Privacy Policy
Contact: marcomendoza@avilapeakpartners.com
Contents
Introduction
Solentis LLC (“Solentis,” “we,” “us,” or “our”) operates Track, a team task management and accountability platform (“Service”) provided to business customers (“Clients”) in the United States. This Privacy Policy explains how we collect, use, store, and disclose information in connection with the Service.
Track is a business-to-business (B2B) platform. If you are using Track as an employee, contractor, or authorized user of a Client organization, your organization deployed Track and is responsible for how your data is used within that deployment. Solentis acts as a service provider and data processor on behalf of its Clients. The Client organization — not Solentis — is the primary data controller for the information of its end users and customers.
This policy applies to all users of Track regardless of the industry their employer operates in. Clients in regulated industries (including financial services, healthcare, and legal) are responsible for ensuring their use of Track satisfies their own sector-specific compliance obligations.
Applicable Legal Frameworks
Track is designed and operated in compliance with the following U.S. laws and regulations.
2.1 California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
To the extent Track processes personal information of California residents, Solentis complies with the CCPA as amended by the CPRA. As a service provider operating under written contract with its Clients, Solentis:
- Does not sell or share personal information for cross-context behavioral advertising.
- Does not retain, use, or disclose personal information outside the scope of the service provider relationship.
- Honors instructions from Clients to delete or restrict processing of personal information consistent with CCPA obligations.
California residents who are users of Track may exercise their rights by contacting the Client organization that deployed Track, or by contacting Solentis directly at marcomendoza@avilapeakpartners.com. See Section 9 for the full list of rights available.
2.2 CAN-SPAM Act
Track sends transactional and operational emails including task assignment notifications, completion confirmations, daily digest summaries, and authentication codes. These emails are sent via Resend, a third-party email delivery provider, on behalf of the Client organization.
- All commercial email includes a physical mailing address and a functional opt-out mechanism.
- Transactional emails (account security, two-factor authentication) are sent only when triggered by a user action and are not subject to commercial opt-out requirements.
- Users may update their notification preferences within Track's settings at any time.
2.3 Telephone Consumer Protection Act (TCPA)
Track integrates with WhatsApp via Meta's Cloud API to deliver task notifications and to support Sofia, an AI-powered conversational agent. WhatsApp messages sent through the platform are organizational communications between users and the Service — they are not unsolicited marketing messages to consumers.
- WhatsApp notifications are sent only to users whose phone numbers have been registered in Track by an authorized administrator of the Client organization.
- Users may disable WhatsApp notifications at any time in their Track notification preferences.
- Solentis does not initiate unsolicited commercial text or voice communications to consumers.
2.4 Gramm-Leach-Bliley Act (GLBA) — Financial Services Clients
Where Track is deployed by a financial institution (including registered investment advisers, broker-dealers, or wealth management firms), Solentis operates as a nonaffiliated third-party service provider under GLBA. In this capacity:
- Solentis does not sell, share, or use nonpublic personal information (NPI) of financial institution customers for any purpose other than providing the contracted Service.
- Solentis maintains a written information security program consistent with the FTC Safeguards Rule (16 C.F.R. Part 314).
- Access to NPI within Track is scoped by role-based access controls and organization-level data isolation.
- Solentis does not use NPI received from financial institution Clients to market other products or services.
2.5 Recordkeeping Obligations — Regulated Industries
Track maintains immutable audit logs of all task-related actions. These logs are designed to support Client compliance with applicable recordkeeping obligations, including SEC Rule 17a-4, SEC Rule 204-2, and FINRA Rule 4511 for financial services Clients, as well as equivalent obligations in other regulated industries. Audit log records are retained for a minimum of six (6) years and cannot be modified or deleted by users or administrators. Clients are solely responsible for ensuring their use of Track satisfies their specific regulatory requirements.
2.6 FTC Act Section 5 — Unfair or Deceptive Practices
Solentis's privacy and data practices are consistent with the FTC's guidance on fair information practices. This policy accurately describes our data practices. We do not engage in practices that misrepresent how we handle data or that cause substantial harm to individuals that they cannot reasonably avoid.
Data We Collect
Track collects the following categories of information in the course of providing the Service.
3.1 Account and Identity Data
- Full name and email address (required for account creation and authentication)
- Password, stored as a one-way bcrypt hash (Solentis cannot recover your password)
- Role within your organization (admin, manager, or user)
- WhatsApp phone number (optional; required only to use WhatsApp notifications or the Sofia AI agent)
3.2 Task and Work Product Data
- Task titles, descriptions, priorities, due dates, statuses, and assignees
- Subtasks and task dependencies
- Comments and activity associated with tasks
- Recurring task templates
- Client records and interaction logs, if the Client organization has enabled the CRM feature
3.3 Communication Data
- WhatsApp conversation history between users and the Sofia AI agent, stored per organization and retained for context and compliance review
- Email notification delivery logs (delivery status only; not the full body of emails beyond the notification itself)
3.4 Voice Data
When a user sends a WhatsApp voice note to Sofia, the audio is transmitted to Groq (a third-party provider) for transcription using the Whisper speech-to-text model. The transcribed text is then processed by Sofia as though it were a typed message.
