ten31tracker Privacy Policy

Effective Date: February 1, 2026 Last Updated: October 19, 2026 Company: ten31tracker LLC

Introduction

ten31tracker ("we," "our," or "us") provides a cloud-based software platform designed to help law firms and qualified intermediaries (QIs) manage IRC Section 1031 like-kind exchange transactions. We are committed to protecting your privacy and handling your data transparently.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data. We encourage you to read this policy carefully. This policy should be read together with our Terms of Service.

Important: ten31tracker is a tracking and organization tool only. It does not provide legal, tax, or financial advice. All users should consult qualified professionals for 1031 exchange guidance.

Information We Collect

Information You Provide Directly

Data Type	When Collected	Purpose
Account Information	Registration & login	Name, email address, firm name
Mobile Phone (SMS)	Profile SMS opt-in	Phone number used only to send the SMS you opted into: critical/overdue deadline alerts and, if the status box is checked, failed/completed/cancelled exchange alerts
Product-updates signup	/waitlist	First name, last name, email, and firm type are required. Middle name is optional. Phone, company, address, and annual exchange volume are optional. We log IP address and user agent. Signups are added to a Resend marketing audience and can unsubscribe. If we email an administrator about the signup, that email includes the phone number when one was provided. Consent to product-update email is required.
Demo request	/demo form	Name, email, and consent to follow-up communications. We log IP address, user agent, and the time of consent, and email a one-time demo link.
Billing Information	Subscription setup	Processed by Stripe; we do not store full payment card numbers
Exchange Data	Application use	Client names, property addresses, transaction amounts, dates, deadlines
Documents	File uploads	Exchange-related documents you upload (stored encrypted)
Tax Identifiers	Exchange records	SSN/EIN for exchange participants (encrypted at application level)
Communications	Support requests and in-app feedback	Emails, support tickets, and feedback (message, optional name, optional email, and screenshots)
Client portal	Magic link sent by a firm	The client's email address, a one-time verification code, and the exchange the firm shared

Information Collected Automatically

Data Type	How Collected	Purpose
Usage Data	Application logs	Feature usage, page views, actions taken
Device Information	Browser/device	Browser type, operating system, device type
IP Address	Server logs	Security, rate limiting, fraud prevention
Error Data	Error tracking (Sentry)	Debugging and improving the service, including error reports, sampled session replays, and feedback you submit

Information We Do NOT Collect

Health or biometric data
Social Security Numbers beyond what you enter for exchange records (encrypted)
Data from children under 13
Browsing history outside our application
Location data beyond IP-derived region

How We Use Your Information

We use your information for the following purposes:

Service Delivery

Provide, maintain, and improve ten31tracker
Process transactions and send related information
Calculate exchange deadlines and send notifications
Store and organize your exchange documents

Communication

Send service-related notices (deadline reminders, account updates)
Send optional SMS alerts when you have opted in (see SMS Communications)
Respond to your requests and support inquiries
Send product updates if you've opted in (waitlist or account settings)

SMS Communications

If you check the optional Profile SMS box, ten31tracker LLC sends automated SMS text messages about critical and overdue 1031 deadline alerts (45-day identification and 180-day exchange) and, if you also check the separate status box, exchange status-change alerts when an exchange is marked failed, completed, or cancelled. We do not send SMS for 30-day, 14-day, or 7-day email reminders.

Frequency: Event-driven. Typically a few messages per month. Deadline texts are sent when a deadline is critical (3 days, 1 day, or due today) or overdue. Status texts are sent when an exchange is marked failed, completed, or cancelled, and only if you opted into them.
Rates: Message and data rates may apply.
Opt-out: Reply STOP to cancel anytime, reply HELP for help, or disable SMS in Profile settings. You can also contact support@ten31tracker.com.
Consent: The SMS checkbox is unchecked by default. Consent to receive SMS text messages is not required to create an account or use ten31tracker. Checking a box is SMS consent only; it is not acceptance of this Privacy Policy or the Terms of Service.
No marketing share: Mobile information is not shared with third parties or affiliates for marketing or promotional purposes.

Your mobile number is stored encrypted at rest. We share it with Twilio solely to deliver the messages you opted into.

Demo Requests

The public form at /demo asks for your name and email and requires consent to receive follow-up communications from ten31tracker. We store that consent with the time, your IP address, and your user agent, and we email you a one-time link to a short demo session.

Client Portal

A firm can email its client a magic link to a read-only view of one exchange. The client confirms the email address and receives a verification code by email. Those emails go to the address the firm entered and include the client name, the firm name, and the exchange identifier. The link, the code, and the portal session are limited in time. The client does not create a ten31tracker account.

Session Replay and Feedback

On the website and the application, Sentry Session Replay records 10% of sessions and 100% of sessions in which an error occurs. Replay masks on-screen text and blocks media. Signed-in users can open a feedback widget and send a message, an optional name, an optional email address, and a screenshot. Screenshots can include what is on the screen.

