Privacy Policy

Operated by Pixie Pinch LLC d/b/a DealsOnTrack
Effective Date: September 3, 2026
Last Updated: September 3, 2026

About This Privacy Policy

DealsOnTrack is a software-as-a-service platform operated by Pixie Pinch LLC, a Florida limited liability company doing business as DealsOnTrack (collectively, “DealsOnTrack,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit dealsontrack.com, create an account, or use our web application, features, communications, and support (collectively, the “Service”).

The Service is designed primarily for real estate professionals and organizations in the United States. This Policy does not govern a subscribing customer’s own privacy practices or any third-party website or service that we do not control.

Our Privacy Roles

Account and business information. DealsOnTrack decides why and how to process information used for account setup, billing, support, security, legal compliance, and operation of our own business. For this information, DealsOnTrack acts as a controller or business, as those terms are used under applicable privacy laws.

Customer Content. The subscribing agent, transaction coordinator, team, brokerage, or other organization (the “Customer”) decides what transaction information is placed in the Service and why it is used. For Customer Content, the Customer generally acts as the controller or business, and DealsOnTrack acts as its processor or service provider. We process that information to provide the Service, follow the Customer’s instructions, protect the Service, and comply with law.

Participant requests. If your information was entered by a Customer because you are a buyer, seller, lender, title professional, attorney, agent, or other transaction participant, please direct privacy requests first to that Customer. When appropriate, we will help the Customer respond or will forward your request to the Customer.

Organization accounts. A Customer’s administrators may control user access, view and manage Customer Content, and retain Customer Content after an individual user leaves the organization. Individual users should contact their organization about those controls.

Information We Collect

Account and profile information

We collect information used to create and manage an account, such as your name, email address, authentication information, company or brokerage name, professional title, role, time zone, branding preferences, logo, email signature, administrative fees, commission or referral settings, plan, and subscription status. Passwords and sign-in credentials are handled through our authentication systems and providers.

Transaction and participant information

Customers may enter or upload property addresses, purchase prices, effective and closing dates, contract terms, deadlines, deposits, financing details, commissions, referral fees, tasks, notes, status information, and audit history. Customers may also provide participant names, email addresses, phone numbers, roles, company names, and other information about buyers, sellers, agents, assistants, transaction coordinators, lenders, title companies, closing agents, attorneys, associations, inspectors, and other contacts.

Documents and AI information

We collect contracts, addenda, PDFs, attachments, and other files uploaded for storage or AI-assisted review. We also collect AI prompts, extracted terms, calculated dates, confidence information, corrections, approvals, and outputs produced through the Service.

Customer Content may contain signatures, financial information, government identifiers, or other sensitive information if a Customer includes it in a document. DealsOnTrack does not require Social Security numbers, full bank-account numbers, or full payment-card numbers to provide its standard transaction-tracking features.

Connected account information

If you connect Google or Microsoft, we receive the information and permissions shown during authorization. Depending on the feature you choose, this may include your name, email address, profile identifier, OAuth access and refresh tokens, and the email or calendar data needed to perform the action you request. We do not receive your Google or Microsoft password.

Payment information

Stripe processes payment-card information for subscriptions and purchases. DealsOnTrack does not store full payment-card numbers. We may receive limited billing details, such as your billing name and address, card brand and last four digits, payment status, subscription status, and transaction identifiers.

Usage, device, and log information

We automatically collect information such as IP address, browser type, operating system, device or browser identifiers, pages and features used, actions taken, dates and times, session information, referring pages, error reports, performance data, delivery events, and security logs. We may collect an approximate location from an IP address, but we do not collect precise device location unless a feature clearly asks for it.

Support and communications

We collect messages, attachments, feedback, and contact information that you provide when you contact us, request support, report a problem, or communicate with us.

Sources of information

We obtain information directly from users; from Customers, their administrators, and other authorized users; from transaction participants who communicate through the Service; from connected Google or Microsoft accounts; from Stripe and other service providers; and automatically from devices and use of the Service.

