Privacy Policy

Last updated Oct 13, 2026

At Trac, we respect your concerns about privacy. This Privacy Policy describes the practices of TKO SOLUTIONS L.L.C (doing business as "Trac") regarding the collection and use of personal information through our application at app.trac.bot, our mobile app, and other services or websites that display this Policy. It explains the measures we take to protect your personal information, the parties with whom we may share the information, and your choices about our use of the information.

This Privacy Policy addresses personal data processing. Product usage terms, service disclaimers, and liability limitations are governed by our Terms of Use.

If you are a California consumer, please refer to the California Consumer Privacy Statement section for more information about your privacy rights.

Personal Information Collected

We collect personal information in a variety of ways through our website and platform services (collectively, the Services):

Login credentials: Information provided when you access our Services.
Communications: Details from inquiries submitted via email, forms, or other communication methods.
Contact details: With your consent, we may use your contact information to provide updates about our products and services.
Professional information: Job titles, work-related contact information, and other details you provide.
Other: Any additional information you provide during your use of our Services.

We also process personal information uploaded to our platform by Trac customers, who are typically financial professionals. This information, known as Customer Data, is processed on behalf of our customers who act as data controllers. Customer Data may include information about financial accounts, names, and contact details. Trac acts as a data processor for Customer Data and adheres to agreements with our customers and applicable laws.

If required by law or contractual terms, we may need to collect specific personal information from you. Failure to provide such information may limit access to our Services.

Automated Information Collection

When using our Services, we collect certain information automatically, including IP addresses, browser types, device identifiers, and usage patterns. This data is collected using technologies like cookies and web beacons to:

Enhance and personalize your experience.
Improve the effectiveness of our Services and marketing efforts.
Measure usability and troubleshoot issues.

You can manage cookie preferences through your browser settings, but certain features may be impacted. Our Services do not currently respond to Do Not Track signals.

Use of Personal Information

We use personal information to:

Deliver and manage our Services.
Authenticate users and secure access to accounts.
Communicate about services, respond to inquiries, and provide updates.
Maintain and improve our Services, conduct analytics, and develop new offerings.
Prevent fraud, comply with legal requirements, and enforce our terms of use.
Tailor your experience on our platform.

Where available, features may include automated or AI-assisted functionality. We may process relevant account and usage data to provide, secure, monitor, and improve those features, consistent with this Policy and applicable law.

Where required by law, we will obtain your consent before processing your personal information.

Disclosure of Personal Information

We may share personal information with:

Service providers: To facilitate our operations, such as data storage, customer support, and legal services.
Business transfers: During mergers, acquisitions, or similar transactions.
Legal and security obligations: To comply with legal requirements or protect our rights and interests.

We do not sell personal information or use it for targeted advertising without consent.

Your Rights

You may request access to, correction, or deletion of your personal information. To exercise these rights or update your preferences, please contact us at data@trac.bot. If we process your data on behalf of a customer, we will forward your request to the appropriate data controller.

Security and Data Retention

We implement technical and organizational measures to protect your data. Personal information is retained as long as necessary for legitimate business purposes or to meet legal obligations.

While we implement safeguards, you are responsible for the accuracy and completeness of data submitted by you or on your behalf. Data quality issues in submitted records may affect outputs and reporting.

Retention of portfolio data

Customer Data is kept for as long as the portfolio exists, with these exceptions, which expire automatically:

Files attached in a chat with Trac expire after 1 day. A file Trac saves from the chat into your portfolio is kept like any other file you upload.
Copies of attachments that arrive with an email Trac is asked to act on expire after 18 days.
The raw copy of an email sent to Trac expires after 3 days. Its attachments and a copy of the message are filed into your portfolio and kept like any other file you upload.
Files staged while an upload is processed expire after 1 day.
Snapshots of data received from your connected financial institutions expire after 90 days.
Saved copies of chat conversations expire after 2 years.

Automatic expiry runs once a day, so an item can remain for a short time after its period ends.

Everything else persists until the portfolio is deleted. That includes files you upload, your accounts, ledger and transactions, and the documents and knowledge that Trac's AI assistant keeps about your portfolio. If a single document is deleted inside Trac, earlier versions of it are kept until the portfolio is deleted.

