Privacy Policy
How OnTrak Technologies collects, manages, and safeguards personal and operational data across our diagnostic assessments, consultation booking engine, and ongoing client operations.
01. Introduction & Scope
OnTrak Technologies Inc. (operating as OnTrak.tech, "OnTrak", "we", "our", or "us") provides virtual business operations support, process architecture, intelligent workflow automations, and custom software solutions to commercial clients across the United States, the United Kingdom, and the European Union.
This Privacy Policy governs the collection, processing, and protection of information obtained through our website (ontrak.tech), our Free Operations & Automation Assessment diagnostic tools, discovery consultation scheduling forms, and subsequent client communications.
02. Information We Collect
We collect only the minimum necessary information required to evaluate your operational requirements, provide diagnostic insights, schedule consultations, and deliver contracted services.
assessment Free Assessment Diagnostics
- Business email address
- Company name and industry
- Estimated team headcount (1–5, 6–20, 21–50, 50+)
- Primary operational bottlenecks (CRM, onboarding, internal ops)
- Current software tools and workflow descriptions
calendar_month Discovery Booking Details
- Full name and representative title
- Company and corporate email address
- Selected service track and consultation objective
- Preferred appointment date, time, and timezone
- Optional project notes and communication preferences
Automated Device & Usage Data: When browsing our website, basic technical data may be recorded automatically, including IP address, browser type, referral URLs, operating system, and anonymous interaction analytics via privacy-first server analytics.
03. How We Use Your Information & Legal Basis
Under the EU General Data Protection Regulation (GDPR) and UK Data Protection Act, we process personal data under clearly established lawful bases:
- Performance of Pre-Contractual Measures & Contracts (Art. 6(1)(b)): To calculate and deliver your requested Operations Assessment, schedule discovery calls, generate calendar invites (.ics), and execute agreed Statements of Work.
- Legitimate Business Interests (Art. 6(1)(f)): To communicate directly regarding your inquiries, safeguard our infrastructure against spam or abuse, improve workflow advisory frameworks, and evaluate operational feasibility.
- Legal Compliance (Art. 6(1)(c)): To maintain mandatory accounting records, comply with enterprise tax obligations, and protect lawful business rights.
Because our operational consulting involves reviewing internal SOPs, team capacity, and workflow bottlenecks, we treat all disclosed operational information as strictly confidential proprietary trade data.
We never disclose, publish, or share your proprietary tool configurations, customer databases, or workflow diagrams with third parties or competitors. We routinely execute bilateral Non-Disclosure Agreements (NDAs) prior to accessing client software environments or API credentials.
05. Data Storage, Encryption & Security
We implement defense-in-depth technical and organizational measures aligned with industry best practices (strict confidentiality protocols, transit encryption, and secure cloud storage):
All data transferred between your browser and our servers is secured via Transport Layer Security (TLS 1.3 / HTTPS).
All database records and encrypted environment variables utilize AES-256 standard encryption on dedicated secure cloud nodes.
Role-based access controls (RBAC) ensure only authorized operational consultants access inquiry submissions.
06. Authorized Third-Party Subprocessors
We do not sell, rent, or monetize your personal data. We engage only reputable enterprise cloud subprocessors under strict Data Processing Addendums (DPAs):
| Subprocessor | Purpose | Data Location |
|---|---|---|
| Vercel Inc. | Serverless application hosting & edge infrastructure | United States / Global Edge |
| Neon Inc. | Serverless PostgreSQL cloud database storage | United States / European AWS Nodes |
| Resend Inc. | Transactional booking confirmations & assessment notifications | United States / EU Compliance |
07. Your Data Rights (GDPR, UK & US Regulations)
Regardless of your geographic location, OnTrak provides comprehensive self-determination over your data:
- Right of Access & Portability: Request a complete copy of the information we hold regarding your business and contact profiles.
- Right to Rectification: Request correction of inaccurate, incomplete, or outdated details.
- Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your inquiry and assessment records, subject to legal compliance retentions.
- Right to Restrict or Object to Processing: You may object to legitimate interest processing or opt out of non-essential communications at any time.
- California / US State Privacy Rights (CCPA/CPRA): We do not sell personal data, nor do we share personal information for cross-context behavioral advertising. You possess full rights to non-discrimination.
To exercise any of these statutory rights, send a written request to our dedicated data privacy desk at contact@ontrak.tech. Requests are confirmed and fulfilled within 30 calendar days at no charge.
08. Data Retention Periods
We retain operational diagnostic inquiries and consultation booking records for up to 12 months following submission to maintain conversational context during advisory evaluations. If no formal client engagement ensues, unengaged diagnostic records are safely purged or anonymized.
For retained commercial clients under active Statements of Work, records are retained for the duration of the engagement plus statutory tax and accounting retention periods (typically 6–7 years).
09. Cookies & Local Storage
We deploy strictly essential session cookies to support secure site navigation and record your cookie preference status. For comprehensive details on cookie classification and control preferences, view our dedicated Cookie Policy.
10. Contact Our Data Privacy Officer
If you have questions, regulatory inquiries, or requests concerning this Privacy Policy, please reach out directly: