Privacy Policy

Prime Performance RMS (the “Application”) is a private relationship and financial management tool operated by Rob Tracz (the “Operator”) for his personal and business use. The authorized user of the Application is the Operator. This policy also describes how data about third parties (the Operator's contacts, clients, and prospects) is handled.

The Application collects and stores:

• Contact data: names, email addresses, phone numbers, social profile URLs, segment, and source. Imported from Keap, ClickUp, QuickBooks Online, and manual entry.
• Communication records: sent and received emails (via Gmail), call recordings and transcripts (via Fathom), voice notes, meeting calendars (via Google Calendar).
• Financial data: revenue and expense records (synced from QuickBooks Online), invoices, payment categorizations.
• AI-generated content: summaries, briefings, and extracted insights produced by Anthropic Claude.
• Authentication tokens: OAuth credentials for connected services (Gmail, Calendar, QuickBooks Online).
• Usage telemetry: token consumption logs from Anthropic API calls; email send/open/click events from Resend.

Data is stored in a managed PostgreSQL database (Neon) with encryption at rest and TLS in transit. The Application runs on Vercel. Both providers operate in US data centers. OAuth tokens and API keys are encrypted at the platform level.

The Application integrates with the following providers, which receive data necessary for their respective functions:

• Intuit QuickBooks Online— income and expense data sync.
• Anthropic (Claude API)— AI summaries, extraction, and content generation.
• OpenAI (Whisper API)— voice note transcription.
• Resend— outbound transactional and marketing email; open/click event webhooks.
• Google (Gmail API + Calendar API)— one-to- one email send and calendar sync.
• Fathom— meeting recording and transcript sync.
• ClickUp— task and contact sync.
• Keap— legacy contact and revenue import.
• Vercel— application hosting and request logging.
• Web Push providers (Apple, Google)— delivery of progressive-web-app notifications.

Each provider operates under its own privacy policy. The Operator shares only the data necessary for the integration to function.

Communication content (emails, transcripts, voice notes) is sent to Anthropic Claude and OpenAI Whisper for processing. Both providers offer commercial-tier privacy commitments under which inputs and outputs are not used to train their public models.

The Application uses a single encrypted session cookie (iron-session) for authentication. No third-party advertising or analytics cookies are set.

Records are retained for as long as they serve the Application's purpose. Specific contacts, interactions, or messages can be deleted on request by emailing rob@robtracz.com.

Individuals whose personal data is stored in the Application (contacts, prospects, clients) may request access, correction, or deletion of their data by emailing the address above. Requests are honored promptly subject to verification of identity.

Recipients of marketing email sent through the Application can unsubscribe via the link included in every message. Unsubscribed contacts are excluded from future broadcasts, sequences, and automation rules. Transactional and one-to-one email may continue.

Industry-standard security practices are used, including TLS for all network traffic, encrypted database connections, encrypted environment variable storage in Vercel, and OAuth 2.0 for all third-party integrations. No system is fully secure; the Operator cannot guarantee absolute protection against breach.

Material changes to this policy will be reflected in the “Last updated” date above.

Questions, deletion requests, or other privacy-related inquiries: rob@robtracz.com.