Privacy Policy

DealAtrium is a deal management platform for mergers and acquisitions advisory firms. It is operated by ExitPros LLC, a Colorado limited liability company (“ExitPros LLC,” “we,” “us”), 3123 W Union Ave, Englewood, CO 80110.

This policy covers three groups of people, and our role differs for each:

• Advisory firms and their advisors — our customers. We process the data they put into the platform on their instructions.
• Buyers — people who register interest in a business for sale. Buyers hold their own DealAtrium account, and we are responsible for that account and its data in our own right, not only on a firm’s behalf.
• Sellers — business owners whose sale is managed by an advisory firm using the platform.

Advisors may connect their own Gmail account so that outreach to buyers is sent from their real address. This section describes exactly what that connection does.

• The only permission we request is gmail.send — permission to send mail as you. We do not request, and technically cannot exercise, permission to read, search, modify, or delete anything in your mailbox.
• What we store: your email address, and an access token and refresh token issued by Google. Refresh tokens are encrypted with AES-256-GCM before being written to our database. They are never logged and never sent to a browser.
• What we do with it: send email you compose and send in the platform, addressed to buyers you select. We do not send mail on your behalf without your action.
• What we keep: a record of messages you sent through the platform — recipient, subject, body, and timestamp — so your firm has a record of buyer correspondence. This is visible to other advisors at your firm.
• What we never do: we do not sell Google user data, use it for advertising, use it to train machine learning or AI models, or transfer it to anyone except the infrastructure providers listed below that store it on our behalf.
• Disconnecting: you can disconnect the mailbox at any time from your profile. Doing so deletes the stored tokens and revokes our access at Google. You can also revoke access directly at your Google account permissions page.

DealAtrium’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The same commitments apply to Microsoft Outlook mailboxes connected through the equivalent send-only permission.

DealAtrium only sends email to people who asked to receive it. Every message is addressed to a single buyer about a single deal they registered interest in, and none is sent unless we hold a record of that buyer agreeing to receive email about it. Today that agreement is given on the deal’s inquiry form, where a buyer registers interest in a specific listing marketed by a specific advisory firm.

We record when that agreement was given and what it came from, so it can be shown on request. Buyers who joined before we began recording this are marked as such rather than being presented as having agreed to anything.

Every email we send carries a link to stop further emails about that deal. Using it takes effect immediately: our software will not send another message to that buyer about that deal, and no one at the advisory firm can reverse it. The same page offers a way to resume if the link was used by mistake.

Two limits worth stating plainly. Stopping these emails does not affect a buyer’s access to documents and does not cancel anything they have signed. And it governs email sent through DealAtrium — an advisor writing to a buyer directly from their own mailbox is outside this system, so a buyer who wants a firm to stop contacting them entirely should tell the firm directly.

• Account information — name, email address, phone number, company name, and role.
• Buyer information — the details a buyer provides when registering interest in a business, along with their stated acquisition criteria.
• Deal and document content — materials advisory firms upload, and documents exchanged between buyers, sellers, and firms, including executed non-disclosure agreements.
• Correspondence — email sent through the platform, and notes advisors record about their interactions.
• Technical data — when someone submits the public inquiry form we record their IP address and email address to detect and limit automated abuse.

We do not use advertising trackers, and we do not sell personal data to anyone.

We use the following providers to operate the platform. Each stores or processes data on our behalf under its own terms:

• Supabase — database and file storage (United States)
• Vercel — application hosting (United States)
• Clerk — authentication and login
• Resend — transactional email such as invitations and notifications
• Cloudflare — domain routing and bot protection on public forms
• GoHighLevel — non-disclosure agreement delivery and electronic signature. Receives a buyer’s name, email address, telephone number and the deal reference in order to issue and track the agreement
• Google and Microsoft — only where an advisor has connected their own mailbox
• Sentry — error monitoring (United States). Receives technical detail about software faults so we can find and fix them, including excerpts of our own application code around the fault. Request bodies, file contents, file storage paths and access links are removed before anything is sent, and error reports are deleted within 90 days

We do not send document contents, deal information, or personal data to any third-party artificial intelligence or machine learning provider.

Advisory firm data. When a firm’s access ends, we delete the firm’s data from our active systems within 30 days. This includes deal records, uploaded deal materials, correspondence, and the firm’s private notes about buyers.

Executed non-disclosure agreements are deleted with the rest of the firm’s data. An NDA is an agreement between a buyer and an advisory firm, and both of them keep their own copy independently of us: the buyer is emailed a copy by the signature provider when they sign, and the firm can export its agreements at any time or receive each one automatically as it completes. We do not keep a further copy after the firm’s data is deleted. A firm that wants its executed agreements should export them before or at termination.

Buyer accounts. A buyer account belongs to the buyer, not to any firm. If every firm relationship associated with a buyer ends, the buyer’s account and profile remain so that the buyer keeps access to their own records. We delete a buyer account after 24 months without a sign-in, or sooner at the buyer’s request.

Inquiry records. IP and email records captured for abuse prevention on the public inquiry form are retained only as long as needed for that purpose.

Backups. Deleting a record from our active database does not immediately remove it from our hosting provider’s daily database backups. Those backups are retained for 7 days and are not separately editable; after that window no copy remains. Documents and files are stored separately from the database and are not included in those backups, so a deleted document is removed immediately with no backup copy.

An advisory firm may request an export of its data at any time, and on termination. Send a written request to privacy@dealatrium.com and we will provide it within 30 days, in two parts: a machine-readable file of your records, and an archive of documents received through the platform, such as executed NDAs and buyer submissions.

Deal marketing materials your firm uploaded — confidential information memoranda, financial statements, teasers — are not included in the export. Those originated with you and you hold the originals; the platform distributes them rather than serving as their system of record. Keep your own copies. We do delete them.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to appeal a decision we make about such a request. Colorado residents have these rights under the Colorado Privacy Act, and residents of other states and countries may have comparable rights.

To exercise any of them, email privacy@dealatrium.com. We will respond within 45 days. If a request concerns data an advisory firm put into the platform, we may need to direct you to that firm, and we will tell you who they are.

Access to deal materials is checked on every request against the permissions recorded for that specific person and deal — there is no cached permission state. Documents are never served by public link; they are streamed only after that check passes. Mailbox refresh tokens are encrypted at rest. No system is perfectly secure, and we do not claim otherwise.

The platform is a business tool and is not directed to anyone under 18. We do not knowingly collect personal data from children.

We will update the effective date above when this policy changes. If a change materially affects how we handle personal data, we will notify affected account holders by email.

ExitPros LLC
3123 W Union Ave, Englewood, CO 80110
privacy@dealatrium.com