Seller and Diligence Room Terms

We do not read your documents. No part of the platform extracts, transcribes, optically recognises, indexes, searches, summarises, or classifies the contents of an uploaded document. There is no full-text index of document contents anywhere in our systems. When someone with permission opens a document, our servers send it to their browser and the browser renders it with its own built-in viewer.

Some of the steps below mean opening the file's format — you cannot check what a file is, or write a marker into it, without doing so. What they never involve is reading what the document says.

What we may do is limited to this list and nothing beyond it:

• storing the document;
• streaming it to people the advisory firm has authorised, after checking their permission on every request;
• checking its type and scanning it for malware, though neither is something to rely on — no scanner catches everything;
• applying an identifying mark to a copy so that a leaked copy can be traced to the recipient it was issued to; and
• deleting it.

These are the operations permitted, not a warranty that each is performed on every file.

Nothing else in the platform touches a document. We do not send documents or their contents to any artificial intelligence or machine learning provider, and we do not use them to train models. Because we do not read contents at all, that is a property of how the platform is built, not a policy we apply on top of it.

We do operate on information about a document — filename, file type and size, who uploaded it, when, which room it belongs to, who has access, and when it was opened. Search and status tracking run on that. Do not put confidential information in a filename.

Due diligence materials routinely contain personal data of people who are not part of this transaction — most often your own employees. Employee censuses, payroll registers, benefit plan documents, tax returns and Schedule K-1s all carry it.

By uploading, you confirm that:

• you have the authority to disclose the materials, including personal data of your personnel or of third parties contained in them;
• any notice or consent required by law from the individuals whose personal data appears in those materials has been given or obtained; and
• you have the right to share the materials for the purpose of this transaction.

Redact where you can. Standard practice is to pseudonymise employee censuses — Employee 1, Employee 2, and so on — and disclose identities at or near closing. Ask your advisor if you are unsure. This is the single most effective protection for the people whose data appears in your documents, and it costs the diligence process almost nothing.

Do not upload payment card data, or personal data of anyone under 18, in any form.

Do not enter regulated data into fields or notes. Social Security and taxpayer identification numbers, driver's licence and passport numbers, personal financial account numbers, health information, consumer report information, biometric identifiers, and data revealing race, religion, health diagnosis, sexual orientation, immigration status or union membership do not belong in a structured field, a tag, a filename, or a note. Inside a document is different — that is what documents are for.

A diligence room is created by an advisory firm for a specific transaction. The firm decides who is admitted, what each party may see, and when access ends. We enforce those decisions; we do not make them.

If you are admitted to a room:

• materials in it are confidential business information, and access is granted solely to evaluate the transaction;
• where you have signed a non-disclosure agreement, that agreement governs and these terms do not narrow it;
• independently of any NDA, you agree not to redistribute, republish, or use the materials for any purpose other than evaluating the transaction;
• documents you open may carry a mark identifying you, so that a leaked copy can be traced back;
• do not attempt to reach materials you have not been granted access to;
• your account is yours alone — do not share credentials.

Removing the download option from a video or audio file limits convenience, not capability. Treat everything in a room as traceable to you and handle it accordingly.

Your materials are held for as long as the advisory firm's account with us is active, and are deleted at the firm's instruction or within 30 days of the firm's access ending.

Deleting a file removes it immediately, including from backups — documents are stored separately from our database and are not included in database backups.

If you want your materials removed before the transaction concludes, ask the advisory firm. They give us the instruction. If you ask us directly, we will tell you which firm to contact and let them know you asked.

Where we hold personal data about you as an individual — your name, email address, telephone number, and account — you may ask to know what we hold, access it, correct it, or delete it. Email privacy@dealatrium.com. We respond within 45 days, and you may appeal a decision by replying to it.

Where your personal data sits inside a document uploaded to the platform, we cannot search for it, cannot tell you what is in it, and cannot find you inside it — that is what "we do not read documents" means in practice. The advisory firm can. We will tell you who they are.

Our full Privacy Policy has more detail, including rights specific to your state.

If we receive a subpoena, court order, or other binding legal demand for materials on the platform, we will tell the affected firm before disclosing anything unless we are legally prohibited from doing so, disclose only what the demand requires, and challenge a demand that appears overbroad or defective.

Access is checked on every request against the permissions recorded for that specific person and document — there is no cached permission state. Documents are never served by public link. Data is encrypted in transit. Sign-in is by emailed link; we never store passwords. No system is perfectly secure, and we do not claim otherwise.

DealAtrium is software. We are not a broker, dealer, investment adviser, or party to any transaction, and nothing on the platform is legal, financial, tax, or investment advice. We are not responsible for the outcome of any transaction, for the accuracy of materials uploaded by any party, or for the conduct of any user.

The platform is provided "as is." To the fullest extent permitted by law we disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement, and we are not liable for indirect, incidental, special, or consequential damages, or for lost profits or lost business opportunity.

These terms are governed by the laws of the State of Colorado, without regard to its conflict of laws rules. The state and federal courts located in Colorado have exclusive jurisdiction over any dispute.

We will update the effective date above when these terms change, and notify you by email where a change materially affects how we handle your materials.

ExitPros LLC
3123 W Union Ave, Englewood, CO 80110
privacy@dealatrium.com