Privacy Policy

This Privacy Policy describes how numanknows ("numanknows", "we", "us") collects, uses, and shares information when you use our acquisition search workspace (the "Service").

Information we collect

We collect information in the following ways:

• Account information. When you sign up, we collect your name, email address, and authentication details (including OAuth identifiers if you sign in with a third-party provider).
• Acquisition search profile. Information you provide about your acquisition criteria, available capital, financing readiness, target geographies and sectors, and acquisition timeline.
• Pipeline and deal data. Listings you save, notes, evaluations, and other deal-related information you create within the Service.
• Deal documents. Files you upload to a deal — such as CIMs, financial statements, or seller correspondence — along with their filename, file type, and size. The text of uploaded documents may be processed by our AI providers (see "How we share information" below) to provide features you request, such as document triage, summaries, and diligence.
• Listings you submit via our browser extension or API. If you use our browser extension, or have a third-party AI assistant connect to our API on your behalf, to submit business listing information to the Service, we collect the listing data you submit through that channel in the same way as listings you add directly within the Service.
• Broker profile information (public). If you register as a broker, the profile information you provide — including your bio, photo, credentials/licenses, and sold-listing history — is displayed publicly on your broker profile page and is not treated as private account data. Do not include information in your broker profile that you don't want publicly visible.
• Usage data. Log data, device information, and interactions with the Service, collected automatically for security, debugging, and reliability purposes.

Advisors invited to a deal

A buyer can invite an attorney, accountant, lender, or other advisor into a single deal (see "Advisor access to deals" in our Terms of Service). This section covers what we collect about advisors and who sees it.

• From the buyer. The advisor's email address, the kind of advisor they are, and what they may access, entered by the buyer when sending the invitation. We use the email address to send the invitation and notices about the deal.
• From the advisor. Account information, as for any user, plus the multi-factor authentication method advisors must set up.
• Confidentiality acceptance. When an advisor accepts the confidentiality acknowledgement, we record the version they accepted, the time, their IP address, and their browser's user agent.
• Access log. Each view, download, upload, and comment on a deal, plus grant changes such as acceptance, revocation, and expiry, recorded with the time, IP address, user agent, and the advisor's email address.

The buyer's organization can see the access log, the confidentiality acceptance, and anything the advisor uploads or comments on the deal. Advisors themselves can't see the access log. We use this information to provide the deal room, to let the buyer show who had access to confidential material, and to detect misuse.

How long it's kept. The access log is append-only: nobody, including the buyer, can edit or delete entries. It is kept even after the deal's files are purged, the deal is removed, or the advisor deletes their own account, because a buyer may need it to show that they met their confidentiality obligations to the seller. It is deleted with the buyer's workspace. Files an advisor uploads belong to the buyer's deal and follow its retention, described below.

Advisors' choices. Advisors have the same rights over their account as any user, including deleting it. Deleting an advisor account ends all of that advisor's deal access. To ask what the access log holds about you, or to request a correction, contact privacy@numanknows.com. Because the log is the buyer's record of who saw their confidential material, we may decline to delete entries while the buyer's workspace exists, where the law allows.

How we use information

• To provide, maintain, and improve the Service, including your acquisition pipeline.
• To generate AI-assisted analysis of listings and deals against your search profile, using third-party AI providers (see below).
• To send account-related communications, such as email confirmations and security alerts.
• To monitor, debug, and secure the Service, including detecting abuse.

How we share information

We do not sell your personal information. We share information with the following categories of service providers, solely to operate the Service:

• Supabase — database, authentication, and storage infrastructure.
• Sentry — error tracking and application diagnostics.
• AI providers (e.g. Anthropic Claude) — to analyze listing data against your search criteria. Your acquisition criteria and relevant listing data may be sent to these providers to generate analysis.
• Email delivery providers — to send transactional email such as confirmation and password reset links.
• Payment processors — if and when you subscribe to a paid plan, a payment processor (e.g. Stripe) will process billing information on our behalf. numanknows does not store your card details.
• Google Analytics — via Google Tag Manager, to understand how visitors use the Service (pages viewed, general usage patterns) so we can improve it.

We may also disclose information if required by law, or to protect the rights, property, or safety of numanknows, our users, or others.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you, such as via email or a notice on the Service, before your information becomes subject to a different privacy policy.

Data retention

We retain your account and pipeline data for as long as your account is active. You may request deletion of your account and associated data at any time from your account Settings or by contacting us. A deletion requested from Settings takes effect seven days later, and you can cancel it until then; it removes your account and any workspace you own, including its deals and uploaded documents. Otherwise we will delete or anonymize your data within a reasonable time, except where retention is required for legal, security, or accounting purposes.

Deal documents specifically: when you mark a deal as not being pursued, the Service prompts you to permanently delete all documents and diligence attachments associated with that deal, and also provides a standing "Remove all listing data" control for the same purpose. This deletion is immediate and permanent — deleted files are not recoverable through the Service. Because we maintain routine infrastructure backups for disaster-recovery purposes, a deleted file's data may persist in a backup snapshot for up to 7 days after deletion before it is fully purged from all systems.

Your choices

• You can access and update most of your account and search profile information directly within the Service.
• You can download a copy of your data, or request its deletion, from your account Settings or by contacting us.
• You can opt out of non-essential email communications.

Cookies

We use the following cookies:

• Authentication. Session cookies that keep you signed in, set by our authentication provider (Supabase). Necessary for the Service to work.
• Preferences. A cookie that remembers interface state, such as whether the navigation sidebar is expanded or collapsed. Necessary for the Service to work.
• Payment security. When you add a payment method or make a purchase, our payment processor (Stripe) sets cookies used for fraud prevention. Necessary for the Service to work.
• Analytics. Google Analytics (delivered via Google Tag Manager) and PostHog set cookies to distinguish visitors and measure how the Service is used. These cookies are only set if you accept them in the cookie banner shown on your first visit — declining, or not responding, keeps them off.

We do not use cookies for advertising.

Security

We use industry-standard safeguards to protect your information, including encryption in transit, role-based access control, and database-level row security so that your organization's data is isolated from other tenants.

Links to other websites

The Service may contain links to third-party websites we don't control — including listing sources, brokers' own external sites, or partner services. This Privacy Policy applies only to information collected by numanknows, not to the practices of any third-party site you access through a link on the Service. We encourage you to review the privacy policy of any third-party site before providing it with information.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended, gives you additional rights over the personal information described in "Information we collect" above, including the right to: know what personal information we've collected about you and how it's used and shared; request deletion of your personal information, subject to certain exceptions; correct inaccurate personal information; and not be discriminated against for exercising these rights. We do not sell or share your personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. To exercise any of these rights, contact us at privacy@numanknows.com.

Children's privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice before they take effect, by posting the updated policy on this page, updating the "Last updated" date above, and, where appropriate, emailing the address on your account. Non-material changes or clarifications may take effect immediately.

Contact us

Questions about this Privacy Policy can be sent to privacy@numanknows.com.