How We Use Information

Create, authenticate, maintain, and administer accounts.
Provide transaction tracking, deadline calculations, document storage, collaboration, reports, and audit history.
Extract contract information and support other AI-assisted features that a user chooses to use.
Send reminders, transaction communications, calendar events, system notices, and other messages requested by a user.
Apply user settings, branding, templates, roles, access permissions, and notification choices.
Process payments, manage subscriptions, and prevent billing fraud.
Provide support, investigate errors, and improve the reliability and usability of the Service.
Monitor, secure, and protect accounts, Customer Content, our systems, and other users.
Enforce our agreements, establish or defend legal claims, and comply with legal duties.
Create aggregate or deidentified information for internal analytics and service improvement, where permitted by law. We do not attempt to reidentify information that we maintain as deidentified.

AI-Assisted Processing

When you choose an AI-assisted feature, you direct us to transmit the uploaded document, prompt, and related information to Anthropic, PBC through Anthropic’s commercial Claude API. The content may include personal and confidential information found in a real estate contract. Anthropic processes the content to return the requested extraction or other response to DealsOnTrack.

Anthropic states that, by default, it does not use inputs or outputs from its commercial API to train its models. Under Anthropic’s current standard policy, API inputs and outputs are generally deleted from its systems within 30 days, subject to exceptions for certain features, user choices, safety enforcement, legal obligations, or a different contractual arrangement. See Anthropic’s commercial training policy and commercial retention policy.

DealsOnTrack does not use Customer Content or Google user data to train publicly available or generalized AI models. We may change the AI model or provider as the Service develops. If a change materially affects how personal information is handled, we will update this Policy and provide any notice or choice required by law.

Do not upload Social Security numbers, full bank-account numbers, payment-card numbers, medical information, government identification numbers, or other highly sensitive information unless it is lawful, necessary for the transaction, and supported by appropriate safeguards. Redact information that the Service does not need.

AI output and deadline calculations may be incomplete or incorrect. Users must review every extracted term and calculated deadline against the complete, signed contract and all amendments before relying on it. The Service does not provide legal, brokerage, title, lending, tax, or other professional advice.

Google and Microsoft Connections

Access and use. We request only the permissions needed for the feature you select. Depending on the connected feature, we may use basic profile information for sign-in, Gmail or Outlook permissions to create and send messages on your behalf, and calendar permissions to create or update events. We do not access unrelated messages, files, or calendar events unless the permission is clearly displayed and the feature requires that access.

Storage. We store OAuth tokens on protected server-side systems so the connection can continue to work. We may also store message content created in DealsOnTrack, recipient information, attachments selected by the user, delivery information, and related communication logs as part of the transaction record.

Disclosure and human access. We use connected-account data only to provide or improve the user-facing feature, maintain security, comply with law, or complete another action that you clearly authorize. We do not sell this data, use it for advertising, use it to determine creditworthiness, or allow human access except with your affirmative permission for support, when needed for security, when required by law, or when the information has been aggregated as allowed by applicable rules.

Google Limited Use. DealsOnTrack’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting and deletion. You may disconnect Google or Microsoft through the Service’s settings or revoke access through your Google or Microsoft account. Disconnecting stops new access, but information already stored in a transaction record may remain until it is deleted under this Policy or the Customer’s instructions. You may delete available stored records through the Service or request deletion of Google or Microsoft user data by emailing pixiepinchllc@gmail.com.

How We Disclose Information

We disclose personal information only as described below:

Service providers. We use vendors that help us provide hosting, authentication, database, file storage, payments, email delivery, AI processing, security, monitoring, and support. They may process information only for the contracted service and under applicable confidentiality and data-protection duties.
Customer users and administrators. Customer Content may be visible to users whom the Customer authorizes, including team members, brokers, transaction coordinators, assistants, and administrators.
Transaction recipients. At the Customer’s direction, we disclose selected transaction information through reminders, emails, calendar events, reports, portals, or other communications to the recipients selected by the Customer.
Legal and safety matters. We may disclose information when reasonably necessary to comply with law, court orders, subpoenas, or lawful government requests; enforce agreements; investigate fraud or security incidents; or protect rights, safety, property, and the Service.
Business transactions. Information may be reviewed or transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate safeguards and applicable law.
At your direction. We may disclose information when you direct us to do so or give consent where consent is required.

Examples of Core Service Providers

The following are examples of service providers we use. This list is not complete, and our vendors may change as the Service develops.

Supabase - database hosting, authentication, and file storage.
Stripe - payment processing and subscription billing.
Resend - transactional and system email delivery.
Anthropic - AI-assisted document and prompt processing through the Claude API.
Google - optional sign-in, Gmail, and calendar connections.
Microsoft - optional sign-in, Outlook, and calendar connections.

We will update this Policy when a material vendor change affects how personal information is handled.

No Sale, Targeted Advertising, or Data Brokerage

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, use Customer Content for targeted advertising, or disclose participant contact information for third-party marketing. We do not operate as a data broker. We also do not use Google user data or transaction documents for advertising.

Disclosures to service providers that process information for us under written restrictions are not treated as sales or targeted-advertising disclosures under applicable privacy laws.

Cookies and Similar Technologies

DealsOnTrack uses cookies and browser storage for essential functionality. We do not use advertising cookies, analytics tracking, or session-recording tools.

Authentication and session management. The session-id cookie maintains your login session after you sign in. The __Secure-has_logged_in cookie tracks whether you are signed in. Both are set when you sign in via email, signup, or Google sign-in and expire when you sign out or your token refreshes (roughly hourly). These cookies are necessary for the Service to work.

User preferences and performance. The list-state keys stored in your browser's session storage remember your filter, sort, and page position on Deals, Contacts, Deadlines, and similar lists. They are cleared when you close the browser tab. The sidebar_state cookie remembers whether your sidebar is open or closed and expires after 7 days. These improve your experience but are not required for core functionality.

Payment processing. When you open Stripe checkout to subscribe or purchase, Stripe sets cookies on its domain for fraud prevention and session management: __stripe_mid (approximately 1 year) and __stripe_sid (approximately 30 minutes). These are set only during checkout and are controlled by Stripe, not DealsOnTrack.

Infrastructure and security. The __cf_bm cookie (set by Cloudflare, expires in approximately 30 minutes) and the _dpl cookie (set by Lovable, expires in approximately 1 day) support platform security and hosting.

Google sign-in. When you sign in with Google, you are redirected through Google's authentication service. Google sets its own account cookies on Google's domains during the authorization flow. Those cookies are controlled by Google and are not set by DealsOnTrack.

You may block or delete cookies through your browser settings. However, blocking required authentication or preference cookies may prevent the Service from working correctly.

Data Retention

Account and profile information. We keep it while the account is active and afterward only as reasonably needed for billing, security, dispute resolution, legal compliance, and enforcement.

Transaction records and uploaded documents. Active, closed, and archived transactions generally remain available while the Customer’s account is active, unless the Customer deletes them. Uploaded documents remain until the Customer deletes them, the account is deleted, or applicable retention settings require earlier deletion.

OAuth tokens. We keep connected-account tokens until the connection is revoked, the account is deleted, the token expires or becomes invalid, or we no longer need it to provide the connected feature.

Communications and logs. We keep transaction communications, delivery history, audit history, security logs, and support records for as long as reasonably needed for the Service, recordkeeping, security, legal claims, and compliance.

Billing records. We retain invoices, payment status, and related records as required for tax, accounting, fraud prevention, and legal purposes.

Account deletion. After a verified account-deletion request, we generally delete or anonymize personal information from active systems within 30 days, unless the information is controlled by an organization account or must be retained for legal, billing, security, fraud-prevention, dispute, or other legitimate purposes. Limited copies may remain in protected backups until they are overwritten through the normal backup cycle.

