Privacy Policy

What we collect

Account information. We first collect your email address and send a single-use verification code. While that code is in flight, a new member supplies the profile and consent information below; it becomes verified only after the member enters the code.

A new member self-attests that they meet the SEC definition of an accredited investor. We record the attestation time, its eventual verified-account provenance, and the version of the account and consent language presented. The optional Contact Opt-In is selected by default during signup and can be unchecked before submission without affecting account access. Name and phone number are required while it remains selected and optional after it is unchecked. Both are required for an advisor note; an advisor note also includes the message you provide.

Some signups originating from paid advertising use a partner-supported registration flow instead of the optional Contact Opt-In checkbox. In that flow, full name and US phone are required. By submitting the profile and verifying the email code, you authorize a Top1031 partner specialist to call or email you about your exchange, and a Lead is delivered for that purpose. This does not authorize text messages. Do not complete that registration flow if you do not agree to partner contact.

Registration context. Local browser storage keeps up to 10 recent site paths without query strings or fragments, a first referrer reduced to origin and path, and fixed UTM campaign fields with length and character limits. A supported calculator or deadline tool contributes only its tool name. We do not put exact financial inputs, results, dates, free text, credentials, search terms, or unrestricted URLs in this context. For paid advertising, Top1031 stores a limited campaign classification rather than the raw ad-click identifier in the account, Lead, or PostHog events. Advertising providers may separately process identifiers from the visit to attribute conversions. After verified onboarding, the sanitized context is copied to the account and removed from that browser.

Security and request data. Our hosting and security providers may process IP address, browser, device, and request information. The application uses keyed hashes of normalized email and IP values for signup rate limits rather than storing those raw values in its rate-limit buckets. When traffic reaches a risk threshold, Cloudflare Turnstile may process a brief automated check. We also keep bounded, pseudonymized security events.

Audience and product measurement. We measure how the site is used with PostHog. What it receives depends on where you are, and Top1031 does not identify visitors to it in either case.

In the United States, unless you opt out, PostHog uses ordinary first-party analytics storage and receives your IP address, from which it derives an approximate location no more precise than a city. It records page views, clicks and other interactions with page elements (including the text of the element you clicked), documented product events, session recordings of how the page was used, aggregated click heatmaps, page performance and Core Web Vitals, and script errors. In session recordings, anything you type is replaced by placeholder characters before it leaves your browser, and the email, name and phone fields of the registration flow are additionally masked. Page URLs are sent without query strings or fragments, so the ad-click identifier, search terms and similar parameters never reach PostHog.

Outside the United States, PostHog runs in its storage-free cookieless mode: no analytics cookie, no local or session storage, and a privacy-preserving server hash that changes daily and discards the IP address, so it cannot join a visitor across days, browsers, or devices and provides us no location data at all. It receives only canonical page paths without query strings, the referring site reduced to origin and path, coarse browser and device information, sanitized campaign categories, and a closed event dictionary with code-owned categories or coarse bands. No session recordings, heatmaps, or element-level click capture run outside the United States.

We also use the approximate location your IP address indicates, as reported by our hosting provider, to tailor what we show you — for example, highlighting properties near you. This happens in your browser, we do not store the location, and the site works the same way if it is unavailable or wrong.

Google Analytics, Google Ads, and Vercel Web Analytics. In the United States, unless you opt out, Google Analytics 4 (GA4) and Vercel Web Analytics measure page views and the same documented product interactions with ordinary analytics cookies, and Google Ads runs with advertising storage, user-data and personalization signals granted. That lets Google attribute a verified signup or an authorized advisor-contact request to the ad that brought you here, and lets Google use your visit to show you Top1031's own ads on other sites and to improve how our ads are targeted. Under the California Privacy Rights Act this is "sharing" for cross-context behavioral advertising, and you can stop it at any time with the "Do Not Sell or Share My Personal Information" link in the footer, with "Cookie preferences," or by sending a Global Privacy Control signal. We do not run third-party advertising on this site.

Outside the United States, Google Ads starts under denied Consent Mode and GA4 and Vercel Web Analytics do not run unless you accept analytics. Conversions are still sent, as cookieless pings without advertising cookies, personalization, or user-data signals.

In both cases a newly verified account sends the signup conversion, and an authorized advisor-contact request sends the advisor-contact conversion. A verified partner-supported paid-campaign signup therefore sends both conversions. GA4 page locations may retain only Google advertising click identifiers and fixed source, medium, and campaign fields for acquisition attribution; other query parameters and fragments are removed. The closed signup funnel and cookieless Google Ads conversions remain active under essential-only and Global Privacy Control; everything else described in this section stops.

Public securities-offering data shown on this site is separate from visitor information. It comes from public SEC filings, sponsor disclosures, and other cited public sources.

How we use it

• To verify email control and operate passwordless accounts, sessions, and watchlists.
• To apply the accredited-investor access self-attestation.
• To preserve the sanitized registration context described above.
• To provide security, investigate misuse, and prevent automated abuse.
• To measure the closed signup funnel anonymously regardless of cookie choice; to measure audience, product usage, and (in the United States, unless you opt out) how pages are used through session recordings and heatmaps; and to measure and target our own advertising.
• To create and deliver a specialist Lead when Contact Opt-In remains selected and the account is verified, when a partner-supported paid-campaign registration is verified after the partner disclosure, or when you send an Advisor Note.

In standard signup, if Contact Opt-In remains selected when you submit and verify your account, a specialist may respond by email or phone; uncheck it for access without outreach. In a partner-supported paid-campaign signup, submitting the required profile and verifying the email code authorizes that email or phone response. Neither path authorizes texts.

