Privacy Policy

1. Introduction

Tractic ("we," "our," or "us") is a real estate portfolio management platform. This Privacy Policy explains how we collect, use, and protect your information when you use our service at tractic.io. By using Tractic, you agree to the practices described in this policy.

2. Information We Collect

Information you provide directly:

• Name, email address, and authentication profile information
• Property information (addresses, purchase prices, rental rates)
• Financial transaction data you manually enter or import
• Bank account connections (via Plaid)
• Documents and files you upload or make available through connected Google Drive or Microsoft OneDrive folders

If you enable Google Drive or Microsoft OneDrive folder sync, Tractic checks the connected or shared folders on a recurring schedule and accesses files added later until you disconnect the sync.

Information collected automatically:

• Usage data and analytics (pages visited, features used)
• Device and browser information
• IP address and general location

3. How We Use Your Information

• To provide and improve the Tractic platform
• To generate AI-powered portfolio insights and reports
• To sync bank transactions via Plaid (with your permission)
• To send product updates and important account notifications
• To process subscription payments via Stripe
• To provide customer support

We do not sell your personal information to third parties.

4. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL) with row-level security. Sensitive financial data including transaction amounts and bank tokens are encrypted at rest using AES-256-GCM encryption. We use industry-standard security practices to protect your information.

Authorized Tractic staff may access your account and its financial data or documents when needed to provide support or troubleshoot the service. Access through this support tool is restricted to authorized administrators and logged.

5. Third-Party Services

We use the following third-party services:

• Google Sign-In — for optional authentication (email and profile only)
• LinkedIn Sign-In — for optional authentication (email and profile only)
• Google Drive — for scheduled document sync from folders you explicitly share with Tractic
• Microsoft / OneDrive — for optional Microsoft authentication and document sync from connected OneDrive folders
• Supabase — for authentication, database hosting, and file storage
• Vercel — for application hosting and delivery
• Plaid — for bank account connectivity
• Stripe — for subscription billing
• Telnyx — for SMS / text message delivery (if you opt in)
• Resend / Sendinel — for transactional and campaign email delivery, as applicable
• PostHog — for product analytics and service monitoring
• Google Maps — for property location display
• RentCast — for market rent and property value estimates
• Anthropic (Claude) — uploaded or synced documents, including bank statements, owner statements, receipts, and Closing Disclosures, and relevant portfolio data are transmitted to Anthropic's API for AI-powered extraction, reports, and insights

Each of these services has its own privacy policy governing how it handles your data.

SMS / Text Messaging

If you opt in to text messages from Tractic by checking the SMS consent box at signup or on our SMS signup page, we will collect and store: your phone number, the date and time you opted in, the IP address you opted in from, and the consent language you agreed to. This record exists to comply with US carrier and TCPA requirements.

We share your phone number only with Telnyx, our SMS carrier provider, solely to deliver the messages you have opted in to receive. We do not sell, rent, share, or otherwise disclose your phone number to any third party for marketing purposes. We do not share your SMS opt-in data with any other third party.

Message frequency varies. Message and data rates may apply. Reply STOP at any time to opt out; reply HELP for assistance. You can also opt out by emailing support@tractic.io or by deleting your phone number from your account settings.

6. Google User Data

Tractic uses Google Sign-In solely for authentication. We request access only to your name and email address. We do not access your Google Drive, Gmail, Calendar, or any other Google services. We do not share your Google account data with third parties.

7. Data Retention

We retain your data for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us at the email below.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data
• Disconnect bank accounts at any time

9. Cookies

We use cookies and similar technologies for authentication session management and PostHog product analytics. We do not use advertising cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via an in-app notice. Continued use of Tractic after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

privacy@tractic.io