Privacy Policy

TrackMyCM provides a commission-tracking platform built for merchant cash advance (MCA) broker shops. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. It applies to the TrackMyCM website and application.

Information we collect

• Account information — your name, email address, company, and role, created when your shop is set up or you are invited as a user.
• Commission and deal data — the deals, funders, merchants, splits, payouts, and related records you and your team enter into the platform.
• Bank connection data — if your shop connects a bank account for reconciliation, we access transaction information through Plaid on a read-only basis. We never receive or store your online banking credentials.
• Usage and device data — basic technical information such as log data and the cookies needed to keep you signed in.

How we use information

• To provide and operate the platform, including calculating commissions, splits, and payouts.
• To reconcile bank deposits against deals when you connect an account.
• To secure accounts, prevent abuse, and maintain an audit trail.
• To provide support and send service-related communications.

We do not sell your personal information, and we do not use your commission or deal data for advertising.

How we protect your data

Each account is isolated at the database level using row-level security, so every query returns only the data a signed-in user is permitted to see. Bank connection tokens are encrypted with AES-256-GCM. The platform runs on infrastructure that enforces HTTPS, and sign-in supports two-factor authentication.

Service providers

We share information only with the providers that help us operate the platform, and only to the extent each needs to perform its function:

• Supabase — database and authentication.
• Vercel — application hosting.
• Plaid — read-only bank account connections for reconciliation.
• Resend — transactional and statement emails.
• Anthropic — powers the optional in-app assistant, when your shop enables it.

We may also disclose information if required by law or to protect the rights, safety, and security of our users and the platform.

Data retention

We retain your information for as long as your account is active and as needed to provide the platform. When an account is closed, we delete or de-identify data within a reasonable period, except where we are required to retain it to meet legal, accounting, or security obligations.

Your choices

You may access, correct, or request deletion of your information, and request an export of your data, by contacting us. Some records may be retained as described above. You can manage sign-in cookies through your browser, though disabling them will prevent you from logging in.

Children

TrackMyCM is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page.

Contact

Questions about this policy or your data can be sent to hello@trackmycm.com.