Last Updated: July 6, 2026
GRATtrack, LLC (“GRATtrack,” “we,” “our,” or “us”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our website at http://www.grattrack.com (the “Site”) and the GRATtrack software platform you access through it (together, the “Services”). It also describes the choices you have regarding that information.
GRATtrack provides a software platform that licensed attorneys and law firms use to administer and track two-year rolling grantor retained annuity trusts (“GRATs”) on behalf of their own clients. Our customers are licensed attorneys and law firms (“Customers”); the Services are not directed to consumers. Please also review our Terms of Service at https://grattrack.com/legal/terms/, which govern your use of the Services.
This Privacy Policy describes how we collect, use, and disclose information about our Customers and visitors to the Site, such as registration details, login credentials, and billing and usage information, as well as information a Customer enters about its own clients and their trusts (defined below as “Customer Data”).
Information you provide to us. When you register for an account, subscribe to the Services, communicate with us, or otherwise use the Services, we may collect:
• Identifiers and contact details, such as your name, law firm name, professional role, email address, and telephone number;
• Account credentials, such as your username and password;
• Billing and transaction information, such as your subscription selections (we invoice Customers and/or End Clients directly and do not collect or store credit or debit card numbers); and
• Communications, such as the contents of messages, support requests, and feedback you send to us.
Customer Data you enter. A Customer (and its authorized users) may use the Services to enter information about the Customer’s own clients, the individual grantors, trustees, and authorized representatives of the trusts it administers (“End Clients”), and about their trusts, including End Client and trustee names, portfolio holdings and valuations, contributions and distributions, GRAT parameters, and the contact and billing information used to invoice the performance-based fee that may apply to certain Services (collectively, “Customer Data”). GRATtrack does not connect to any brokerage, custodian, or bank account; all such information is entered manually by the Customer or its supervised staff.
Information we collect automatically. When you use the Services, we automatically collect information such as your IP address, browser type, device identifiers, operating system, the pages and features you access, the dates and times of your visits, and other usage and diagnostic information. We collect this information using server logs, cookies, and similar technologies, as described under “Cookies and Tracking Technologies” below.
Information from other sources. We may receive limited information about you from our Customers (for example, when a Customer designates you as an authorized user) and from service providers that help us operate the Services.
We use personal information to provide and operate the Services and to run our business, including to:
• Provide, maintain, secure, and support the Services, and create and administer accounts;
• Authenticate users and prevent fraud, unauthorized access, and other misuse;
• Process subscriptions and invoices, including invoicing the performance-based fee directly to the responsible End Client where it applies (and if directed);
• Communicate with you about the Services, respond to your inquiries, and provide customer support;
• Send marketing communications to Customers, such as product news (you may opt out at any time); and
• Comply with legal obligations and enforce our agreements.
We use personal information only to provide the Services. We do not use Customer Data for our own independent purposes (other than invoicing and collecting the performance-based fee, as described below), including for advertising, or, in identifiable form, to develop or train products or services.
Our role with respect to Customer Data. GRATtrack processes Customer Data only as a service provider, on the Customer’s behalf and under its instructions, and the Customer is the responsible business for that information, except where a Premium subscription applies, in which case GRATtrack may use the End Client contact and billing information to invoice and collect the performance-based fee.
Aggregated and de-identified information. We may aggregate or de-identify personal information so that it no longer reasonably identifies any individual. We may use and disclose aggregated or de-identified information for any lawful purpose, including to operate, analyze, improve, and develop our Services. Where we maintain information in de-identified form, we will maintain it as de-identified and will not attempt to re-identify it except as permitted by law.
Cookies and Tracking Technologies
We and our service providers use cookies and similar technologies to operate the Site, authenticate users, remember your preferences, and analyze how the Services are used so that we can improve them. We use:
• Strictly necessary cookies, which are required to operate the Services and keep them secure; and
• Analytics and performance cookies, which help us understand how the Services are used.
We do not use cookies for cross-context behavioral advertising, and we do not allow third parties to collect personal information through the Services to serve you targeted advertising. Most browsers let you remove or reject cookies through their settings; if you block strictly necessary cookies, parts of the Services may not function. Where required by law, we honor recognized browser-based opt-out preference signals, such as Global Privacy Control (GPC).
We do not sell or share your personal information. GRATtrack does not sell personal information, and does not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar laws. We also do not disclose personal information to third parties for their own direct marketing purposes. We disclose personal information only as follows:
• Service providers and contractors. We disclose personal information to vendors that perform services for us, such as cloud hosting and data storage, billing and invoicing support, analytics, email delivery, and customer support. We provide them only the information reasonably necessary to perform their services and require them by contract to protect the information and use it only on our behalf.
• At your direction or to our Customer. We disclose Customer Data to the applicable Customer (the attorney) and to others at the Customer’s or your direction.
• Legal and safety. We may disclose information when we believe it is reasonably necessary to comply with applicable law or legal process, to respond to lawful government requests, to enforce our agreements, or to protect the rights, property, or safety of GRATtrack, our Customers, or others.
• Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, or in the event of insolvency or bankruptcy.
Depending on where you live, you may have rights regarding your personal information, such as the rights to access, correct, delete, or receive a copy of it, and to make the other requests described below. If you wish to exercise these rights with respect to the personal information we hold about you, you may contact us at support@grattrack.com.
To the extent the relevant personal information is Customer Data, we will use reasonable efforts to inform the relevant Customer of your choices. As noted above, we only act as a service provider with respect to Customer Data, and you should exercise your rights with your attorney, who acts as the data controller with respect to Customer Data.
This California Privacy Notice supplements the information above and applies to California residents. It uses terms defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA/CPRA”). It describes the personal information GRATtrack collects and uses to operate the Site and Services, as distinct from the Customer Data that GRATtrack processes only as a service provider on a Customer’s behalf (other than invoicing and collecting the performance-based fee as described above).
Categories of personal information we collect. We collect the following categories of personal information, described using the categories set out in the CCPA/CPRA. Whether we collect a given category about you depends on how you use the Services.
|
Category |
Examples we collect |
Categories of recipients |
|
Identifiers |
Name, firm name, email address, telephone number, IP address, account username, online and device identifiers |
Service providers and contractors; the applicable Customer |
|
Commercial information |
Subscription selections; billing and payment records |
Service providers and contractors |
|
Internet or other electronic network activity |
Log data pages and features accessed, usage and diagnostic data, cookie data |
Service providers and contractors (hosting, analytics) |
|
Sensitive personal information |
Account log-in credentials (username and password) |
Service providers and contractors (hosting, security) |
The “Categories of recipients” column lists the parties to whom we disclose each category in order to operate the Services. We may also disclose personal information to government or legal recipients, or in connection with a business transfer, as described under “How We Disclose Information” above.
Categories of sources. We collect personal information from these categories of sources: directly from you; automatically from your device and browser when you use the Services; from our Customers (for example, when a Customer designates you as an authorized user); and from vendors and service providers that help us operate the Services.
Business or commercial purpose for collecting. We collect personal information for the purposes described under “How We Use Information” above.
Selling and sharing. GRATtrack does not sell personal information and does not share personal information for cross-context behavioral advertising, and has not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age.
Disclosures to service providers and contractors. In the preceding 12 months, we have disclosed the categories of personal information described above to service providers and contractors for business purposes. We disclose this information so that they can perform services on our behalf, such as cloud hosting and data storage, billing and invoicing support, analytics, email delivery, and customer support, and for no other purpose. We may also disclose personal information to the applicable Customer and as otherwise described under “How We Disclose Information” above (including to government or legal recipients and in connection with a business transfer).
Sensitive personal information. The only sensitive personal information we collect is your account log-in credentials. We use and disclose that information solely to authenticate you, provide and secure the Services, and prevent fraud (purposes for which the CCPA/CPRA does not require a right to limit), and we do not use it to infer characteristics about you. Accordingly, the right to limit the use and disclosure of sensitive personal information does not apply, because we do not use or disclose it for any purpose that would trigger that right.
Retention. We retain each category of personal information, including sensitive personal information, according to the criteria described under “Data Retention” below.
Your California privacy rights. Subject to certain exceptions, California residents have the right to:
• Know and access the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties and recipients to whom we disclose it (up to twice in a 12-month period);
• Delete personal information we collected from you;
• Correct inaccurate personal information;
• Obtain a portable copy of your personal information;
• Opt out of the sale or sharing of personal information (we do not sell or share personal information);
• Limit the use and disclosure of sensitive personal information (as explained above, this right does not apply to our limited use of credentials); and
• Not receive discriminatory or retaliatory treatment for exercising your rights.
How to exercise your rights. To submit a request to know, delete, or correct, contact us at support@grattrack.com. We will verify your request, generally by confirming information associated with your account, before responding, and we will respond within the time period required by applicable law. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may verify your identity directly. We will not discriminate against you for exercising your rights.
Other U.S. State Privacy Rights
Depending on your state of residence, you may have rights similar to those described above, including the rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, the “sale” of personal information, and certain profiling. To exercise any of these rights, contact us at support@grattrack.com. Where applicable law gives you the right to appeal a decision on your request, we will explain how to appeal in our response to you.
We retain personal information for as long as necessary to provide the Services, maintain your account, comply with our legal, tax, and recordkeeping obligations, resolve disputes, and enforce our agreements. We retain and dispose of Customer Data in accordance with our agreement with the applicable Customer. We determine the appropriate retention period for each category of personal information, including sensitive personal information, based on the amount, nature, and sensitivity of the information, the purposes for which we process it, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.
We maintain administrative, technical, and physical safeguards designed to protect personal information, including sensitive financial information, against unauthorized access, use, disclosure, alteration, and destruction, and we use encryption in transit. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
The Services are intended for licensed attorneys and their authorized users and are not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of consumers under 16. If you believe a child has provided us with personal information, please contact us so that we can delete it.
The Services are intended for use in the United States, and we process and store information in the United States. The Services are not directed to, or intended for, individuals located in the European Economic Area, the United Kingdom, or Switzerland.
The Services may contain links to third-party websites and services that we do not control. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy policies before providing them with information.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last Updated” date above and, where required by law, provide additional notice. Your continued use of the Services after the changes take effect constitutes your acknowledgment of the updated Privacy Policy.
If you have questions about this Privacy Policy or our privacy practices, contact us at: support@grattrack.com
GRATtrack, LLC