Privacy
TrackFilings Privacy Policy
Last updated: 22 August 2026
Who is responsible
TrackFilings is a personal project operated by David Sanchez, an individual established in Spain.
Contact: [email protected]
TrackFilings is free to use. There are no public user accounts, payments, advertisements, newsletter, or contact form.
Data processed
Website use
TrackFilings uses limited first-party analytics to understand and improve the service. It may record:
- the page pathname, without query parameters or fragments;
- the referrer, with query parameters and fragments removed;
- permitted page-view and interface events;
- limited event metadata from a strict allowlist;
- device category and timestamp; and
- a random session identifier generated in browser memory.
Search terms are not intentionally recorded in analytics. The session identifier is not stored in cookies, localStorage, sessionStorage, or IndexedDB. Analytics events are automatically deleted after 13 months.
For security and operation, the origin server logs the IP address, date, HTTP method, requested path without its query string, and response status. These logs are retained for 30 days, unless required for an active security incident or legal claim.
Cloudflare
Cloudflare provides content delivery, security, managed firewall and DDoS protection, performance analytics, and network-error diagnostics.
Cloudflare Web Analytics uses browser performance data but, according to Cloudflare, does not use cookies or browser storage and discards the source IP without storing it in its analytics databases or logs.
Cloudflare Network Error Logging may receive technical reports about failed requests. Cloudflare states that it keeps the client IP only in volatile memory while processing the report and then deletes it. Cloudflare may also process normal request and IP information to deliver and protect the Website.
If you email TrackFilings, your email address, message, attachments, and any name you provide will be used to answer and manage your enquiry. There is no public contact form.
Public SEC filings
TrackFilings collects and organises information from public U.S. Securities and Exchange Commission (SEC) filings, primarily Form 4 filings. This may include reporting persons' names, roles, issuer relationships, securities transactions, ownership information, dates, prices, values, footnotes, and filing identifiers.
This information comes from official public records, not directly from the reporting person. TrackFilings may normalise, group, or calculate values to make the filings easier to understand. The original or amended SEC filing remains the authoritative source.
Why the data is processed
Under the GDPR, TrackFilings relies mainly on legitimate interests to:
- operate, secure, and improve the Website;
- measure aggregate product use with privacy-minimising analytics;
- answer messages and legal requests; and
- make official public financial information easier to access and understand.
Processing may also be necessary to comply with a legal obligation or to establish, exercise, or defend legal claims. TrackFilings does not use visitor data for advertising, profiling, or decisions producing legal or similarly significant effects.
Providers and international transfers
- Hetzner Online GmbH hosts the origin server in Germany.
- Cloudflare, Inc. provides global delivery, security, Web Analytics, and network diagnostics.
- SEC systems provide the public filing data and are operated in the United States.
Cloudflare may process data outside the European Economic Area. Its Data Processing Addendum includes the European Commission's Standard Contractual Clauses, and Cloudflare also participates in the EU-U.S. Data Privacy Framework.
Personal data is not sold or shared for cross-context behavioural advertising. It may be disclosed to authorities or professional advisers where required by law or reasonably necessary to protect legal rights.
Retention
| Data | Retention |
|---|---|
| First-party analytics | 13 months |
| Origin access logs | 30 days, unless needed for an incident or claim |
| Canonical database backups | 14 daily copies; the analytics database is excluded from the reviewed daily backup process |
| General email enquiries | Up to 12 months after the last substantive communication, unless longer retention is legally necessary |
| Privacy requests | Up to 3 years after closure where needed to demonstrate compliance |
| Administrative session cookie | 12 hours |
| Public SEC filing information | While the official filing remains public and the information remains relevant, subject to applicable rights and corrections |
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Email [email protected] and provide enough information to locate the relevant data. Identity verification may be required where reasonably necessary.
Rights are not absolute. Requests concerning accurate official filings may be affected by the public-record context, freedom of information, legal obligations, or legal claims. If displayed filing information appears incorrect, identify the filing and any amendment so it can be checked against the SEC source.
You may complain to the Spanish Data Protection Agency (AEPD) at aepd.es or, where applicable, another competent supervisory authority.
United States residents
Where an applicable U.S. state privacy law grants relevant rights, requests may be sent to the contact address above. TrackFilings does not sell personal information, share it for cross-context behavioural advertising, or offer financial incentives for personal information. It will not discriminate against anyone for exercising an applicable privacy right.
Children
TrackFilings is a general-audience financial-information service and is not directed to children. It does not knowingly collect personal information directly from children under 13.
Changes and contact
This policy will be updated if the service, its providers, or its processing changes materially.
Questions, complaints, security reports, and privacy requests may be sent to:
David Sanchez
[email protected]