Who is responsible for your data
The controller of personal data processed through acquisitions.ai is the administrator of the acquisitions.ai service. You can reach the administrator at [email protected] for every matter covered by this policy, including requests to exercise your rights.
What data we collect
We collect only the data needed to run the marketplace and the deal workflow.
- Account data. Email address, password stored as a one-way hash, role (buying, selling or both), chosen plan and billing period.
- Valuation data. The category, revenue and other figures you enter into the valuation estimator, and the resulting indicative range.
- Listing data. The description, metrics, assets and other information a seller adds to a listing, and the settings for what unlocks after NDA.
- Connection data. Metrics read through read-only connections a seller authorizes, such as revenue, subscriptions, refunds, churn and traffic.
- Deal data. NDA requests and signatures, messages, offers, letters of intent, checklist progress and the handover status.
- Billing data. Plan, invoices and payment status. Card details are entered with the payment operator and are not stored by us.
- Technical data. IP address, browser and device type, pages visited, the referring page and campaign parameters in links, used for security, fraud prevention and to understand which pages bring visitors.
- Support data. The content of messages you send to [email protected] or from inside your account.
Read-only connection data
When a seller connects a payment processor or analytics account, the connection uses read-only access. We read aggregated business metrics and the records needed to compute them, such as subscription status and amounts. We never move money, issue refunds, change settings or write any data to the connected account. Where the connected records contain personal data of the seller's own customers, we use it only to compute the metrics shown on the listing and do not show individual customer details to buyers. The seller can disconnect at any time, after which we stop reading new data.
Why we process data and on what legal basis
- To create and run your account, provide the plan you chose and process your listings, NDAs, messages and offers. Legal basis is the performance of a contract.
- To verify listing metrics through read-only connections. Legal basis is the performance of a contract with the seller, who authorizes the connection.
- To send the email code, account notices and messages about your deals. Legal basis is the performance of a contract.
- To bill subscriptions and keep accounting records. Legal basis is the performance of a contract and legal obligations.
- To secure the service, prevent fraud and misuse and keep logs. Legal basis is our legitimate interest in a safe marketplace.
- To understand how the site is used and improve it, in aggregated form. Legal basis is our legitimate interest.
- To send deal alerts you set up. Legal basis is the performance of a contract, and you can turn alerts off at any time.
- To establish, exercise or defend legal claims. Legal basis is our legitimate interest.
Who receives data
We share personal data only with recipients who need it to provide the service, under contracts that require them to protect it. We list categories of recipients.
- Hosting provider, which stores the service and its data.
- Payment operator, which processes subscription payments and card details.
- Email delivery provider, which delivers codes, notices and alerts.
- AI model provider, which processes text and figures needed for valuation estimates and listing drafts, without using them to train its models where this can be contractually excluded.
- Independent licensed escrow provider, which receives the data needed to open and run an escrow transaction when buyer and seller choose the escrow route.
- Other users, within the limits you set. Buyers see public listing data, and after an approved NDA the details the seller unlocks. Sellers see the plan and stated thesis of buyers who request an NDA.
- Authorities, when the law requires it.
We do not sell personal information and we do not share it for cross-context behavioral advertising.
International transfers
Some recipients may process data outside your country, including outside the European Economic Area. In that case we rely on safeguards required by law, such as adequacy decisions or standard contractual clauses.
Cookies and similar technologies
The service uses only essential cookies, such as the session cookie that keeps you signed in, a security token that protects forms, and a cookie that remembers basic preferences. These cookies are required for the service to work, so there is no cookie banner. We do not use advertising cookies or tracking pixels. You can delete cookies in your browser, but signing in will then not work until a new session starts.
How long we keep data
- Account data, for as long as the account exists, and up to 30 days after deletion to complete the request.
- Listing, connection and deal data, for as long as the account exists. After a deal closes, records of NDAs, offers and checklists are kept for up to 6 years to resolve disputes.
- Billing and accounting records, for the period required by tax and accounting law.
- Security logs, for up to 12 months.
- Support messages, for up to 3 years after the last message.
- Data from a confirmed account that never used the service, until you delete the account.
When a period ends, we delete data or make it anonymous.
Your rights
Depending on where you live, you have rights over your personal data. We honor the following requests from every user, wherever possible.
- Access to your data and a copy of it.
- Correction of inaccurate data.
- Deletion of your data, except data we must keep by law or to defend legal claims.
- Restriction of processing in the cases the law allows.
- Data portability in a structured, commonly used format.
- Objection to processing based on our legitimate interest.
- Withdrawal of consent at any time, where processing is based on consent.
- Complaint to a data protection supervisory authority in your country.
If you live in California or another US state with a privacy law, you also have the right to know what personal information we collect, use and disclose, to delete it, to correct it, to opt out of the sale or sharing of personal information and to not be discriminated against for using these rights. We do not sell or share personal information, so there is nothing to opt out of, and you can still send the request. You can use an authorized agent, and we will verify your identity before acting on a request.
To use any right, write to [email protected] from the email linked to your account. We answer within one month, or within the period your local law sets.
How we protect data
We use encrypted connections, hashed passwords, read-only scopes for connected accounts, access control based on roles and logs of access to sensitive actions. On the Fund plan, accounts can use single sign-on and an audit log. More detail is on Security and data handling.
Children
The service is intended for adults acting for business purposes. We do not knowingly collect data of persons under 18. If you believe a minor has created an account, write to [email protected] and we will delete it.
Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the latest version. For significant changes we notify account holders by email before they take effect.
FAQ
No. We do not sell personal information and we do not share it for cross-context behavioral advertising.
We read business metrics such as revenue, subscriptions, refunds, churn and traffic through read-only access. We cannot move money or change anything in the connected account.
The service uses only essential cookies needed to keep you signed in, protect forms and remember basic preferences. These do not require consent, so no banner is shown.
Write to [email protected] from the email linked to your account. We confirm the request and delete your data, except records we must keep by law.
Questions about privacy
Write to the administrator of the acquisitions.ai service at [email protected]. You can also read the Terms that govern the use of the service.