We may still email sign-in codes, security notices, retention notices, and service notices about your account. We do not sell your personal information and we do not run third-party advertising on this site. For United States visitors who have not opted out, visit data is shared with Google for cross-context behavioral advertising limited to Top1031's own ads, as described under "What we collect." Account, Lead and Advisor Note data is never used for that purpose.

Cookies and browser storage

We use cookies and local browser storage:

• Account and security: sign-in sessions, single-use verification state, abuse controls, and your versioned cookie-preference record.
• Registration context: local storage holds the sanitized paths, referrer, UTM fields, and tool name described above so verification can open in a second tab. This operates separately from optional analytics and is cleared after onboarding completes. You can also clear it through your browser's site-data controls.
• Analytics and advertising: in the United States, PostHog (including session recordings and heatmaps), GA4, Vercel Web Analytics and Google Ads use first-party storage from your first page view unless you opt out. Elsewhere, PostHog uses no browser storage, Google Ads uses denied Consent Mode for cookieless measurement of verified signups and authorized advisor-contact requests, and GA4 and Vercel Web Analytics run only after you accept analytics. Change your choice through “Cookie preferences” or “Do Not Sell or Share My Personal Information” in the footer.

Choosing essential-only stops ordinary PostHog page-view and product measurement, session recordings, heatmaps, GA4, Vercel Web Analytics and Google advertising personalization, but not the closed signup funnel or cookieless Google Ads conversions. If you withdraw a prior grant, we immediately deny Google analytics and advertising storage, erase PostHog's browser state, and reload with only those essential registration measurements active. The change synchronizes to other open Top1031 tabs, which also withdraw and reload if analytics had been active.

When Global Privacy Control is enabled, we record essential-only, keep only the closed signup funnel and cookieless Google Ads conversions, and disable optional analytics even if an earlier grant exists. Disabling GPC later does not restore analytics automatically; essential-only remains stored until you deliberately change it through “Cookie preferences.”

Sharing

Leaving the default Contact Opt-In selected and verifying a standard signup creates and delivers a Lead. Explicitly unchecking it creates no Lead and does not affect account access. Submitting the required profile and verifying a partner-supported paid-campaign signup after its disclosure also creates and delivers a Lead.

If Contact Opt-In remains selected through verified signup, or you later send an advisor note, the application sends the resulting record to configured Top1031 operations and affiliated-partner recipients. A Lead can include your email address, name, phone number, attestation and contact-consent timestamps, consent-language version, and sanitized registration context. An Advisor Note also includes your note.

Service providers process information to host and protect the site and database, control authorized staff access, send account and lead-notification email, provide measurement, and retry failed deliveries. These include Vercel, Cloudflare, and Neon for hosting, security, and data infrastructure; Postmark for outbound email; and PostHog and Google for the measurement described above. We may also disclose information when required by law.

Retention

• Unused, unverified accounts are deleted after 30 days. Expired verification records are deleted after 7 days.
• Sign-in codes work once and expire after 10 minutes. Account-deletion confirmation links work once and expire after 15 minutes. Sessions close after 30 days without activity and can never last more than 90 days; expired session records and closed rate-limit buckets are deleted after 30 days.
• Verified accounts and watchlists are deleted after five years without activity, after a notice approximately 30 days before deletion.
• Leads, Advisor Notes, and their sanitized attribution are deleted three years after their last update.
• Pseudonymized security events are kept for up to 12 months.
• Minimal consent, attestation, and deletion evidence may be kept for five years. It is limited to a keyed email hash, timestamps, provenance, wording version, and event type.

A verified account-deletion request overrides the normal account, watchlist, Lead, and Advisor Note periods. Analytics retention is controlled by each provider's settings.

Your choices and rights

• Access and correction: email us or use the contact page and we will honor verified requests, subject to records we must keep by law.
• Account deletion: a signed-in member can request deletion from the account page. We send a fresh, single-use email link before permanently removing the account, sessions, watchlist, Leads, Advisor Notes, and linked personal profile data. Minimal pseudonymous legal or security evidence may remain for the periods above.
• Opt out of contact: you can ask us or the specialist who contacted you not to contact you again.
• California residents (CCPA/CPRA): you have the rights to know, delete, correct, and opt out of sharing as defined by the CPRA. We do not sell personal information. We share visit data with Google for cross-context behavioral advertising of Top1031's own ads unless you opt out; use the "Do Not Sell or Share My Personal Information" link in the footer or a Global Privacy Control signal, and the sharing stops on that browser at once. Delivering a Lead after the contact authorization described above is not cross-context behavioral advertising.
• Privacy signals: we honor Global Privacy Control as an opt-out signal and will not discriminate against you for exercising a right.
• Do Not Track: we honor GPC; legacy DNT signals have no settled meaning and are not acted on separately.

Children

This site is for accredited investors and is not directed to anyone under 18. We do not knowingly collect information from children.

Security

Sign-in uses hashed, single-use email-code records. Sessions have inactivity and absolute lifetime limits. Application access to account, Lead, and Advisor Note records is restricted by authenticated, role-based access rules, and administrative systems use an additional identity-aware access layer.

Application secrets are supplied through protected environment configuration rather than stored in page code. No system is perfectly secure.

Changes

Changes to this policy will be posted on this page with a revised "Last updated" date.

Contact

Privacy questions and requests: privacy@top1031.com.

Mangold, Inc. · 1111B South Governors Avenue, Suite 48507, Dover, Delaware, USA · Contact page: /contact/.