- Audio is not stored by Solentis after transcription is complete.
- Transcription is performed by Groq under their applicable terms of service and privacy policy.
- Users who do not wish to use voice transcription may communicate with Sofia via text only.
3.5 Audit and Activity Logs
- Immutable records of all task mutations (create, update, complete, delete, assign) with timestamps, actor identity, and organization context
- Authentication events (logins, two-factor authentication attempts, password resets)
- WhatsApp webhook events (retained for debugging and security purposes)
Audit logs are retained for a minimum of six (6) years and cannot be modified or deleted by users or administrators.
3.6 Technical and Usage Data
- IP addresses and user agent strings, captured at authentication and webhook events
- Error and exception data collected by Sentry, our application monitoring provider
- Infrastructure metadata from Vercel, our hosting provider
Track does not use cookies for tracking, advertising, or analytics. Session management is handled server-side with a 24-hour hard session expiry.
How We Use Data
Solentis uses information collected solely to provide, maintain, and improve the Track Service.
4.1 Service Delivery
- Authenticating users and maintaining secure sessions
- Displaying task assignments, priorities, and deadlines to authorized team members
- Sending email and WhatsApp notifications triggered by task events
- Enabling Sofia to respond to task queries and perform task operations via WhatsApp
- Generating daily digest emails summarizing team task status
4.2 Compliance and Security
- Maintaining immutable audit logs for regulatory recordkeeping purposes
- Detecting and preventing unauthorized access, abuse, or fraud
- Responding to security incidents
- Verifying webhook authenticity
4.3 Service Improvement
- Identifying and fixing application errors via Sentry
- Analyzing aggregate, anonymized usage patterns to improve platform performance
Solentis does not use personal information to train AI or machine learning models. Personal information is not shared with AI providers beyond the transactional API calls required to deliver the Service (see Section 5).
4.4 What We Do Not Do
- We do not sell personal information to third parties.
- We do not share personal information for cross-context behavioral advertising.
- We do not use personal information to build consumer profiles for parties other than the Client that owns the data.
- We do not use NPI received from financial institution Clients for any purpose outside the contracted Service.
AI Processing — Sofia
Sofia is an AI agent powered by Anthropic's Claude API. When a user sends a message via WhatsApp (text or transcribed voice), the following data is transmitted to Anthropic's API to generate a response:
- The user's message text
- The user's first name, role, and organization context
- The last 10 turns of that user's WhatsApp conversation history
- Task data retrieved from Track's database in response to Sofia's tool calls
- If the Client organization has enabled the CRM feature and the user has the appropriate role: client names, interaction summaries, and open task summaries
Solentis uses Anthropic's API under a commercial agreement. As of the effective date of this policy, Anthropic does not use API-submitted data to train its models. Anthropic's API terms and privacy practices govern how Anthropic handles data received through API calls.
Users who do not wish their messages to be processed by the Anthropic API may opt out of WhatsApp and Sofia by removing their WhatsApp phone number from their Track profile settings.
Data Sharing and Disclosure
Solentis does not sell personal information. We disclose information only in the following circumstances.
6.1 Service Providers
Solentis engages the following third-party service providers who process data on our behalf under contractual data protection obligations:
| Provider | Purpose | Privacy Policy |
|---|---|---|
| Supabase | PostgreSQL database hosting (all structured data: tasks, users, audit logs, conversation history). Deployed on AWS infrastructure in the United States. | supabase.com/privacy |
| Vercel | Application hosting and deployment | vercel.com/legal/privacy-policy |
| Resend | Transactional email delivery | resend.com/privacy |
| Meta (WhatsApp Cloud API) | Routes WhatsApp messages between users and the platform | meta.com/legal/privacy |
| Anthropic | Claude AI API — processes message content to generate Sofia's responses (see Section 5) | anthropic.com/privacy |
| Groq | Whisper voice transcription API — transcribes WhatsApp voice notes to text; audio is not retained by Solentis | groq.com/privacy |
| Upstash | Redis — in-memory rate limiting, webhook deduplication, and two-factor authentication nonce management | upstash.com/privacy |
| Sentry | Application error monitoring — receives error reports that may include request context | sentry.io/privacy |
6.2 Client Organization
Because Track is a B2B platform, the Client organization that deployed Track has administrative visibility into task data, team activity, audit logs, and (for administrators) WhatsApp conversation logs within their organization. Your use of Track is subject to your organization's own policies in addition to this one.
6.3 Legal Obligations
Solentis may disclose information when required to do so by law, regulation, court order, or valid legal process. Where permitted by law, we will notify the affected Client before disclosing their data in response to a legal demand.
6.4 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of Solentis's assets, personal information may be transferred to the successor entity. Users will be notified via email and/or a prominent notice on the Service before information becomes subject to a materially different privacy policy.
Data Retention
| Data Type | Retention Period |
|---|---|
| Audit logs | Minimum 6 years, in compliance with applicable recordkeeping regulations. Cannot be deleted by users or administrators. |
| Task and work product data | Duration of the Client's contract with Solentis, plus 90 days following contract termination. |
| WhatsApp conversation history | Duration of the Client's contract for compliance review purposes. The last 10 turns per user are retained as active context for Sofia. |
| Account data | Until the user account is deleted by a Client administrator or until contract termination. |
| Voice audio | Not retained by Solentis. Transcribed text is retained as WhatsApp conversation history (see above). |
| Error monitoring data (Sentry) | 90 days per Sentry's default retention schedule. |
| Authentication and security logs | 12 months. |
Data Security
Solentis implements technical and organizational security measures to protect personal information against unauthorized access, disclosure, alteration, and destruction.
Authentication and access controls
Passwords are stored as one-way bcrypt hashes. Two-factor authentication (2FA) is enforced via time-limited email codes with Redis-backed nonce replay prevention. Sessions expire after 24 hours with no rolling extension. Role-based access control (admin, manager, user) is enforced at both the API layer and the database layer.
Data isolation
Every database query is scoped to the authenticated user's organization. Row-Level Security (RLS) policies are enforced at the database level as a defense-in-depth layer. Users cannot access data belonging to other organizations under any circumstances.
Transport security
All data is transmitted over HTTPS/TLS. WhatsApp webhook authenticity is verified via HMAC-SHA256 signature. File uploads are transmitted directly from the client browser to Solentis's storage provider via signed URLs and are never routed through the application server.
Infrastructure security
The application is hosted on Vercel with DDoS protection. The database is hosted on Supabase with encryption at rest and automated backups. Redis (Upstash) provides rate limiting on authentication endpoints. Application errors are monitored via Sentry.
No security measure is perfect or guaranteed. In the event of a confirmed breach of personal information, Solentis will notify affected Clients without unreasonable delay and in accordance with applicable state breach notification laws.
Your Privacy Rights
Depending on your state of residence, you may have specific rights with respect to your personal information. The following rights are recognized by Solentis for all U.S. users:
- Right to access. You may request a copy of the personal information Solentis holds about you.
- Right to correction. You may request that inaccurate personal information be corrected.
- Right to deletion. You may request deletion of your personal information, subject to legal retention obligations (including the six-year audit log retention requirement). All non-legally-required data will be deleted upon a valid request.
- Right to data portability. You may request your task and account data in a machine-readable format.
- Right to restrict processing. You may request that Solentis stop processing your personal information for purposes beyond legal compliance. Note that some restrictions may prevent use of the Service.
Additional rights for California residents (CCPA/CPRA)
- Right to know the specific pieces of personal information collected about you
- Right to know the categories of sources from which personal information is collected
- Right to know the categories of third parties to whom personal information is disclosed
- Right to opt out of the sale or sharing of personal information (Solentis does not sell or share personal information; no opt-out action is required)
- Right to limit use of sensitive personal information (Track does not collect sensitive personal information as defined by the CPRA, except as necessary for account authentication)
- Right to non-discrimination: Solentis will not deny service, charge different prices, or provide a different quality of service because you exercised a CCPA right
Solentis will respond to verified CCPA rights requests within 45 days. Where reasonably necessary, we may extend this period by an additional 45 days with prior notice.
How to exercise your rights
Submit requests to marcomendoza@avilapeakpartners.com. We will verify your identity before processing any access, correction, or deletion request, typically via confirmation of your registered email address and a one-time authentication code.
Note: Because Track is a B2B platform, some requests — particularly deletion — may need to be directed to your Client organization's administrator, as your employer may have independent legal obligations that prevent immediate deletion of certain records.
Children's Privacy
Track is a professional business productivity platform and is not directed to children under the age of 13. Solentis does not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information through the Service, we will delete that information promptly.
Changes to This Policy
When we make material changes to this policy, we will:
- Update the “Effective Date” at the top of this document
- Notify Client administrators via email at least 30 days before the change takes effect
- Post a prominent notice within the Track application
Your continued use of Track after the effective date of a revised policy constitutes your acceptance of the updated terms. If you do not agree to the revised policy, you must discontinue use of the Service and notify your organization's administrator.
Contact
Solentis LLC
Privacy inquiries: marcomendoza@avilapeakpartners.com
Security concerns: marcomendoza@avilapeakpartners.com
For questions about your organization's specific use of Track — including user access, data within your organization's workspace, or your employer's data practices — contact your organization's Track administrator directly.
Last reviewed: April 13, 2026. Solentis LLC. All rights reserved.
Terms of Service →