Overview
Triple Crown Investments ("Company," "we," "us," or "our") operates The Paddock platform ("Platform") at www.tcrpaddock.com. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with your use of the Platform.
This Policy applies to all users of the Platform, including subscribers, trial users, and team members invited by subscribers. By using the Platform, you consent to the data practices described in this Policy.
Information We Collect
2.1 Information You Provide Directly
- Account Registration: Name, email address, company name, business market/territory, and password when you create an account
- Subscription & Billing: Payment card information processed and stored by Stripe, Inc. (we do not store full card numbers)
- Lead Data: Property addresses, owner names, notes, and other information you enter about real estate leads
- Communications: SMS and email messages you draft and send through the Platform
- Team Information: Names and email addresses of team members you invite
- Support Inquiries: Messages you send to our support team
2.2 Information We Collect Automatically
- Usage Data: Features accessed, actions taken, session duration, and interaction patterns within the Platform
- Platform Metrics: Counts of skip traces run, messages sent, leads created, and appointments booked (stored in your browser's localStorage)
- Device Information: Browser type, operating system, IP address, and device identifiers
- Log Data: Server logs from our Vercel-hosted serverless functions, including API call timestamps and error events
2.3 Third-Party Data Retrieved on Your Behalf
- Property Data: Property records, ownership information, tax status, and equity data retrieved from BatchData based on addresses you provide
- Skip Trace Results: Owner contact information (phone numbers, email addresses, address history) retrieved from BatchData's skip trace service at your direction
- Street View Imagery: Property photographs retrieved from Google's Street View API based on addresses you input
How We Use Your Information
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Providing and operating the Platform | Account info, lead data, usage data | Contract performance |
| Processing payments and managing subscriptions | Billing info (via Stripe) | Contract performance |
| Sending account notifications and updates | Email address | Contract performance |
| Enabling team collaboration features | Team member names and emails | Contract performance |
| Generating AI-powered property analysis | Property data you provide | Contract performance |
| Enabling skip trace and outreach features | Addresses and names you input | Contract performance |
| Platform analytics and improvement | Aggregated usage data | Legitimate interests |
| Customer support | Support inquiry content | Legitimate interests |
| Fraud detection and security | Account info, usage patterns, IP | Legitimate interests |
| Legal compliance | Any data as required | Legal obligation |
Third-Party Services & Data Processors
The Paddock integrates with several third-party services to deliver its functionality. When you use these features, data is transmitted to these providers subject to their own privacy policies:
| Provider | Purpose | Data Shared |
|---|---|---|
| BatchData batchdata.com | Property data lookup and owner skip tracing | Property addresses, owner names you input |
| Anthropic anthropic.com | AI message generation and property analysis | Property details and context you provide |
| Twilio twilio.com | SMS delivery | Recipient phone numbers and message content |
| Resend resend.com | Email delivery | Recipient email addresses and message content |
| Stripe stripe.com | Payment processing | Billing information, subscription details |
| Google google.com | Maps, geocoding, street view imagery | Property addresses you search |
| Vercel vercel.com | Platform hosting and serverless functions | All Platform traffic and API requests |
| EmailJS emailjs.com | Registration and notification emails | User email address, name |
We encourage you to review the privacy policies of these providers. We are not responsible for their data practices.
Data Sharing & Disclosure
We do not sell your personal data. We do not share your personal information with third parties for their own marketing purposes.
We may share your information in the following limited circumstances:
- Service Providers: With third-party vendors who process data on our behalf to deliver the Service (listed in Section 4), subject to confidentiality obligations
- Your Team: Information you choose to share within your account's team members
- Legal Requirements: If required by law, subpoena, court order, or government authority, or to protect the rights, property, or safety of the Company, our users, or the public
- Business Transfers: In connection with a merger, acquisition, or sale of all or part of the Company's assets, with notice to you
- With Your Consent: In any other circumstances with your explicit consent
Data Storage & Security
Where Data is Stored: The Platform currently stores most user data in your browser's localStorage on your own device. Server-side data is processed through Vercel's serverless infrastructure. API keys and credentials are stored as Vercel environment variables.
Security Measures: We implement the following security measures:
- All data transmitted to and from the Platform is encrypted via HTTPS/TLS
- API keys are stored server-side and never exposed to client-side code
- Third-party payment processing by Stripe means we never handle raw payment card data
- Access to administrative functions requires authentication
- The SuperAdmin portal requires separate master credentials
Limitations: Data stored in your browser's localStorage is accessible to anyone with access to your device and browser. We recommend using password-protected devices and logging out when using shared computers.
No Guarantee: Despite our security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
Data Retention
- Account Data: Retained for the duration of your subscription plus 30 days following termination, after which it is deleted
- Lead & Property Data: Stored in your browser's localStorage — persists until you clear your browser data or we migrate to cloud storage
- Server Logs: Retained for up to 90 days for security and debugging purposes
- Billing Records: Retained as required by applicable tax and accounting laws (typically 7 years)
- Skip Trace Results: Cached temporarily in localStorage for performance; not stored in any central database by us
- Deleted Accounts: Personal data is deleted within 30 days of account termination, except where retention is required by law
Your Privacy Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of inaccurate personal data
- Deletion: Request deletion of your personal data, subject to legal retention requirements
- Portability: Request your data in a structured, machine-readable format
- Objection: Object to processing of your data for certain purposes
- Restriction: Request restriction of processing in certain circumstances
- Withdraw Consent: Where processing is based on consent, withdraw consent at any time
To exercise any of these rights, contact us at coleton@triplecrowninvestments.com. We will respond within 30 days. We may need to verify your identity before processing your request.
Cookies & Local Storage
Cookies: The Platform may use session cookies for authentication purposes. We do not use tracking cookies or advertising cookies.
localStorage: The Platform uses your browser's localStorage extensively to persist your data between sessions, including:
- Lead and property data you create
- Inbox conversation threads
- Skip trace history
- Scout history and preferences
- Platform usage metrics
- User preferences and settings
This data is stored locally on your device and is not transmitted to our servers except when you explicitly use features that require server-side processing (such as skip tracing or sending messages).
Managing Storage: You can clear localStorage data at any time through your browser's developer tools or privacy settings. Clearing this data will remove your locally-stored leads, conversations, and preferences.
Children's Privacy
The Paddock is a professional B2B platform intended solely for adults (18 years of age or older) operating real estate businesses. We do not knowingly collect personal information from anyone under 18 years of age.
If we become aware that we have inadvertently collected personal information from a person under 18, we will delete that information immediately. If you believe we have collected information from a minor, please contact us immediately at coleton@triplecrowninvestments.com.
California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
- Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising
- Right to Limit Sensitive Data Use: We do not use sensitive personal information beyond what is necessary to provide the Service
- Non-Discrimination: We will not discriminate against you for exercising your privacy rights
To exercise California privacy rights, contact us at coleton@triplecrowninvestments.com with "California Privacy Request" in the subject line. We will respond within 45 days.
Categories of Personal Information Collected: Identifiers (name, email, IP address), commercial information (subscription and billing data), internet activity (usage patterns), and professional information (business name, market territory).
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify active subscribers of material changes via email at least 14 days before changes take effect.
The "Last Updated" date at the top of this Policy indicates when it was most recently revised. We encourage you to review this Policy periodically.
Your continued use of the Platform after any changes constitutes your acceptance of the updated Policy.
Contact Us
For privacy questions, data access requests, or concerns about this Policy, contact us at:
- Company: Triple Crown Investments
- Platform: The Paddock — www.tcrpaddock.com
- Privacy Email: coleton@triplecrowninvestments.com
- Response Time: We aim to respond to all privacy inquiries within 30 days
For urgent data security concerns, please mark your email subject line "URGENT: Privacy" and we will prioritize your request.