Privacy
What we hold, and who touches it
You upload other people’s financial statements to this product. This page says plainly where they go. Last updated 25 August 2026.
What we collect
- Your account. E-mail address, password hash, and the authenticator secret if you enable one.
- Your workspace. Deals, contacts, follow-ups, deadlines, Quick Screens and saved academy work — the things you create.
- Documents you upload. CIMs, tax returns and financial statements. These are the most sensitive things here and are treated as such: stored in a private bucket, scoped to your workspace, never public.
- Mailbox data, only if you connect one. We ask your provider for message metadata only — sender, recipients, subject, date, and the short preview line your provider itself generates. We never request the body of a message, so it never reaches our servers, and we never take attachments from your mail. That metadata is what lets us spot business listings and file a message against the right contact. We do not send mail from your account, and you can disconnect a mailbox at any time.
- Billing state, if you subscribe. Which plan, and whether it is active. Card numbers go to Stripe and never reach our servers.
Who processes it
These are every third party your data can reach. There are no others.
| Processor | Purpose | What it sees |
|---|---|---|
| Supabase | Database, authentication and file storage | Everything in your workspace, including uploaded documents |
| Vercel | Hosting and traffic analytics | Request logs, page-view metrics |
| Stripe | Payments | Billing e-mail, subscription state. Card details go to Stripe directly and never reach us |
| Anthropic | AI grading of practice teardowns and listing analysis | The text you submit for grading, and listing text you ask us to analyse |
| Brevo or Resend | Transactional e-mail | Your e-mail address and the contents of the message being sent |
| Microsoft / Google | Mailbox sync — only if you connect one | Message metadata and the snippets used to spot listings. Connect nothing and neither is involved |
What we never do
- We do not sell your data, and we do not share it with advertisers.
- We do not use your deals, documents or mailbox to train AI models. Text you send for grading is processed by Anthropic to answer that request and is not used by us for anything else.
- We do not take a percentage of your deal, and nothing on this site is ranked because someone paid for the position.
How long we keep it
Your workspace data is kept until you delete it. Delete a deal and its uploaded documents are removed from storage at the same time, not merely unlinked. Close your workspace and everything is destroyed after a 30-day grace period — see deleting your account.
What you can do
Both of these are self-serve, in Settings. Neither requires e-mailing us and waiting.
- Export everything as CSV — and as JSON on Acquisition Pro — in one download.
- Delete everything, with 30 days to change your mind.
Contact
Questions about any of this go to privacy@acquisitioncommand.com.