Privacy Policy

The operator of 1031Assist is 1031Assist.com, LLC, a Utah limited liability company ("we" or "us"), which provides the software service directly to end customers and is their contracting service provider. This policy describes information handled through the website, application, and related support. The service helps investors maintain property and exchange records and collaborate with invited professionals.

The service is offered to US customers aged 18 or older, including authorized representatives of organizations. People you invite or send records to may also handle information under their own obligations and policies. This policy does not control copies they retain outside 1031Assist.

Holladay Labs IP, LLC is the intended software licensor to 1031Assist.com, LLC. Its IP or licensing status alone grants no access to customer data and does not establish a controller or processor role. 1031Assist.com, LLC remains the operator identified in this policy.

• Account and contact information: name, email, account identifiers, and phone or company details you provide, together with sign-in and account-status information.
• Property and exchange records: property details, dates, ownership and entity information, financial and tax-planning inputs, professional contacts, notes, and related records.
• Documents and collaboration: uploaded files, extracted or entered facts, messages, invitations, permissions, and activity associated with those records.
• AI requests: text and selected documents submitted for an AI-assisted feature and resulting suggestions or responses.
• Billing information: plan, customer and subscription identifiers, payment status, and billing periods received from Stripe. Card details are entered on Stripe-hosted checkout; the application does not receive your full card number through that checkout.
• Usage and technical information: pages and features used, product activity, browser and device information, browser identifiers, network information such as IP addresses where collected by providers, and error or security logs.
• Support communications: information you include when requesting help or making a privacy inquiry.

Submit only relevant property, closing, entity, and tax-support records you are authorized to provide. Minimize personal identifiers and remove unnecessary sensitive information. Do not upload medical records, payment-card data, passwords, or other access credentials. Also do not submit sensitive information protected by special legislation that requires unique treatment unless we have expressly confirmed support for that category in writing. An upload feature does not establish permission for every tax or financial document; remove unnecessary sensitive information and confirm that you have the required rights before submitting it. Avoid unnecessary identifiers in prompts or support messages.

Information is used to provide sign-in; store and display records; support authorized collaboration; perform requested calculations and exports; process subscriptions; provide requested AI assistance; generate supported service communications; respond to support requests; measure product use; investigate errors and unauthorized activity; and meet applicable legal obligations.

Our policy as operator is not to sell personal information, use it for behavioral advertising, or use private customer records for promotional purposes. We may use deidentified aggregate metrics for product measurement without attempting to reidentify individuals.

Inviting a professional, sharing a link, requesting AI extraction, and purchasing a plan involve different information and recipients, as described below.

Records may be available to invited professionals, exchange participants, authorized company users, and share-link recipients according to feature permissions. Review what an action shares before using it. Revoking access does not retrieve copies a recipient already downloaded or retained.

Providers process information for hosting, identity, storage, payments, email, analytics, monitoring, and requested AI features. Information may also need to be disclosed to satisfy a binding legal requirement or address fraud, abuse, or security incidents, as permitted by law.

• Base44 — application, identity, and storage: hosts the application, handles sign-in and authorized functions, stores records and uploaded files, and receives application activity and product events.
• Base44 — email delivery: provides the integration used to send generated messages such as collaboration invitations. A feature's availability does not guarantee a particular reminder is scheduled or delivered.
• Stripe — payments: processes subscriptions, provides the billing portal, and sends billing-status information to the application.
• Google Analytics 4 — usage analytics: receives browser and usage information about the website and authenticated application, including automatic events where enabled. It uses cookies and browser identifiers.
• Sentry — error monitoring: receives technical error reports. Application filtering removes certain URL and structured values, and default personal-information collection is disabled; this does not guarantee that every error message contains no personal information.
• Base44 AI services and third-party model providers: process text and selected documents for the AI requests you authorize.

Base44's public security and subprocessor information describes its provider network. Inclusion there does not mean every 1031Assist request reaches that provider.

When you explicitly choose an available AI-assisted feature, text and selected documents for that request, including private documents, may be sent through Base44 to third-party AI providers. Optional closing-document assistance also depends on whether that feature is enabled. Ordinary record access does not itself supply the consent required by these application AI request paths.

AI outputs can be inaccurate or incomplete. Check suggested facts and references against original material. An output is not a tax or legal opinion or document authentication.

Base44 hosting and model training: We use Base44 under a non-Enterprise plan. Base44's Terms permit Customer Data to be used to improve its services, including training its software and AI models. Its privacy and security documentation says non-Enterprise workspace data can be used for training, with no plan-level opt-out. We do not promise that information submitted through 1031Assist is excluded from Base44's AI training. This hosting-level limitation also concerns information stored through app forms; choosing not to use an AI-assisted feature does not create a hosting-level training opt-out.

Base44's Data Processing Addendum limits use of personal data to providing its defined services or using fully anonymized or aggregated information. Those defined services include improving the platform. The DPA does not establish a blanket AI-training exclusion or assure that every training use involves only anonymous data. These disclosures do not waive applicable privacy rights or authorize uses beyond applicable law and agreements.

Base44's Terms also describe promotional rights in Customer Data, subject to its Privacy Policy. The DPA imposes separate personal-data restrictions. Our own operator policy in section 3 does not establish identical restrictions on every provider. We do not claim that Base44 actually trained on, sold, or promoted any particular customer record.

Browser storage supports sign-in and preferences. Google Analytics 4 uses first-party cookies, such as _ga, to distinguish browsers and visits and sends usage information to Google. Analytics can initialize on authentication and private routes; automatic activity such as scrolling can be measured even without an application-sent page-view event for that route.

Browser settings can block or remove cookies and local storage. Google provides an Analytics opt-out browser add-on. Restricting sign-in storage can prevent application features from working.

We use HTTPS connections, authenticated sign-in, and access controls designed to limit unauthorized access and support authorized sharing. Monitoring includes configured filtering of certain sensitive values.

No system is completely secure. Protect credentials, review collaborator access, and keep independent copies of important records. These measures do not promise every access path or error report is free of risk.

Canceling a paid subscription does not itself delete your account or records. Account closure, record deletion, and subscription cancellation are separate actions. Maintained Free accounts are not deleted merely because paid access ends.

We retain information for the purposes described here for no longer than reasonably needed, considering account activity, legal obligations, necessary billing records, security, and disputes. A verified deletion request must address applicable active records and files, provider-held information, and retained backups. Where retention is necessary, we will identify the reason and retain only the necessary information with applicable safeguards.

Base44's DPA provides for account deletion on written request, with exceptions for legally required retention and periodic backups. It does not specify a numerical backup-purge interval. We cannot promise immediate removal from every provider system; applicable rights and existing commitments still apply. For information covered by our earlier policy, its commitment to remove or anonymize data within 30 days of account deletion, except information retained as required by law, continues to apply. Provider delays do not by themselves cancel that commitment.

Depending on applicable law and circumstances, you may have rights to request access, obtain a copy, correct inaccuracies, request deletion, or exercise applicable opt-out rights. Rights and exceptions depend on the jurisdiction and processing involved.

Send requests to privacy@1031assist.com. We handle requests manually and use reasonable identity and authority verification to protect others' information. Service and security messages are distinct from optional marketing communications.

We will respond within the deadlines applicable to your request. Any verification request, permitted extension, denial, or retention exception will be explained as required by applicable law. Waiting for verification or a provider answer does not itself extend an applicable deadline or replace an existing deletion commitment.

For review of a disputed response, contact legal@1031assist.com. We will provide any reasons, appeal process, or opt-out handling required by applicable law.

The application workspace has been observed with US data residency configured. Base44 and its subprocessors may process information in other countries. That setting does not establish where every provider, model, log, or support operation processes information.

We will give at least 30 days' advance email notice of materially adverse changes to this policy, with a link to the dated revision and its effective date. We will preserve dated versions and applicable consent records. Longer notice or affirmative consent will be used where required by law.

A new policy does not itself authorize broader uses of previously collected information. A posted update or continued use alone does not replace consent required for a new use.

Operator: 1031Assist.com, LLC, formed in Utah.

• Privacy requests: privacy@1031assist.com.
• Legal notices: legal@1031assist.com.
• Product and billing support: support@1031assist.com.
• Legal-notice mailing address: 5855 S Whitewater Dr, Holladay, UT 84121.