Privacy Policy
How we collect, manage, and safeguard data in compliance with the EU General Data Protection Regulation (GDPR) and the United States federal and state privacy frameworks (including CCPA/CPRA).
Last Updated: June 1, 2026
Scope & Regional Limitations
This Privacy Policy exclusively governs the processing of personal data by Brass Tracks Software ("we," "our," "us") for clients, prospective clients, and visitors located in the European Union (EU), the European Economic Area (EEA), and the United States (US). We focus our services on these regions and do not actively solicit or target data subjects outside of the EU and US markets.
Categories of Personal Information
In our business-to-business (B2B) software engineering and modernization practices, we limit data collection to the minimum required for contract execution and service delivery. We collect:
- Identifiers: Professional name, business email address (e.g.,
hello@brasstracks.net), corporate phone number, physical business address, and company affiliation. - Commercial Information: System architecture requests, project scopes, execution milestones, invoicing details, and payment histories.
- Internet or Network Activity: IP addresses, browser specifications, and device identifiers recorded through our website traffic analytics.
GDPR Lawful Bases & Data Subject Rights
For individuals residing in the EU/EEA, our processing is grounded on the following legal bases:
Contractual Necessity
Processing is required to initiate, execute, or deliver services defined under our fixed-price milestones and blueprint scopes.
Legitimate Interest
Processing serves our business interests in securing our digital architecture, optimizing client communication, and conducting professional outreach.
EU data subjects enjoy the following rights under Chapter III of the GDPR:
- Right to access personal records and request copies.
- Right to rectify incorrect, incomplete, or outdated data.
- Right to erasure ("Right to be Forgotten") where processing is no longer required.
- Right to restrict or object to processing under legitimate interest claims.
- Right to data portability in standard machine-readable formats.
California & US State Privacy Rights
Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, and other applicable US state frameworks, US residents are entitled to specific rights regarding their personal information.
No Sale or Sharing of Data
We have never sold, rented, leased, or shared personal information to third parties for monetary or other valuable consideration. We do not engage in behavioral cross-context advertising.
US Consumer Rights
US consumers have the right to request disclosure of what personal information is collected, the right to delete collected data, the right to correct inaccurate records, and the right to non-discriminatory treatment for exercising their privacy rights.
Data Integrity & EU-US Transfers
All code repository interactions, client schemas, database migrations, and administrative records are protected using strong end-to-end encryption (TLS 1.3 in transit and AES-256 at rest).
Since our engineering operations are headquartered in Romania (EU) and we serve enterprise clients in the US, any cross-border transfers are executed in strict alignment with GDPR-approved Standard Contractual Clauses (SCCs) and in compliance with the EU-U.S. Data Privacy Framework.
Exercise Your Privacy Rights
To submit an access, erasure, correction, or portability request under GDPR or CCPA frameworks, please contact our Data Protection Officer directly: