Privacy Policy

1. Introduction

Deal Tracking Solutions, LLC, doing business as Port-Trak ("Company," "we," "us," or "our"), is committed to protecting the privacy and security of the personal information and financial data entrusted to us by our clients, users, and website visitors. This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and protect information in connection with our subscription line investment management platform and related services (the "Service").

This Policy applies to all users of the Service, including authorized users of client accounts, visitors to our website, and individuals whose information may be processed through the Service. By accessing or using the Service, you acknowledge that you have read and understood this Policy.

As a provider of financial technology services, we recognize the heightened sensitivity of the data we process and maintain safeguards consistent with financial industry standards and applicable regulatory requirements.

2. Information We Collect

2.1 Account Information

When you register for the Service, we collect:

• Full name (first and last name)
• Business email address
• Phone number
• Company name and company code
• Job title and role designation
• Profile photograph (if provided)
• Authentication credentials (stored as cryptographic hashes, never in plaintext)

2.2 Financial and Investment Data

In connection with your use of the Service, we process:

• Fund information, including fund names, structures, and configurations
• Investment details, including commitment amounts, drawn amounts, outstanding balances, and interest rates
• Transaction records, including draws, repayments, interest payments, and fee transactions
• Position data, including daily accruals and balance calculations
• Month-end closing records and historical financial data
• Third-party vendor and counterparty information
• Documents uploaded to the document library

2.3 Usage and Technical Data

We automatically collect certain information when you access the Service:

• IP address and geolocation data (country/region level)
• Browser type, version, and operating system
• Device identifiers and characteristics
• Pages visited, features used, and actions taken within the Service
• Date and time of access, session duration, and navigation patterns
• Referring URLs and search terms
• Error logs and performance metrics

2.4 Communication Data

We may collect information from:

• Support tickets and help desk communications
• Email correspondence with our team
• In-application notifications and feedback submissions
• Survey responses and feature requests

2.5 Cookies and Tracking Technologies

We use session cookies and similar technologies strictly for authentication, session management, and security purposes. We do not use advertising cookies or third-party tracking pixels. Our cookies include:

• Session cookies: Essential for maintaining your authenticated session and security context
• Preference cookies: Store your dashboard layout preferences, display settings, and UI customizations
• Security cookies: Support multi-factor authentication and fraud prevention

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Providing, operating, and maintaining the Service
• Processing financial calculations, including interest accruals, position tracking, and month-end operations
• Generating reports, analytics, and data visualizations
• Managing user accounts, permissions, and access controls
• Facilitating document storage and management

3.2 Security and Compliance

• Authenticating users and maintaining session security
• Detecting, preventing, and responding to security incidents, fraud, and unauthorized access
• Maintaining audit trails and activity logs for regulatory compliance
• Enforcing our Terms of Service and other policies
• Complying with applicable legal and regulatory obligations

3.3 Service Improvement

• Analyzing usage patterns to improve Service functionality and user experience
• Identifying and resolving technical issues and bugs
• Developing new features and capabilities
• Conducting internal research and analysis (using aggregated, de-identified data only)

3.4 Communications

• Sending transactional emails (account verification, password resets, security alerts)
• Providing technical support and responding to inquiries
• Sending Service-related announcements (maintenance windows, feature updates, security notices)
• Delivering administrative communications required by our Terms of Service

4. Legal Bases for Processing

We process personal information on the following legal bases:

• Contractual Necessity: Processing necessary to perform our obligations under the Terms of Service and any applicable subscription agreement.
• Legitimate Interest: Processing necessary for our legitimate business interests, including Service improvement, fraud prevention, and security, where such interests are not overridden by your data protection rights.
• Legal Obligation: Processing necessary to comply with applicable laws, regulations, court orders, or government requests.
• Consent: Where required by applicable law, we obtain your consent before processing personal information for specific purposes. You may withdraw consent at any time.

5. Information Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share information in the following limited circumstances:

5.1 Within Your Organization

Information is shared among authorized users within your organization's account as determined by your company's administrator and the role-based access controls configured within the Service.

5.2 Service Providers

We engage trusted third-party service providers who assist us in operating and delivering the Service, including:

• Cloud infrastructure and hosting providers
• Database management services
• Email delivery services (for transactional communications only)
• Error monitoring and logging services

All service providers are contractually obligated to maintain the confidentiality and security of information and are prohibited from using it for any purpose other than providing services to us.

5.3 Legal Requirements

We may disclose information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Enforce our Terms of Service, including investigation of potential violations
• Detect, prevent, or address fraud, security, or technical issues
• Protect against harm to the rights, property, or safety of Company, our users, or the public as required or permitted by law

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or similar event, information may be transferred as part of the transaction. We will provide notice before information becomes subject to a different privacy policy.

6. Data Security

We implement comprehensive security measures designed to protect information against unauthorized access, alteration, disclosure, or destruction. Our security program includes:

6.1 Technical Safeguards

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 or equivalent
• Cryptographic hashing of authentication credentials (SHA-256)
• Multi-factor authentication support for user and administrator accounts
• Role-based access controls with principle of least privilege
• Session management with automatic timeout and secure cookie handling
• Regular security assessments and vulnerability scanning

6.2 Administrative Safeguards

• Employee background checks and security training
• Access controls limiting employee access to information on a need-to-know basis
• Incident response procedures and breach notification protocols
• Regular review and update of security policies and procedures
• Comprehensive audit logging of all system access and data modifications

6.3 Physical Safeguards

• Data hosted in SOC 2 Type II certified data centers
• Redundant infrastructure with geographic distribution
• Environmental controls including fire suppression and climate control
• Physical access controls with biometric authentication and 24/7 monitoring

7. Data Retention

7.1 Active Accounts

We retain information associated with active accounts for the duration of the client relationship and as necessary to provide the Service. Financial records and transaction data are retained in accordance with applicable regulatory requirements and the client's data retention preferences.

7.2 Account Termination

Upon termination of a client account, we retain data as follows:

• Client Data Export Period: Client data is made available for export for thirty (30) days following account termination.
• Financial Records: Transactional and financial records may be retained for up to seven (7) years to comply with applicable tax, securities, and financial regulatory requirements.
• Audit Logs: Audit and activity logs are retained for a minimum of three (3) years for security and compliance purposes.
• Anonymized Data: Aggregated, de-identified data may be retained indefinitely for analytics and Service improvement purposes.

7.3 Deletion Requests

Deletion requests are processed within thirty (30) days, subject to our legal and regulatory retention obligations. Certain information may be retained in encrypted backup systems for up to ninety (90) days following deletion from active systems.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

8.1 Access and Portability

You have the right to request access to the personal information we hold about you and to receive a copy of such information in a structured, commonly used, and machine-readable format.

8.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You may update certain account information directly through the Service settings.

8.3 Deletion

You have the right to request deletion of your personal information, subject to our legal and regulatory retention obligations as described in Section 7.

8.4 Restriction and Objection

You have the right to request restriction of processing of your personal information and to object to processing based on our legitimate interests.

8.5 Withdrawal of Consent

Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

8.6 Exercising Your Rights

To exercise any of these rights, please contact us at support@deal-trak.com. We will respond to verified requests within thirty (30) days. We may require verification of your identity before processing certain requests.

9. State-Specific Privacy Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete, the right to opt-out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.

9.2 European Economic Area (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR), including those described in Section 8. You also have the right to lodge a complaint with your local supervisory authority. Our legal bases for processing are set forth in Section 4.

9.3 Other Jurisdictions

We comply with applicable data protection laws in all jurisdictions where we operate. If you have questions about your specific rights under local law, please contact us at support@deal-trak.com.

10. International Data Transfers

The Service is hosted and operated in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States. We implement appropriate safeguards for international transfers, including:

• Standard Contractual Clauses approved by the European Commission
• Data processing agreements with all service providers that process personal information
• Compliance with applicable cross-border data transfer frameworks

11. Children's Privacy

The Service is designed for use by financial professionals and is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child, we will take steps to delete such information promptly. If you believe a child has provided personal information to us, please contact us at support@deal-trak.com.

12. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. This Policy does not apply to the practices of third parties. We encourage you to review the privacy policies of any third-party services you access through the Service. We are not responsible for the privacy practices of third parties.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. We will notify you of material changes by: (a) posting the updated Policy on our website with a revised "Last Updated" date; (b) sending an email notification to the address associated with your account; or (c) providing an in-application notification. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Policy.

We encourage you to review this Policy periodically to stay informed about our information practices.

14. Data Protection Officer

For privacy-related inquiries, data protection concerns, or to exercise your rights under this Policy, please contact our Data Protection Officer: