TavaTrack LLC ("TavaTrack," "we," "us," or "our") is a Wyoming limited liability company, operated from Massachusetts, with its principal place of business at 8 Fowler Street, Danvers, MA 01923. We operate two lines of business under the TavaTrack name:
Together with our website at tavatrack.com and all of its pages and sub-pages (the "Site"), our customer support channels, our sales and marketing activities, and any other product or service that links to this Privacy Policy, these are the "Services."
This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to everyone whose information we handle: our customers and their staff, people who call or message a business that uses the Automation Service, people who see or respond to advertising we run for a Creative Service client, visitors to the Site, and businesses we contact about our Services.
This Privacy Policy is incorporated by reference into the TavaTrack Terms of Service (tavatrack.com/terms) and, for Automation customers, the Service Agreement (tavatrack.com/service-agreement). Where a signed agreement between TavaTrack and a customer addresses data handling in more detail, the signed agreement controls as between the parties to it. This Privacy Policy is a disclosure of our practices; it is not itself a contract and does not create rights beyond those provided by applicable law.
If you do not agree with this Privacy Policy, please do not use the Services.
Because we serve businesses that in turn serve the public, we handle information in two capacities. Which one applies determines who you should contact to exercise your rights (Section 12).
| Whose information | Examples | Our role | Who to contact about it |
|---|---|---|---|
| Customers (the businesses that buy the Services) and their owners, staff, and authorized users | Account holder name, email, mobile number, business details, billing, support history, login and usage data | Controller / business. We decide how this information is used to provide and bill the Services. | TavaTrack — support@tavatrack.com |
| Callers, texters, and chat users of an Automation customer ("End Callers") | A homeowner who calls a contractor's number and speaks with the AI receptionist; a visitor who uses the chat widget on a contractor's site; a past customer who receives a review-request or winback text | Processor / service provider to the Automation customer. We handle this information only on the customer's behalf. | The business you contacted (the contractor). We assist them on request. |
| Ad audiences and lead-form respondents of a Creative customer ("Ad Respondents") | A person who sees a Meta ad we produced; a person who submits a Meta instant form or a website form tied to a campaign we manage; a customer whose conversion the client's Pixel reports | Processor / service provider to the Creative customer. Meta Platforms, Inc. is a separate, independent controller of the data it collects through its own platform. | The business whose ad you saw or responded to; and Meta, for Meta's own processing. |
| Prospects (businesses we contact about the Services, and the individuals we contact there) | An HVAC owner we email about the Automation Service; a med-spa marketing manager we send a sample ad to | Controller. We decide to contact you, based on our legitimate interest in marketing our Services to businesses. | TavaTrack — support@tavatrack.com, or reply "unsubscribe" / "stop" |
| Site visitors | Anyone who browses tavatrack.com, submits a contact form, or opts into SMS reminders | Controller. | TavaTrack — support@tavatrack.com |
Where this Privacy Policy says we act "on behalf of" a customer, we mean we act as that customer's processor or service provider (as those terms are used under the California Consumer Privacy Act and similar laws), under written terms that restrict our use of the data to providing the Services to that customer.
When you sign up for the Automation Service, or during onboarding, we collect:
When your AI receptionist answers a call, text, or chat on your behalf, we collect the information needed to capture the lead and, where enabled, book the job. This typically includes:
We also generate operational metadata about each interaction: timestamps, call duration, the number dialed, call disposition, SMS delivery receipts, and the automated workflow logs used to route, retry, and troubleshoot each step.
When you engage the Creative Service, we collect:
To research, launch, and measure campaigns we request partner access to your advertising assets through Meta Business Manager / Business Portfolio. Depending on the package, this may include your Ad Account, Facebook Page, Instagram account, Pixel and datasets (including Conversions API), catalogs, lead forms, and domain verification. We never ask for your Facebook or Instagram password, and you retain ownership of every asset. You can revoke our access at any time from Meta Business Manager.
Through that access we can see and, on your behalf, use:
Before a business becomes a client, we may produce a sample ad to show what we could do for them. Samples are built from the business's publicly available brand presence — its name, logo, website, public ads in the Meta Ad Library, and public reviews. Samples are delivered privately to the business; they are not published, not run as ads, and not shown as client work without the business's permission. See Section 5.3.
Our public portfolio consists of fictional brands created to demonstrate style and approach. Client work appears in our portfolio only with the client's written permission.
Some Creative customers operate in health-adjacent fields (for example med spas, dental practices, or fitness). TavaTrack is not a HIPAA covered entity or business associate and does not accept protected health information. Customers in these fields must not send us patient records, appointment histories, or any information that identifies a person as a patient, and must configure Pixel, Conversions API, and lead forms in line with Meta's restrictions on health and other sensitive data categories. We may decline to run or will modify any campaign or data flow that we believe would transmit sensitive-category data to Meta. If a customer needs a business-associate agreement, that must be negotiated and signed separately; nothing in this Privacy Policy creates one. The same approach applies to other sensitive categories (for example financial-services offers subject to Meta's special ad categories).
When you submit our sign-up form, or a contact or free-sample request, we collect the fields you enter — typically name, business name, phone, email, trade or industry, service area, number of locations, the plan you clicked (if any), and your message — together with your consent to be contacted by phone, text, or email about your request, the address of the page you sent it from, and the first-visit source information described in Section 14 (the page you first landed on, the referring website, and any campaign tags in the link, such as utm, gclid, or fbclid). Submissions are delivered to our team by email through our transactional email provider (Section 7.1), may also be logged in our own lead tracker through our workflow tool, and are kept in our inbox and CRM.
If you opt in to receive text messages from us on the Site (for example appointment reminders or demo follow-up), we record your phone number, the consent language you agreed to, and the date and time of consent, so we can prove consent and honor opt-outs. See Section 8 for our SMS practices.
We use two analytics services to understand how visitors use the Site. Vercel Web Analytics is cookieless: it records page views, referrers, approximate country and region derived from IP address, device type, and browser (and may record the same button-click and sign-up events described below), and does not set cookies or follow you across other sites. Google Analytics 4 (provided by Google LLC) sets first-party cookies (_ga and _ga_<ID>, kept up to 2 years) and records the pages you view, how you arrived (referrer and campaign tags such as utm, gclid and fbclid), how you scroll and interact with pages, clicks on our buttons (including the button text), that a sign-up form was submitted together with the plan, trade and number of locations chosen (never your name, email or phone number), your device and browser type, and approximate location derived from your IP address; Google Analytics 4 does not store full IP addresses. We use this only to understand our traffic and which of our own ads and pages bring inquiries. We do not enable Google signals or link Google Analytics to Google advertising products, and we do not use it to target ads to you. Google processes this data for us under the Google Analytics terms and its data-processing terms; for how Google itself uses information from sites that use its services, see How Google uses information from sites that use its services. See Section 14 for your choices.
Our hosting provider also keeps standard server logs (IP address, requested URL, user agent, timestamp) for security and reliability.
Some pages embed content from third parties — for example a Stripe checkout page, a scheduling widget, or a demo video. When you interact with embedded content, that provider may collect information under its own privacy policy.
TavaTrack markets its Services to businesses. To find and contact businesses we believe we can help, we compile business-contact information, which may include: business name, address, phone number, website, and social media pages; the name, title, business email address, business phone number, and business social profile of an owner, manager, or marketing contact; publicly observable facts about the business's marketing (for example, that it runs Meta ads, how many, and for how long, as shown in Meta's public Ad Library; its public reviews and ratings; its website technology); and our own notes on why we think we can help.
We use prospect information to send business-to-business email, to make phone calls to business numbers, to send direct messages on business social accounts, and to prepare personalized samples (Section 3.4). Our basis for doing so is our legitimate interest in marketing our Services to businesses that appear to need them; we only contact businesses about their own business.
To opt out of everything at once, email support@tavatrack.com with "unsubscribe" in the subject line. We do not sell prospect lists or share them with anyone for their own marketing.
If you refer someone to us, we record your name and the referral so we can credit you. If you give us a testimonial or review, we publish it only with your permission and in the form you approve.
We use the information described above to:
The Automation Service is powered by probabilistic AI. To answer a call or chat, the audio or text is transmitted to our AI providers (Section 7.1), which convert speech to text, generate the receptionist's replies, convert them to speech, and after the interaction extract the caller's details, write a summary, and score the lead. The AI receptionist is configured to disclose that it is an automated assistant whenever asked, and, on lines where the customer has enabled it, to state at the start of the call that the call may be recorded. AI output can be wrong or incomplete; the customer should review leads and bookings and not rely solely on AI summaries for safety-critical decisions.
Calls handled by the Automation Service are recorded and transcribed. Recording is essential to the Service: the transcript is how the lead reaches you. Federal law and the law of many states allow recording with the consent of one party; other states — including Massachusetts, where we operate, as well as California, Connecticut, Florida, Illinois, Maryland, Montana, New Hampshire, Pennsylvania, Washington, and others — require the consent of all parties or notice to them. We build a recording notice into the receptionist's greeting for lines in all-party-consent states, and we recommend it everywhere. As the business operating the phone line, you (the Automation customer) are responsible for ensuring that recording is lawful in your jurisdiction and your callers' jurisdictions, including keeping the recording notice in your greeting. By using the Automation Service you authorize TavaTrack to record and transcribe calls on your behalf.
We use third-party AI models to run the Services. Our agreements with those providers limit them to processing your data to provide their service to us. Under the commercial terms we use, our large-language-model providers do not use your calls, transcripts, chats, prompts, or creative briefs to train or improve their general-purpose models. We do not sell or license your data to any AI company for training. TavaTrack itself does not train foundation models; we may use de-identified examples of receptionist behavior to improve our own prompts and configurations (Section 11).
For the Creative Service we use generative-AI image and video tools to produce ad creative from prompts we write. Prompts and outputs are retained with the piece so we can reproduce and improve it. We label AI-generated or AI-altered creative where Meta's policies or applicable law require it, and we do not create synthetic depictions of real, identifiable people without that person's documented consent.
We do not use personal information to make decisions that produce legal or similarly significant effects on any individual (for example credit, employment, housing, or insurance decisions). Lead scoring helps a contractor prioritize callbacks; it does not deny anyone a service.
We share personal information only as described here. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months.
We use the following providers to run the Services. Each is bound by written terms that restrict its use of your information to providing services to us and require appropriate confidentiality and security.
| Provider | What it does for us | Which Services |
|---|---|---|
| Retell AI, Inc. | Voice AI platform: call handling, speech-to-text, text-to-speech, transcripts, and call recording storage | Automation |
| OpenAI, L.L.C. (via Retell, and directly) | Large-language-model inference that generates the receptionist's and chatbot's responses | Automation |
| Anthropic, PBC | Large-language-model inference: extraction of caller details from transcripts, summaries, lead scoring, chat responses; and research and drafting assistance for creative | Automation, Creative |
| Twilio Inc. | Phone-number provisioning, SIP telephony, and SMS delivery (including Creative lead alerts and lead confirmations) | Automation, Creative, Site (SMS opt-in) |
| Supabase, Inc. | Encrypted cloud database and storage for accounts, leads, calls, and configuration | Automation |
| n8n GmbH (n8n Cloud) | Workflow automation that routes calls, leads, notifications, bookings, and alerts between the other providers | Automation, Creative |
| Jobber (Octopusapp Inc.) | CRM and field-service scheduling — only where you connect your Jobber account. Booking writes the caller's name, phone, address, and job details into your Jobber account; returning-customer lookup reads it. | Automation |
| Cal.com, Inc. | Appointment scheduling — only where you connect your Cal.com account | Automation |
| Stripe, Inc. | Payment processing, subscription billing, invoicing, and fraud prevention | All |
| Vercel Inc. | Website hosting, serverless form handling, and cookieless analytics | Site |
| Google LLC (Google Analytics 4) | Website analytics (Section 4.3) | Site |
| Resend, Inc. | Transactional email delivery for Site form submissions and notifications | Site, Automation |
| Google LLC (Google Workspace) | Business email, calendar, and document storage for our team; the shared workspace where Creative deliverables and reports are kept; the lead trackers (Google Sheets) we keep for Creative clients | All |
| Meta Platforms, Inc. | Advertising platform on which Creative campaigns run, accessed through partner access to your assets (see 7.2) | Creative |
| Higgsfield AI, Inc. and comparable generative-media providers | AI image and video generation from prompts we write | Creative |
| Smartlead and comparable email-outreach platforms | Sending and tracking business-to-business marketing email | Marketing |
| Apollo.io, Clay, and comparable business-data providers | Finding and verifying business-contact details | Marketing |
We will update this table when we add or replace a provider that processes personal information; customers with a signed Service Agreement will be notified as that agreement provides.
When we run campaigns for a Creative customer, we operate inside the customer's own Meta assets as the customer's agency. Meta is an independent controller of the information it collects through Facebook, Instagram, the Pixel, the Conversions API, and lead forms, and processes it under Meta's Privacy Policy and its Business Tools Terms. We do not receive from Meta any information about individual people who merely see an ad. Lead-form submissions belong to the customer; we route them where the customer directs, keep them in the customer's lead tracker for the engagement, and delete our copies as Section 11 describes. We do not combine audiences, Pixel data, or lead data across different customers' accounts, and we do not use one customer's data to target ads for another.
All payments for the Services are processed by Stripe. When you enter card or bank details, they go directly to Stripe; we receive only a token, the last four digits, card brand, expiration, and billing name and address. Stripe acts as an independent controller for its own purposes, including fraud detection, regulatory compliance, and — if you choose to use it — Stripe Link. Stripe's practices are described in the Stripe Privacy Policy. We share your name, email, business name, plan, and invoice details with Stripe so that it can bill you and send receipts.
We share End Caller and Ad Respondent information with the customer on whose behalf we collected it — that is the whole point of the Services. We also share it with the systems that customer connects (their CRM, calendar, inbox, or phone), with the customer's staff whom the customer designates (for example emergency pages to an on-call technician), and with the notification channels the customer chooses.
We may disclose information where we believe in good faith that it is necessary to: comply with a law, regulation, subpoena, court order, or other legal process; respond to a lawful request from a public authority; enforce our agreements; detect, prevent, or address fraud, abuse, security, or technical issues; or protect the rights, property, or safety of TavaTrack, our customers, End Callers, or the public. If a request seeks a customer's End Caller or Ad Respondent data, we will notify the customer before responding unless legally prohibited.
If TavaTrack is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, information may be transferred as part of that transaction, subject to this Privacy Policy and to notice to affected customers.
We share information with other parties when you ask us to or consent — for example, when you ask us to send a report to your accountant, or when you approve a case study.
Automation customers: by signing up for the Automation Service and providing a mobile number, you consent to receive transactional text messages from TavaTrack: lead notifications, appointment alerts, emergency pages, and service-status or system alerts. Frequency varies with your call volume; during busy periods you may receive several messages a day. Message and data rates may apply.
Creative customers: we text you only if you opt in by ticking the optional, unchecked "TavaTrack Lead Alerts" box on your order form, as the subscriber or regular user of the number. Consent is not a condition of service. See Section 8.5.
If you enable the Reviews add-on, the Winback add-on, appointment confirmations or reminders, or chat follow-ups, the Service sends text messages to your customers in your name. You are responsible for having the consent that applicable law (including the Telephone Consumer Protection Act and state laws) requires for each message type, for honoring opt-outs, and for the content of those messages, as set out in the Service Agreement. We include opt-out instructions in every recurring message program and stop messaging any number that replies STOP.
We send text messages to Site visitors only after they opt in through a form that records the consent language, number, and time. Texts we send after you tick the contact box on our sign-up form are about the request you made; reply STOP to end them. We send marketing texts to prospects only with prior express consent or where otherwise permitted by law.
Reply STOP to any TavaTrack message to stop receiving messages from that program; reply HELP for help, or email support@tavatrack.com. You can also opt out in any other reasonable way, for example by emailing support@tavatrack.com, and we will honor it. Opting out of texts does not cancel a subscription. We do not share, sell, rent, or trade mobile phone numbers or SMS opt-in consent with any third party or affiliate for their marketing or promotional purposes. Mobile numbers are used solely to deliver the messages described in this Section 8 (including Section 8.5), through our SMS delivery provider.
We run two text programs for Creative clients, both registered with the phone carriers under TavaTrack's brand. Each is optional and off unless the client ticks it on its order form.
Replies and rates. Message and data rates may apply. These texts are automated, but replies are read. Reply HELP for help. Replying STOP, CANCEL, END, QUIT, UNSUBSCRIBE, STOPALL, REVOKE, or OPTOUT opts you out immediately. For Lead Confirmations, any other reply except HELP is treated as a request to stop. For Lead Alerts, any reply asking us to stop, in any words, is honored. Either way we act within one business day, and you can also ask by emailing support@tavatrack.com.
Consent records. We keep a consent and opt-out log (phone number, date and time, the exact checkbox wording, form id, lead id, and client) for 4 years after the last text to that number, to prove consent and keep honoring opt-outs. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are excluded from all of the sharing described in this policy and will not be shared with any third parties.
We maintain an information-security program with administrative, technical, and physical safeguards appropriate to the size of our business and the sensitivity of the information we handle, including:
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own login credentials, CRM credentials, and Meta Business Manager access secure and for promptly revoking access for staff who leave.
If we confirm a security breach that affects personal information in our possession or our providers', we will notify affected customers without undue delay and in any event within the time required by applicable law (for example Massachusetts General Laws chapter 93H and similar state breach-notification statutes), and we will give you the information reasonably available to us to assess and respond, consistent with law-enforcement requests and our investigation. Where the affected information belongs to a customer's End Callers or Ad Respondents, the customer is responsible for any notice to those individuals; we will assist.
We keep personal information only as long as needed for the purposes in Section 6, then delete or de-identify it, except where a longer period is required by law or is needed to establish, exercise, or defend legal claims.
| Category | Retention |
|---|---|
| Customer account and configuration data | Duration of the subscription, then 90 days after cancellation, after which it is deleted from active systems |
| Call recordings, transcripts, summaries, chat logs, and lead records (End Caller data) | Duration of the subscription or as the customer instructs, then 90 days after cancellation. Customers may request earlier deletion of specific records at any time. |
| CRM and calendar integration tokens | Deleted immediately on disconnection or cancellation |
| SMS consent records and opt-out (suppression) lists | Retained for 4 years after the last text to that number, to prove consent and honor opt-outs. For Creative texting this is the log described in Section 8.5. |
| Creative-account data (briefs, assets, research, results, prompts, and outputs) | Duration of the engagement, then 90 days after cancellation; final deliverables the customer has paid for are the customer's and are delivered before deletion |
| Meta partner access | Until the customer revokes it or the engagement ends, whichever is first; we remove ourselves at offboarding |
| Lead-form submissions we route for a Creative customer | Kept in the customer's lead tracker for as long as we work together. Within 30 days after the engagement ends we hand the tracker over to the customer and delete our copies (consent and opt-out records excepted, as above). |
| Prospect (marketing) records | Up to 24 months from our last contact or interaction; suppression records are kept indefinitely so we do not contact you again |
| Site form submissions | 24 months |
| Analytics and server logs | Aggregate analytics indefinitely; Google Analytics event-level data up to 14 months; analytics cookies up to 2 years; server logs up to 90 days; first-visit source information stays in your browser until you clear it (once sent with a form, it is kept with that submission) |
| Billing, invoice, and tax records | 7 years as required by tax and accounting law |
| Support correspondence | 3 years after the account closes |
| Backups | Rolling backups are retained for a limited period (generally no more than 35 days); data deleted from active systems ages out of backups within that cycle |
On written request following termination, we will delete or return a customer's data, subject to the exceptions above. Customers should request any data export before the subscription ends. De-identified and aggregated data — data that no longer identifies you, your business, or any individual, and that we commit not to re-identify — is not subject to deletion and may be retained and used for any lawful business purpose, including improving the Services, benchmarking, and demonstrating results in the aggregate. De-identified data is never sold.
Depending on where you live, you may have some or all of the following rights regarding personal information about you that we hold as a controller:
These rights are provided under laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the comprehensive privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, among others. Many of these laws apply only to businesses above certain size thresholds and exempt business-to-business and employee data; we honor the rights above for everyone regardless of whether a particular statute technically applies to us.
If you are an End Caller or Ad Respondent, the business you contacted or whose ad you responded to is the controller of your information. Please direct your request to that business; it can identify your record and instruct us. We will assist that business with your request, and if you contact us directly we will forward your request to the business and confirm to you that we have done so, to the extent we can identify it. We will not make an independent decision to disclose a customer's End Caller data to a third party without the customer's instruction or a legal requirement.
Email support@tavatrack.com with the subject "Privacy request," or write to us at the address in Section 18. Tell us which right you are exercising and how we can reach you. You may use an authorized agent; we will ask the agent for proof of your written authorization and may ask you to confirm the request directly.
We will verify your identity to a degree of certainty appropriate to the request — usually by matching the email address or phone number in our records and, for deletion or access to sensitive records, by a confirming message to that contact point. We will not ask you to create an account.
We will confirm receipt within 10 business days and respond within 45 days of receipt; we may extend once by a further 45 days where reasonably necessary, and will tell you if we do. There is no charge for a request unless it is manifestly unfounded or excessive. If we decline all or part of a request, we will explain why and how to appeal: reply to our decision within 45 days with "Appeal" in the subject line and a member of management not involved in the original decision will review it and respond within 45 days. If your appeal is denied, we will tell you how to contact your state attorney general or privacy regulator.
We honor Global Privacy Control (GPC) and similar browser opt-out preference signals as a valid request to opt out of sale and sharing where the law requires. Because we do not sell or share personal information, honoring the signal changes nothing about how our Site works.
For the preceding twelve months, the categories of personal information we collected, and the sources, purposes, and disclosures for each, are described in Sections 2 through 7 and summarized here:
| Category (Cal. Civ. Code §1798.140) | Collected? | Sources | Business purposes | Disclosed to (service providers) | Sold or shared? |
|---|---|---|---|---|---|
| Identifiers (name, email, phone, address, IP) | Yes | You; End Callers; public sources; data providers | Provide and bill the Services; support; security; marketing to businesses | Providers in §7.1 as applicable | No |
| Customer records (billing name and address; payment tokens) | Yes | You; Stripe | Billing | Stripe | No |
| Commercial information (plans, purchases, job requests, quotes, appointments) | Yes | You; End Callers | Provide the Services | §7.1 providers | No |
| Internet / network activity (Site usage, form submissions, workflow logs) | Yes | Your device; our systems | Operate, secure and measure the Site and Services | Vercel, Google (Analytics), Supabase, n8n | No |
| Geolocation (service address; approximate location from IP) | Yes (address); coarse only (IP) | End Callers; your device | Book jobs; analytics | §7.1 providers | No |
| Audio and electronic information (call recordings, transcripts, chat logs) | Yes | End Callers | Provide the Automation Service | Retell, OpenAI, Anthropic, Supabase, n8n | No |
| Professional / employment information (role, title, business) | Yes | You; public sources; data providers | Provide the Services; marketing to businesses | §7.1 providers | No |
| Inferences (lead score, urgency, returning-customer status) | Yes | Generated by us | Prioritize leads for the customer | Supabase, n8n, customer's CRM | No |
| Sensitive personal information (account credentials for connected integrations) | Yes (OAuth tokens only) | You | Operate connected integrations | Supabase, n8n | No |
| Biometric identifiers; precise geolocation; government IDs; health; racial/ethnic origin; religion; union membership; sexual orientation; contents of mail not directed to us | Not collected | — | — | — | — |
We do not knowingly sell or share the personal information of consumers under 16. Our contact-form and outreach practices do not involve "sharing" as defined by the CPRA. We retain each category for the periods in Section 11.
We do not sell covered information as defined under Nevada law. Nevada residents may nonetheless submit an opt-out request to support@tavatrack.com.
The Services are designed for businesses in the United States and we do not target users elsewhere. If we nonetheless hold personal information about a resident of the European Economic Area, United Kingdom, Switzerland, or Canada, the legal bases on which we rely are: performance of a contract (providing the Services to our customers); our legitimate interests (operating, securing, and marketing our business, balanced against your interests and rights); consent, where we ask for it (for example marketing texts); and compliance with legal obligations. You have the rights to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent, and you may lodge a complaint with your local supervisory authority. Contact support@tavatrack.com to exercise these rights.
Personal information is stored and processed primarily in the United States. Some providers process limited data in other countries — for example n8n GmbH (Germany) and the global infrastructure of our cloud and AI providers. Where we transfer personal information out of the jurisdiction where it was collected, we do so under appropriate safeguards, including provider terms that incorporate standard contractual clauses where required. By using the Services you acknowledge that your information may be processed in the United States and other countries whose data-protection laws may differ from those of your home jurisdiction.
We keep cookies to a minimum.
_ga and _ga_<ID> (Section 4.3). To turn off both Google Analytics and Vercel Web Analytics, add ?noanalytics=1 to any tavatrack.com URL once (it saves a preference in your browser; clearing your browser's site data removes it), install the Google Analytics Opt-out Browser Add-on, or use a browser setting or extension that blocks analytics scripts and cookies; such an extension also blocks Vercel Web Analytics.ttc_source remembers how you first reached the Site (the page you landed on, the referring website, any utm, gclid, or fbclid tags, and the time); it stays in your browser and is sent to us only if you submit our sign-up form, so we know which ad or page brought your inquiry. It is not saved once you have opted out with ?noanalytics=1. tt_noanalytics remembers that you opted out of analytics. Both stay until you clear your browser's site data.You can control cookies through your browser. Our separate Cookie Policy (tavatrack.com/cookie-policy) gives browser-specific instructions. If the Cookie Policy and this Privacy Policy ever differ, this Privacy Policy controls.
The Services are for businesses and adults. We do not knowingly collect personal information from anyone under 18, and we do not direct any Service, ad, or message to children. If a child's information reaches us — for example a minor calls a contractor's line — we treat it as End Caller data on the customer's behalf and delete it on the customer's or a parent's request. If you believe we hold a child's information, contact support@tavatrack.com.
The Site and our messages may link to third-party websites, apps, and services (for example Meta, Jobber, Cal.com, Stripe). Their privacy practices are their own; we encourage you to read their policies. Our customers' websites, phone lines, and ad accounts are theirs; their privacy policies govern what they do with the information we deliver to them.
We will update this Privacy Policy when our practices, providers, or the law change. The "Last Updated" date at the top tells you when. For material changes — for example a new category of data, a new purpose, or a new type of sharing — we will notify active customers by email and/or in-product notice at least 14 days before the change takes effect, and we will not apply a materially less protective practice to data already collected without your consent where the law requires it. Continued use of the Services after the effective date constitutes acceptance. Prior versions are available on request.
TavaTrack LLC
Email: support@tavatrack.com (privacy requests: subject line "Privacy request")
Web: tavatrack.com
Business address: 8 Fowler Street, Danvers, MA 01923
Registered agent (Wyoming): Northwest Registered Agent Service, Inc., 30 N Gould St Ste N, Sheridan, WY 82801
For SMS help, reply HELP to any TavaTrack message. We respond to all privacy inquiries within one business day and resolve rights requests within the periods in Section 12.