Legal
Privacy Policy
Last updated: August 2026
1. Who we are
Privatecos ("we", "us") operates the marketplace at www.privatecos.com, where business owners and investors connect anonymously to buy and sell private companies. This policy explains what personal data we collect, why, and the rights you have over it.
2. Data we collect
Account data: name, email address, and authentication credentials when you create an account. Listing data: the company information, financials, and documents you choose to upload when creating a listing or valuation. Usage data: pages visited, features used, and device information collected through our analytics tooling. Payment data: processed by our payment provider (Stripe) — we never store your card details on our servers.
3. How anonymity works
Public listings show sector, country, and key financials — never your company name or website. Identifying information is only disclosed to buyers you explicitly admit to your secure data room. Your data is never used to train AI models and is never sold or shared with third parties for their own purposes.
4. Why we process your data
We process data to operate the marketplace (matching, messaging, data rooms), to generate valuations you request, to secure the platform against fraud and abuse, to comply with legal obligations, and — with your consent — to send product communications. Each purpose rests on a legal basis under the GDPR: contract performance, legitimate interest, legal obligation, or consent.
5. Who processes it for us
We rely on a small set of infrastructure providers acting as processors under contract: hosting and databases (Vercel, Supabase), payments (Stripe), transactional email (Resend), and product analytics (PostHog). Each processes data only on our instructions.
6. Security
All data is encrypted in transit and at rest. Access is governed by row-level security so users can only ever access their own data and what sellers have explicitly shared with them. Documents live in access-controlled data rooms with audit trails.
7. Retention
We keep your data while your account is active. If you close your account, we delete or anonymize personal data within 90 days, except where the law requires longer retention (for example, transaction records for tax purposes).
8. Your rights
Under the GDPR and similar laws you can request access to, correction of, or deletion of your personal data; object to or restrict processing; and receive a portable copy. You can exercise these rights from your account settings or by contacting us. You also have the right to lodge a complaint with your data protection authority.
9. International transfers
Where data is transferred outside the EEA, we rely on adequacy decisions or standard contractual clauses with our providers.
10. Changes and contact
We will post any changes to this policy on this page and, for material changes, notify you by email. Questions or requests: contact us at support@privatecos.com.