Deleting a portfolio

You can ask us to delete a portfolio by following Data Rights and Account Requests. A person on our team carries out the deletion once we have verified the request. When a portfolio is deleted, we:

Permanently delete every file stored for it, including uploaded statements, imported and processed data, attachments, saved conversations, and the documents and knowledge kept by Trac's AI assistant, along with every earlier version of those files.
Disconnect the portfolio's connected financial institutions, so the data provider stops holding the connection.
Delete the portfolio's database records, its history of activity, and the encryption key records for its data.
Delete the sign-in accounts that belong only to that portfolio. A person who also belongs to another portfolio keeps their account and loses only their access to the deleted one.
Schedule the portfolio's encryption key for destruction. The key is destroyed after a waiting period of 30 days.

Some copies are removed on a schedule and not at the moment of deletion. In our production service, continuous database backups age out within 35 days of the deletion. Operational logs, which are kept for about 3 months, are not edited when a portfolio is deleted. Internal data-quality checks on a portfolio's bank data are kept for up to 60 days. Where the law requires us to keep certain records, we keep them for as long as it requires.

Copies held by our service providers (see Subprocessors) are kept under their own retention terms.

Children's Privacy

Our Services are not intended for children under 16, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a child under 16 without appropriate legal authorization, we will take steps to delete that information as required by law. To submit a deletion or correction request, use the process in Data Rights and Account Requests. If you believe we have collected information from a child under 16, please contact support@trac.bot.

Updates to This Policy

We may update this Policy from time to time. Changes will be posted with a revised Last Updated date, and material changes will be communicated as required by law.

Contacting Us

For questions or concerns about this Policy, please contact us at data@trac.bot. For legal notices related to the Services, contact legal@trac.bot.

California Consumer Privacy Statement

This section supplements Trac's Privacy Policy and applies solely to California residents, as required by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). It outlines the personal information we collect, how we use it, and your rights as a California consumer.

Categories of Personal Information Collected

In the past 12 months, we may have collected the following categories of personal information as defined under the CCPA:

Identifiers: Name, email address, IP address, and similar information.
Customer records information: Contact details, financial information, and employment data.
Commercial information: Records of products or services purchased or considered.
Internet activity: Browsing behavior and interactions with our website.

We do not collect sensitive categories such as biometric data, precise geolocation, or inferences about behavior or preferences unless explicitly provided by you.

Sources of Personal Information

We collect information:

Directly from you (for example, when you provide information through forms or inquiries).
Automatically (through cookies and similar technologies when you use our website).
From service providers (such as analytics or payment processing vendors).

Use of Personal Information

We use personal information for purposes including:

Providing and improving our services.
Fulfilling your requests or inquiries.
Detecting fraud and ensuring security.
Complying with legal obligations.
Other purposes disclosed at the time of collection or with your consent.

Disclosure of Personal Information

In the past 12 months, we may have shared the following categories of personal information with service providers or business partners for business purposes:

Identifiers.
Customer records information.
Commercial information.
Internet activity.

We require service providers to keep your information confidential and use it only as necessary to perform their functions.

Sale of Personal Information

We do not sell personal information as defined under the CCPA, nor do we knowingly collect or sell information from individuals under 16 years of age without consent.

Your Rights Under the CCPA

As a California resident, you have the following rights:

Right to know: Request details about the personal information we collect, use, and share.
Right to delete: Request deletion of personal information we have collected, subject to certain exceptions.
Right to opt out: Direct us not to sell your personal information.
Right to non-discrimination: Exercise your rights without being denied goods or services or receiving differential treatment.

How to Exercise Your Rights

To submit a request to access, delete, or opt out of the sale of your personal information, please contact us at data@trac.bot. We will verify your identity using the information provided in your request.

Opting Out of Sale or Sharing for Targeted Advertising

If you wish to opt out of interest-based advertising or potential sharing of your personal information for such purposes, you can:

Use browser settings to block cookies.
Enable Limit Ad Tracking on iOS or Opt out of Ads Personalization on Android.
Visit opt-out platforms such as Your Online Choices or Network Advertising Initiative.

Data Retention and Updates

We retain personal information as long as necessary to fulfill the purposes outlined above or as required by law. If you have concerns or need more details, contact us at data@trac.bot.

Additional Information

For further details or to request alternative formats of this policy, please reach out to us. We are committed to ensuring your rights under the CCPA are respected and upheld.