When Customer Content belongs to an organization account, the organization controls its retention. Closing an individual user account may not delete Customer Content held by that organization.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These safeguards include encryption in transit, encryption at rest where supported by our hosting providers, role-based access, database row-level security, server-side storage of OAuth tokens, access controls, logging, monitoring, and backup procedures.

No system can be completely secure. We cannot guarantee that personal information will never be lost, misused, or accessed without permission. Users are responsible for protecting passwords, devices, connected accounts, and user permissions and for notifying us promptly about suspected unauthorized access.

If a security incident affects personal information, we will investigate and provide legally required notices to Customers, users, regulators, or affected individuals, as applicable.

Customer Responsibilities and Participant Data

Customers are responsible for the Customer Content they collect and place in the Service. By adding a participant, uploading a document, or directing a communication, the Customer represents that it has a lawful basis and appropriate authority to do so.

Give any privacy notices and obtain any permissions required by law, contract, brokerage policy, or professional duty.
Use only the information reasonably needed to manage the transaction.
Avoid uploading unnecessary sensitive information and redact it when possible.
Keep participant details accurate and limit access to authorized users.
Make sure reminders and communications are sent only to proper recipients and comply with applicable communication laws.
Review user roles and remove access promptly when a person no longer needs it.

Participant contact information is used to support the Customer’s transaction activities. We do not use participant information for our own marketing or disclose it for third-party marketing.

Your Privacy Rights and Choices

Depending on where you live and subject to legal exceptions, you may have the right to:

Know whether we process your personal information and obtain access to it.
Correct inaccurate personal information.
Delete personal information.
Receive a portable copy of certain information.
Withdraw consent when processing is based on consent.
Opt out of a sale, targeted advertising, or certain profiling. DealsOnTrack does not conduct these activities as described above.
Limit certain uses of sensitive personal information, where applicable.
Appeal a denied privacy request, where applicable.

To submit a request, email pixiepinchllc@gmail.com with the subject line “Privacy Request.” Please describe your request and provide the email address connected to your account. We may ask for information needed to verify your identity and authority. You may use an authorized agent where permitted by law, but we may require proof of that authority and direct identity verification.

If we process the requested information only for a Customer, we may direct the request to that Customer and assist it as required. We will respond within the time required by applicable law. If an appeal right applies, reply to our decision and state that you are appealing. We will not unlawfully discriminate against you for exercising a privacy right.

You may update certain account information, export available transaction information, delete documents, and disconnect Google or Microsoft through the Service’s settings when those controls are available.

United States Processing

DealsOnTrack is based in the United States, and the Service is designed primarily for United States real estate transactions. Personal information may be processed in the United States and other places where our service providers operate. Those places may have privacy laws that differ from the laws where you live.

Children’s Privacy

DealsOnTrack accounts are intended for adults and professional use. The Service is not directed to children under 18, and we do not knowingly collect personal information directly from a child under 13. A Customer must not submit information about a minor unless it is lawful and reasonably necessary for a transaction. If you believe a child provided information directly to us without proper authorization, contact us so we can review and delete it when required.

Third-Party Sites and Services

The Service may link to or connect with services that we do not control. Their own privacy policies and terms govern information they process for their independent purposes. We encourage you to review those policies before using a connection or leaving the Service.

Changes to This Policy

We may update this Policy as the Service, our vendors, or legal requirements change. We will change the “Last Updated” date when we do. For material changes, we will provide notice by email, through the Service, or by another reasonable method before the change takes effect when required. If a new use requires consent, we will request it before beginning that use.

Contact Us

Questions, concerns, and privacy requests may be sent to:

Pixie Pinch LLC d/b/a DealsOnTrack
14823 SW 110th Terrace
Miami, Florida 33196
United States
Email: pixiepinchllc@gmail.com
Website: dealsontrack.com