Security & Compliance

Protect against unauthorized access and fraud
Maintain audit logs for compliance purposes
Enforce our Terms of Service

Contract: Processing necessary to provide our services
Consent: Marketing communications and optional SMS alerts (opt-in only)
Legitimate Interests: Security, fraud prevention, service improvement
Legal Obligation: Tax and regulatory compliance, responding to legal requests

We do not sell, rent, or trade your personal information. We share data only with the following service providers who assist in operating our platform:

Provider	Purpose	Data Shared	Privacy Policy
Auth0	Authentication & identity	Email, name, login credentials	Auth0 Privacy
Stripe	Payment processing	Billing details, subscription status	Stripe Privacy
Resend	Transactional email	Email address, name	Resend Privacy
Twilio	SMS (opt-in deadline and status-change alerts)	Mobile phone number	Twilio Privacy
AWS S3	Document storage	Encrypted files	AWS Privacy
Neon	Database hosting	All application data (encrypted)	Neon Privacy
Inngest	Background jobs	Job data used to send notifications and run background work, which can include names and email addresses	Inngest Privacy
Sentry	Error monitoring, session replay, and the feedback widget	Error logs, stack traces, sampled session replays, and feedback you submit (message, optional name, optional email, and screenshots)	Sentry Privacy
Vercel	Frontend hosting	Request logs, IP addresses	Vercel Privacy
Railway	API hosting	Application logs	Railway Privacy

Other Disclosures

We may disclose information:

To comply with legal obligations, court orders, or government requests
To protect our rights, privacy, safety, or property
In connection with a merger, acquisition, or sale of assets (with notice to you)
With your explicit consent

Security Measures

We implement reasonable administrative, technical, and physical safeguards to protect your data:

Technical Safeguards

Encryption in Transit: All data transmitted via TLS (HTTPS)
Encryption at Rest: AES-256 encryption for stored data
Application-Level Encryption: Sensitive fields (Tax IDs) encrypted before database storage
Row-Level Security: PostgreSQL RLS ensures strict tenant isolation
Secure Authentication: Auth0 with support for MFA

Operational Safeguards

Audit Logging: All significant actions logged with timestamps and actor identification
Access Controls: Role-based permissions limit data access
Account data: After cancellation your account stays read-only for 90 days, then your data is deleted. You can export your data anytime.
Regular Reviews: Security practices reviewed at least annually

Limitations

While we use reasonable measures to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

Data Retention

After cancellation your account stays read-only for 90 days, then your data is deleted. You can export your data anytime.

That schedule covers account information, exchange records, audit logs, billing records, and support communications stored in the account. You may also request deletion sooner.

Your Rights

Depending on your location, you may have the following rights:

All Users

Access: Request a copy of your personal data
Correction: Update inaccurate or incomplete data
Deletion: Request deletion of your data. After cancellation your account stays read-only for 90 days, then your data is deleted. You can export your data anytime.
Opt-Out: Unsubscribe from marketing communications
Data Portability: Receive your data in a structured format

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act:

Right to Know: What personal information we collect, use, and disclose
Right to Delete: Request deletion of personal information
Right to Correct: Correct inaccurate personal information
Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. The "Do Not Sell or Share My Personal Information" right does not apply because we do not engage in these practices.
Non-Discrimination: We will not discriminate against you for exercising your rights

Categories of Personal Information Collected: Identifiers, commercial information, internet activity, professional information, and inferences drawn from the above.

Texas Residents (TDPSA)

Texas residents have rights under the Texas Data Privacy and Security Act:

Right to Access, Correct, Delete, and Port your personal data
Right to Opt-Out of targeted advertising, sale of personal data, and profiling
Global Privacy Control (GPC): We honor GPC browser signals as a valid opt-out request

Note: We do not sell personal data or engage in targeted advertising.

If you are in the European Economic Area, you have rights under GDPR including access, rectification, erasure, restriction, portability, and objection. You may also lodge a complaint with your local supervisory authority.

Exercising Your Rights

To exercise any of these rights, contact us at:

Support: support@ten31tracker.com

Privacy: privacy@ten31tracker.com

We will respond within the timeframe required by applicable law (typically 30-45 days). We may need to verify your identity before processing your request.

Cookies & Tracking

Essential Cookies Only

ten31tracker uses only essential cookies necessary for the application to function:

Cookie	Purpose	Duration
Session cookie	Authentication state	Session
CSRF token	Security	Session
demo_session_expires	Demo session countdown timer	10 minutes

What We Do NOT Use

Third-party advertising cookies
Cross-site tracking
Behavioral profiling for ads
Social media tracking pixels

Analytics

We use privacy-respecting analytics (Vercel Analytics) that do not track individuals across sites or create advertising profiles.

International Data Transfers

ten31tracker is based in the United States. If you access our service from outside the U.S., your data will be transferred to and processed in the U.S.

For users in the EEA/UK, we rely on:

Standard Contractual Clauses (SCCs) with our service providers
Service providers' compliance with applicable data protection frameworks

Children's Privacy

ten31tracker is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will:

Update the "Last Updated" date at the top
Notify you of material changes via email or in-app notice
Review this policy at least annually

Continued use of ten31tracker after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: