Privacy
What we hold, and who touches it
You upload other people’s financial statements to this product. This page says plainly where they go. Last updated 14 October 2026.
What we collect
- Your account. E-mail address, password hash if you set a password, and the authenticator secret if you enable one. If you choose “Continue with Google” or “Continue with Microsoft”, we also receive your name and profile-picture link from that sign-in, which our sign-in provider keeps with your account; signing in this way gives us no access to your mailbox.
- Your workspace. Deals, contacts, follow-ups, deadlines, Quick Screens and saved academy work — the things you create.
- Documents you upload. CIMs, tax returns and financial statements. These are the most sensitive things here and are treated as such: stored in a private bucket, scoped to your workspace, never public.
- Mailbox data, only if you connect one. To decide what belongs in your CRM we read each message’s headers — sender, recipients, subject, date — and the short preview line your provider generates. We keep the full message, its text and formatting, only for mail that involves your CRM: your contacts, people at your companies’ web domains (never shared domains such as gmail.com), and business-listing alerts. Everything else is dropped after that check; we keep only a count of messages per sender address, to suggest companies you might add, and never for shared domains or the mailbox’s own domain. On a plan without the CRM we keep less from then on: from business-listing alerts and mail with your contacts only the headers and the short preview line, never the full message, and we count no new senders; mail and counts kept while you had the CRM stay until they are deleted as below. For attachments we keep the file name, type and size, never the file itself. When you connect, we go back 12 months; kept mail is deleted after 18 months, and a sender’s count once no mail from that sender has arrived for 18 months; both are deleted straight away when you disconnect the mailbox. A conversation you mark private is visible only to you. We do not send mail from your account. No one at Del Val reads your stored mail, except with your permission for support, to investigate a security issue, or when the law requires.
Acquisition Command's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- Billing state, if you subscribe. Which plan, and whether it is active. Card numbers go to Stripe and never reach our servers.
Who processes it
These are every third party your data can reach. There are no others.
| Processor | Purpose | What it sees |
|---|---|---|
| Supabase | Database, authentication and file storage | Everything in your workspace, including uploaded documents |
| Vercel | Hosting and traffic analytics | Request logs, page-view metrics |
| Sentry | Error monitoring | When something fails: what failed and where in our code, the page it happened on (without any search details), internal reference numbers, the app version, and the browser and system type. No names, e-mail addresses or documents. |
| Better Stack | Uptime checks and our status page | It checks that our public pages answer. No customer data. |
| Upstash | Rate limiting | Your IP address and an internal account or workspace number, with a count of your recent requests, so no one can flood the service. Each count deletes itself within about two hours. No names, e-mail addresses or documents. |
| Stripe | Payments | Billing e-mail, subscription state. Card details go to Stripe directly and never reach us |
| Anthropic | AI features you start: grading practice teardowns, reading listings and deal documents, deal analysis, evaluations and business plans, looking up companies and brokers on the web, and writing help | Only what the feature you start needs, and nothing in the background:
|
| Brevo or Resend | Transactional e-mail | Your e-mail address and the contents of the message being sent |
| Microsoft / Google | Mailbox sync — only if you connect one | Message headers, and with the CRM the full content of mail involving your contacts, companies or business listings. Connect nothing and neither is involved |
| Google / Microsoft | Sign-in — only if you choose “Continue with Google” or “Continue with Microsoft” | Your name, e-mail address and profile-picture link. Signing in this way gives no access to your mailbox |
What we never do
- We do not sell your data, and we do not share it with advertisers.
- We do not use your deals, documents, mailbox or profile to train AI models, and Anthropic does not train on what we send it. What we send is used only to answer the request you made, and we use the answer for nothing else.
- We do not take a percentage of your deal, and nothing on this site is ranked because someone paid for the position.
How long we keep it
Your workspace data is kept until you delete it. Mail kept from a connected mailbox is the exception: it is deleted after 18 months, its sender counts once no mail from that sender has arrived for 18 months, and both as soon as you disconnect the mailbox. An import’s copied file contents (its column headings, mapping and error list) are cleared 30 days after the import; its counts and history stay. The file you upload for an import is deleted as soon as it has been read. Its rows are kept while the import runs and removed by a nightly clean-up once it ends, except the rows that had errors, which are kept for 7 days so you can download them. When someone leaves a workspace, the notes and activities they marked private are deleted. When someone is removed from a workspace, the notes, activities, Inbox threads and saved views they kept private and their Buyer Profile are deleted, and any mailbox they connected is disconnected. Delete a deal and its uploaded documents are removed from storage at the same time, not merely unlinked. Close your workspace and everything is destroyed after a 30-day grace period — see deleting your account.
What you can do
Both of these are self-serve, in Settings. Neither requires e-mailing us and waiting.
- Export everything as CSV on any paid plan, and still after it ends — and as JSON on Acquisition Pro — in one download. On Free, export your saved academy work and Buyer Profile.
- Delete everything, with 30 days to change your mind.
Contact
Questions about any of this go to privacy@acquisitioncommand.com.