Vercel); error reports and performance traces (Sentry), configured not to send IP addresses, cookies or user details and scrubbed before sending; Cookies/local storage: essential authentication cookies (Supabase) and a theme preference. We do not use advertising or third-party analytics cookies.

3. Sources

From you, from the company that invites you, from customer companies (Customer Data), from Google if you connect Calendar, and automatically from your device.

4. Purposes

Provide and secure the Service; authenticate; send invitations and service alerts; read uploaded documents with the Anthropic API to suggest contact fields (a person confirms before saving; that review is a suggestion a person confirms before saving, and it is not a promise that a Social Security number, date of birth, income figure, or government ID is left out of the suggestion. Inputs sent to the Anthropic API are not used for model training under its commercial terms, and are retained by the provider for a limited period (up to 30 days) for abuse monitoring, then deleted.); map and calendar features; billing; support; legal compliance. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it to market to homeowners.

5. Sensitive personal information

Uploaded credit applications may contain SSNs, government ID and financial information. We use such information only to provide the Service requested by the customer and as permitted by Cal. Code Regs. tit. 11 §7027(m); we do not use it to infer characteristics. Files sit in access-controlled storage. A workspace member sees a file only when that member's role allows the record.

6. Disclosure

To sub-processors listed at /privacy (currently Supabase, Vercel, Resend, Stripe, Sentry, the Anthropic API, and Google, including Google Calendar and Google Maps). Inputs sent to the Anthropic API are not used for model training under its commercial terms, and are retained by the provider for a limited period (up to 30 days) for abuse monitoring, then deleted.; to integrations you connect; to authorized ProTrack personnel for support, security and operations. Platform administrators, the accounts with the platform-admin role, can open a customer workspace for support, security, and operations. A customer user cannot grant themselves that role. When required by law; in a merger or acquisition subject to this policy.

7. Retention

Account data: while the account exists, then 90 days. Customer Data: while the workspace exists; after deletion or termination, removed from the live product, with restore snapshots and backups kept up to 90 days; uploaded files deleted within 90 days. Database backups of active workspaces: [database backup schedule — pending the host's published retention]. Billing records: as required for tax/accounting ([tax retention period]). Privacy request records: 24 months.

8. Your California rights

Access, deletion, and correction, opt out of sale/sharing (we do not sell/share), limit use of sensitive PI (we use it only for permitted purposes), and non-discrimination. Submit requests at legal@myprotrack.app [or WEB FORM / TOLL-FREE NUMBER]. We verify identity by matching the request to the signed-in account, or to a reply from the account email; authorized agents need signed permission. We respond within 45 days (extendable by 45 with notice). Appeal: [appeal process — pending counsel]. Requests about Customer Data are forwarded to or handled with the customer company. CCPA categories collected in the last 12 months: identifiers; Cal. Civ. Code §1798.80(e) records (incl. SSN, financial info in uploaded documents); characteristics (marital status); commercial information; internet activity; geolocation (home address coordinates); professional information; sensitive PI as above. None sold or shared.

9. Account and data deletion; export

Workspace owners can export workspace data in the product. To delete an account, open Profile and submit the deletion request. ProTrack stores the request. Files uploaded by that account are erased 90 days later. You can also email legal@myprotrack.app. Deletion follows §7.

10. Security

Encryption in transit, row-level tenant isolation in the database, role-based access. No system is perfectly secure; we will notify affected parties of breaches as required by law.

11. Google user data

If you connect Google Calendar, we use the access only to create and update events for your appointments, and our use of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. The connection is used to create and update appointment events.

12. Children

Not for anyone under 18.

13. International

Data is stored and processed in the United States.

14. Changes and contact

We will post changes here and notify of material changes. Contact: LSR Consulting, [ADDRESS], legal@myprotrack.app.