Privacy Policy

We collect the following categories of information:

• Account & identity information. When you register or sign in, our authentication provider (Supabase Auth) processes your email address and password credentials, or — if you use Google sign-in — basic Google profile information such as your name and email address.
• Acquisition criteria you provide. The investment mandate you enter during onboarding and editing, including budget range, financial thresholds (e.g., revenue and margin), preferred business types, niches, tech-stack preferences, growth preference, deal-breaker flags, and any free-text description.
• Activity & usage data. Listings you view, analyses and deep-research reports you run, saved searches and alerts you create (including whether you enable email notifications), your plan, and feature-usage counts.
• Billing information. If you purchase a paid plan, our payment processor (Stripe) collects and processes your payment details. We receive limited billing metadata (such as subscription status) but do not store full payment-card numbers.
• Product-analytics, session-replay & device data. Through PostHog we collect events such as sign-up, login, and upgrade actions, associated with your account identifier, along with standard technical data such as IP address, browser/device type, and pages viewed. We also use PostHog session replay, which records a visual reconstruction of your on-screen interactions — such as page navigation, clicks, and scrolling — so we can see where the interface is confusing or broken. Password and other credential fields are masked and are not captured. We use session replay solely to understand and improve your experience of the Service, and for no other purpose — we do not use it for advertising, profiling, or the sale of data.
• Documents you upload. Files you choose to attach to a listing for deep-research analysis — such as CIMs, profit-and-loss statements, spreadsheets, or screenshots. See our Terms for how we handle these materials.

Note: marketplace listing data shown in the Service describes third-party businesses and is aggregated from public sources; it is not your personal information.

• to provide, operate, secure, and maintain the Service and your account;
• to match listings to your acquisition criteria and generate AI analysis, scores, and research;
• to process payments and manage subscriptions;
• to send service and transactional communications, and — where you have enabled them — alert/digest emails;
• to understand usage, debug, and improve the Service through analytics;
• to diagnose interface problems and improve usability through session replay — used only to improve your user experience and for nothing else; and
• to comply with law and enforce our Terms.

We do not sell your personal information. We share it only as described here:

• Service providers (sub-processors) who process information on our behalf, under contract, including: Supabase (authentication and database), Google (optional OAuth sign-in), Stripe (payment processing), PostHog (product analytics), and Google Cloud Platform (application hosting/infrastructure).
• Legal & safety — when required to comply with law, respond to lawful requests, or protect the rights, property, or safety of ScoutAcq, our users, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

We and our providers use cookies and similar technologies to keep you signed in, remember interface preferences (for example, a cookie that stores sidebar state for about seven days), and measure product usage via analytics. You can control cookies through your browser settings; disabling some cookies may affect functionality such as staying logged in.

We also use a session-replay tool (PostHog) that records on-screen interactions — such as navigation, clicks, and scrolling — to help us find and fix usability issues. It masks sensitive form fields such as passwords, and we use it only to improve your experience of the Service and for nothing else.

We retain personal information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to comply with legal, accounting, or reporting obligations and to resolve disputes. You may request deletion of your account as described below.

Documents you upload for deep-research analysis are deleted from our active systems within 30 days of completing the related analysis and are not used to train AI models; you may remove them at any time through the Service.

We use reasonable administrative and technical safeguards designed to protect personal information, including authentication via Supabase and transport encryption (HTTPS). No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

• Access & update. You can review and update your account information and acquisition criteria within the Service.
• Email preferences. You can turn alert/digest emails on or off in your alert settings. We may still send essential service messages.
• Deletion. You can request deletion of your account and associated personal information by emailing laz@scoutacq.com.

If you are a California resident, the California Consumer Privacy Act, as amended, provides you the following rights, subject to verification and legal exceptions:

• the right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
• the right to delete personal information we have collected from you;
• the right to correct inaccurate personal information;
• the right to opt out of any “sale” or “sharing” of personal information — note that we do not sell or share your personal information as those terms are defined under California law; and
• the right not to receive discriminatory treatment for exercising these rights.

To exercise these rights, email laz@scoutacq.com. You may use an authorized agent to submit a request on your behalf, subject to verification.

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

For privacy questions or to exercise your rights, contact: