Acquiror AI Privacy Policy

On this page

Version 2.8. Effective date: October 20, 2026. This version supersedes the v1 waitlist policy (effective June 5, 2026, last updated August 2, 2026). Prepared with AI assistance and not reviewed by a licensed lawyer. Not legal advice.

Acquiror AI provides no investment, legal, tax, accounting, lending, or valuation advice. AI outputs and every other figure the product produces are informational only and must be verified by a qualified person before reliance. See Sections 5, 12, and 14 of our Terms of Service.

Effective date: October 20, 2026 | Version: 2.8 | Applies to: the Acquiror AI product (app), the acquiror.ai marketing website, and related services operated by Umplify Technologies Inc.

Who we are and scope
Our Privacy Officer
Information we collect
Prospects and the contact form
Where your information comes from
How we use your information
Consent and legal bases
Our role for deal data your organization uploads
How we share information and our subprocessors
Tenant-configured AI providers (bring your own key)
Where your data is stored and cross-border transfers
Data retention
Your rights: Canada
US State Privacy Notice
Breach notification
Automated decision-making
Global Privacy Control
Business transfers
Minors
Cookies and telemetry
Changes to this policy
How to contact us, and version history

01 Who we are and scope

In one line: this policy explains how Umplify Technologies Inc. handles personal information in the Acquiror AI product and on the acquiror.ai website, for customers and visitors in Canada and the United States.

Acquiror AI ("Acquiror AI", "we", "us", or "our") is a business-to-business deal management and acquisition analysis platform operated by Umplify Technologies Inc., a corporation organized under the laws of Ontario, Canada. This policy covers:

The Acquiror AI product: the authenticated, subscription application used by our customers (each, a "Customer" or "tenant", which may be an organization or an individual acting for business purposes, such as an individual searcher or acquirer) and the individual users they authorize.
The marketing website at acquiror.ai, which is a separate system from the product (see Sections 4 and 20).

This policy is written to meet obligations under Canadian federal and provincial privacy law (including PIPEDA and Quebec's Law 25) and United States state privacy laws, together with Canadian and US anti-spam law (CASL and CAN-SPAM). Acquiror AI is offered to customers in Canada and the United States only. The service is not directed at residents of the European Union or the United Kingdom, and we do not claim compliance with the GDPR or the UK GDPR.

Where this policy makes a promise about data handling, it describes how our systems actually work today. Where a practice is still being finalized, we say so.

02 Our Privacy Officer

In one line: a named role at Umplify is accountable for personal information, and you can reach that person at privacy@acquiror.ai.

Under PIPEDA's accountability principle and section 3.1 of Quebec's Act respecting the protection of personal information in the private sector (Law 25), Umplify Technologies Inc. designates a person in charge of the protection of personal information. By default this is the Chief Executive Officer of Umplify Technologies Inc.; the function may be delegated in whole or in part in writing.

Title: Privacy Officer, Umplify Technologies Inc.
Contact: privacy@acquiror.ai

The Privacy Officer oversees our privacy governance practices, including our retention and destruction framework, personnel roles across the information life cycle, and our complaints process. Complaints about our handling of personal information can be sent to the Privacy Officer at the address above.

03 Information we collect

In one line: we collect account and billing information, the deal content your organization uploads, AI prompts and outputs, support communications, and operational logs.

Account and user data

For each individual user of the product: display name, given, middle, and family names, email address, user and directory identifiers from our identity provider (Microsoft's identity service), role and permissions within the tenant, active or removed status, time zone, preferred currency, optional profile details such as street address and unit number, city, province or state, postal code, country, company name, company website, and company phone number and extension, and the time and acting user of each creation and change of the record. Some of these fields (name, address, country) may also arrive as claims from the identity service at sign-in. When an organization starts a trial, we check whether the administrator's email address has already been used for a trial by another organization, so that one trial is offered per person; this check reads email addresses across organizations and stores nothing new.

Terms acceptance records. When you create or join an organization, when the product asks you to accept a changed version of our terms before continuing, and when you dismiss the in-product notice about relying on AI output, we record your email address and your user and directory identifiers at that moment, the time, which documents and versions you accepted (with a fingerprint of each document's text), whether you confirmed that you are authorized to accept for your organization, and the client IP address and browser or client identifier the request carried. Where Stripe collects a consent to our Terms of Service on its checkout page, we also record that consent with the checkout session reference. Administrators of your organization can see on the members page whether each member has accepted the current terms and when. These records are kept for the life of your organization's account, are included in your organization's self-service export, and are not changed or deleted while the account exists.

Tenant and billing data

For each subscribing organization: organization name and display name, organization logo where an administrator uploads one, email domain, billing address (country, province or state, city, postal code, address lines), tax identification number and its country, invitation codes, subscription plan and status, and payment records. Payment records include Stripe customer and subscription references, transaction amounts and currency, tax amounts and jurisdictions, invoice links, and payment failure reasons. We do not store payment card numbers. Card data is collected and held by Stripe, our payment processor; we hold only references and derived billing records. We also retain payment-provider webhook event records, including the raw event payloads Stripe sends us, so that billing events can be verified and replayed (see Section 12 on retention).

Uploaded deal documents and target-company financials

Customers upload documents about businesses they are evaluating (for example CIMs, profit and loss statements, balance sheets) and enter structured financial data (quality of earnings, normalized statements, working capital, valuation, financing, and revenue analyses). These materials may contain personal information about individuals connected to a target business or a deal, including deal-side contacts (names, roles, emails, phone numbers, companies, interaction notes) recorded by the Customer, a target's address and map coordinates, and named customers, owners, and key people in revenue, working-capital, and risk analyses. For each uploaded document we also keep: a copy of the text extracted from it; passages of that text and their numeric embeddings in a search index, together with the identifier of the user who uploaded it; and, where our AI features extract figures from a financial statement, a structured record of those figures (for example revenue, earnings, owner compensation and named add-backs, and the largest customers by share), which is kept with the deal. Scanned pages and uploaded images that have no text layer are sent as images to the AI provider for text recognition (Section 11); we keep no separate copy of the page image beyond the uploaded file itself. Section 8 explains our role for this category.

AI prompts and outputs

When you use AI features, we keep your questions and the AI answers (including citations to your uploaded documents) for 90 days, and we persist AI-generated email and letter of intent drafts, risk summaries, revenue-durability assessments, go/no-go decision proposals and decision records, extracted financial figures, document classifications, and investment memo notes as part of your organization's data in the product, whichever AI provider produced them. We also keep per-tenant AI usage counters (tokens, cost, and call counts by day), cache-hit counters, per-user rate-limit counters, and a cache of recent AI responses (the full response text, including recognized text from scanned pages, keyed by a hash of the request) that is not used after 24 hours. The text of a question you ask the AI question-and-answer feature is also written to our operational logs (Section 20), which are kept for 30 days. If you connect an external AI assistant through the MCP server, we keep an audit record of which prompts it invoked (the prompt name, the names of its arguments and context sources, whether the deal context was assembled, the user, and whether it succeeded; not the argument values) for the life of your organization's account.

Support communications and feedback

Messages you send us (for example to support@acquiror.ai, privacy@acquiror.ai, or hello@acquiror.ai), submissions through the in-product feedback form (your name and email address, the feedback type and severity you choose, a subject, your message, and an optional reply-to address), and question-and-answer quality ratings, which store the rated question and answer with your rating.

Product telemetry and audit logs

Operational telemetry and diagnostics through Microsoft's cloud monitoring service (requests including the client IP address, the request address and query string, exceptions, performance data, and application log lines, which can include user and tenant identifiers, email addresses, document names, the text of questions asked of the AI question-and-answer feature, and the client names and redirect addresses that an external AI client supplies when it registers with our MCP server), kept for 30 days; plus in-product audit logs such as subscription change logs, valuation audit logs, stage history, and data export logs (who exported, when, and what volume). Our product analytics are internal only: we do not use third-party analytics or tracking tools inside the product.

We do not buy personal information from data brokers, and we do not ask for sensitive personal information such as government identifiers, health information, or biometric data.

04 Prospects and the contact form

In one line: if you use the contact form on our marketing site, join the waitlist, sign up for email, or asked for a calculator write-up when the site offered it, this is the data the marketing site holds about you.

The public valuation calculator on acquiror.ai runs entirely in your browser: the figures you enter are not sent to us or stored by us. The marketing website has three kinds of form: the contact form; the waitlist, where you ask to be told when accounts open; and the email sign-ups on the resources pages, at the foot of each guide, and for the demonstration exports on the product page. They collect the following when you submit them.

Data	Required?	Why we collect it
Email address	Required	To reply to your request, to tell you when accounts open (waitlist), to send what you signed up for, and to send product updates where you have asked for them. The contact form accepts business email addresses only; the waitlist and email sign-ups accept any address.
Contact form fields: your name, firm (optional), what best describes you (optional), what you need, and an optional message, plus a record of your consent to be contacted and the wording you agreed to	As marked on the form	To route and answer your request, and to keep a record of your consent.
Waitlist fields: your firm (optional) and what best describes you (optional), plus a record of your consent to be emailed and the wording you agreed to	As marked on the form	To understand who is waiting for access, and to keep a record of your consent.
Email sign-ups: which form you used, plus a record of your consent to be emailed and the wording you agreed to	Required	To send what you signed up for, and to keep a record of your consent.
Which page you submitted from, and any campaign parameters in the link you arrived on	Automatic	To understand where requests come from.
IP address, submission time, and submission month	Automatic	Security and abuse prevention (rate limiting, stopping bot submissions).
Server and diagnostic logs	Automatic	Operational telemetry to keep the site reliable and secure.

Each form includes a hidden field invisible to people and a Cloudflare Turnstile bot check; a filled hidden field or a failed check means the submission is dropped with nothing stored (a failed check still counts toward the rate limit for that IP address), and the check result itself is not stored with your submission. Each submitting IP address and a count of its recent submissions are kept for rate limiting and removed by a daily job once the counting window has passed (at least 24 hours). The contact form, the waitlist and the email sign-ups send no automatic email to you. A notification of each contact form submission is emailed to us, subject to a daily cap that keeps a count only and stores no personal information; once the cap is reached, submissions are still stored but no notification is sent for the rest of that day. A notification of each new waitlist or email sign-up address (the address, the firm and role if given, the page you submitted from, any campaign parameters, and the IP address) is also emailed to us, without a cap. The form service that receives these submissions runs in Microsoft's cloud in the United States; the submissions themselves are stored in Microsoft's cloud in Canada.

The site previously offered, from the public calculator, a request to have your valuation emailed to you as a write-up. It no longer collects it. Those records, which included the email address, company or firm, and how you described yourself (the calculator figures were never stored), are kept under our Data Retention Schedule (https://acquiror.ai/legal/retention-schedule) and are not added to. Records from the earlier waitlist are kept with those of the current one. We have not yet sent any product-update, guide, or launch email to anyone on these lists. When we do, each such email will follow CASL and CAN-SPAM: sent only where you have asked for it, with sender identification, a valid postal contact address, and a working unsubscribe honoured promptly. A reply to a contact request is a transactional message. Unsubscribed addresses go on a suppression list, which we check before any such sending, so we do not contact them again.

05 Where your information comes from

In one line: we get information from you, from your organization, from our systems, and from our payment and identity providers.

Directly from you: account profile details, uploaded content, AI prompts, support messages, marketing-site form submissions.
From your organization: an administrator may invite you, set your role, or enter information about you as a user of their tenant.
Generated by our systems: logs, audit trails, usage counters, AI outputs.
From service providers acting for us: Stripe (billing status and events), Microsoft's identity service (authentication claims such as your directory identifier and email).

06 How we use your information

In one line: we use personal information to run the product, bill for it, power the AI features you invoke, keep the service secure, and meet our legal obligations.

We use personal information to:

Create and administer accounts and tenants, authenticate users, and enforce roles and permissions
Provide the product's features, including document management, financial analysis, and the AI features you choose to invoke
Process subscriptions, payments, invoices, and taxes through Stripe
Send transactional and service email (team invitations, trial ending, payment failed, card expiring, upcoming invoice, card authentication required, and decision export ready) through Microsoft's email service
Provide support and respond to your requests
Secure the service: abuse prevention, rate limiting, fraud detection, audit logging
Operate, maintain, and improve the service, using internal telemetry only
Display a paying Customer organization's legal name, trade name, logo, and trademarks on the acquiror.ai website and in our marketing materials, under the license the organization grants in Section 17 of our Terms of Service (https://acquiror.ai/legal/terms-of-service). This display is a public disclosure of that information. An organization can opt out at any time by emailing privacy@acquiror.ai, and we remove it from the website within 30 days after receiving the email and do not reprint its name or logo in new materials. Where the Customer is an individual, including a sole proprietor, we display the individual's name only with their prior written consent, for example when they agree to provide a testimonial
Comply with legal obligations and enforce our agreements

We do not use Customer content to train or fine-tune AI models, and we have no training or fine-tuning pipeline; the ratings you give to AI answers are used to review answer quality. Our platform AI provider, Microsoft, states in its published terms that prompts and completions are not used to train its foundation models and are not available to the model's original developer. Where your organization configures its own AI provider (Section 10), that provider's own terms govern whether it trains on your content, and your organization should check them. Our AI providers process content to generate the outputs you request; see Sections 10 and 11 for who processes it and where.

In one line: we rely on your knowledge and consent under Canadian privacy law, collected at signup and at the point each feature is used, and you can withdraw it.

Under PIPEDA and Quebec's Law 25, we collect, use, and disclose personal information with the knowledge and consent of the individual, except where law permits or requires otherwise.

The purposes for which we collect personal information are identified in this policy, in clear and simple language, which is published at https://acquiror.ai/legal/privacy-policy; your creation of an account and use of the service constitutes consent for those identified purposes.
For any new purpose, we will seek fresh consent before use.
Quebec residents: consistent with Law 25, we identify purposes at or before collection, we request any consent required separately from other terms, and we do not use personal information for secondary purposes without consent. We do not collect sensitive personal information through the product's account systems.
Withdrawal: you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting privacy@acquiror.ai. Withdrawal may limit our ability to provide the service.
Where we rely on grounds other than consent (for example securing the service against abuse, or meeting legal obligations), we limit processing to what is reasonable and proportionate.

For personal information contained in content your organization uploads, the consent obligations rest primarily with your organization, as explained in Section 8.

08 Our role for deal data your organization uploads

In one line: for deal documents and third-party personal information your organization puts into the product, we are a processor acting on your organization's instructions, and your organization is responsible for having the right to upload it.

Acquiror AI is a business tool. Customers upload documents and data about businesses they are evaluating, and those materials can include personal information about people who are not our users, such as a target company's owners, employees, customers, or advisors, and deal-side contacts.

For that category of information:

The Customer is the organization accountable for the information (in US state privacy law terms, the controller or business).
Umplify Technologies Inc. acts as a processor or service provider, handling the information only on the Customer's instructions, as set out in our Data Processing Addendum.
The Customer is responsible for having the legal right to collect, upload, and process that information in the product, including any required consents or notices to the individuals concerned.

If you are an individual whose personal information appears in a Customer's deal data, your request is usually best directed to that Customer. If you contact us and can tell us which Customer holds your information, we will refer your request to that Customer and provide reasonable assistance; we do not search across Customers' deal data to find a person, because that data is confidential to each Customer and our systems are built to keep it separated.

For our own account, billing, waitlist, and operational data, Umplify Technologies Inc. is the organization accountable (the controller).

In one line: we do not sell personal information and we do not do targeted advertising; we share only with the service providers that run the platform, with parties you direct us to share with, and where the law requires.

We do not sell personal information for money or other valuable consideration, we do not "share" personal information for cross-context behavioral advertising as defined under California law, and we do not process personal information for targeted advertising.

Apart from the public display of a paying Customer's name and logo described in Section 6, we share personal information only:

With subprocessors: service providers that help us run the platform under contract, such as Microsoft (cloud infrastructure, storage, identity, email, AI processing) and Stripe (payments). We maintain a current subprocessor list at https://acquiror.ai/legal/subprocessors, including each vendor's role and processing region. The Data Processing Addendum gives Customers advance notice of subprocessor changes and a right to object.
At your organization's direction: for example, when a Customer on a plan that includes it (currently Firm and Enterprise) connects an external AI client to our MCP server, or configures its own AI provider (see Section 10), data flows to the party the Customer chose. These are customer-directed disclosures, not disclosures by us for our own purposes.
To authorities where required: we may disclose personal information if required by law, to respond to lawful requests from public authorities or courts of competent jurisdiction, or to protect our rights or the safety of others. Where lawful and practicable, we will notify the affected Customer before disclosing Customer Data.
In a business transfer: see Section 18.

10 Tenant-configured AI providers (bring your own key)

In one line: if your organization connects its own AI provider account, your data goes to that provider under your organization's agreement with it, not ours.

Acquiror AI's built-in AI features run on Microsoft's AI service; Microsoft is our subprocessor for this processing (see Section 11 for processing locations, which are outside Canada).

Separately, a Customer may configure its own AI provider for the AI features by supplying its own API key ("bring your own key"; a "Tenant AI Provider" as our Terms of Service define it). Supported tenant-configured providers are currently Anthropic and OpenAI, including an OpenAI-compatible gateway at a public address of the Customer's choosing. When a Customer does this:

Prompts and content for AI features, including scanned page images sent for text recognition, flow to the provider the Customer selected, under the Customer's own agreement with that provider.
That provider is the Customer's chosen processor, not an Acquiror AI subprocessor. Umplify transmits the request on the Customer's instruction and does not control the provider's processing; it stores and logs the exchange as Section 3 describes (question-and-answer history, drafts and analysis records, the 24-hour response cache, and operational logs).
Umplify is not responsible for the privacy practices, data handling, processing locations, or outputs of a tenant-configured provider. Customers should review their provider's terms before connecting it.
The Customer's API key is accepted once at our API boundary, stored only in our cloud secret store (a dedicated secret-management service in Canada), never persisted in our database, and excluded from application logging by design. If an administrator asks the product to list the provider's available models before saving a key, the key is sent once to that provider for the listing and held briefly in memory, and is not stored. The Customer can remove it from use at any time by replacing it or returning to the platform provider, and we delete the stored secret on request.
Embedding (document indexing) processing remains on our platform-managed provider even when a tenant-configured chat provider is in use.

Anthropic and OpenAI are available only on this bring-your-own-key basis. There is no platform-managed option in which Umplify supplies its own key for those providers: if your organization has not configured its own provider, AI features run on our platform provider, Microsoft's AI service.

11 Where your data is stored and cross-border transfers

In one line: your core data is stored at rest in Canada; content you submit to AI features is processed by Microsoft's AI service outside Canada, in the United States or other Microsoft regions, and we are evaluating Canadian AI processing.

Core data at rest is stored in Canada. Our databases, uploaded document storage, background processing queues, search indexes, secret store, monitoring logs, and application infrastructure run in Microsoft's Canadian cloud region in Toronto, Ontario. This continues the Canadian data residency commitment made in our v1 policy for stored personal information. Automated database backups are managed by Microsoft, retained for 7 days, and backup copies may be held in a second Canadian region operated by Microsoft; they stay in Canada.

Some processing occurs outside Canada:

AI processing. When you invoke an AI feature using our built-in provider, the content of that request (which can include text from your uploaded financial documents, images of scanned pages sent for text recognition, your questions, and retrieved document excerpts) is processed by Microsoft's AI service outside Canada, in the United States or other Microsoft regions worldwide. Our current platform AI deployment is provisioned in the United States on Microsoft's global deployment tier, under which Microsoft may route an individual request to any region where the model is available. The AI outputs and the search index built from your documents are stored back in Canada. Microsoft states in its published terms that prompts and outputs are not used to train its base models and are not available to the model's original developer. Microsoft's abuse-monitoring process may store a sample of prompts and outputs that its automated checks flag, for review by authorized Microsoft personnel, in the United States geography where our AI resource is deployed, under Microsoft's published abuse-monitoring terms; as far as we are aware from those terms, that store is the only copy of prompt content our platform provider keeps outside Canada, apart from the transient processing of each request. Our engineering team is evaluating moving AI processing to a Canadian Microsoft region; this policy will be updated if that changes.
Frontend delivery. The product's web application (its code and static assets) is served to your browser from Microsoft's cloud in the United States. Requests pass through that service, and no customer data is stored there; your stored data remains in Canada as described above.
Identity services. Sign-in is provided by Microsoft's identity service, a global Microsoft service that is not pinned to a single region. Identity data such as your name, email address, and directory identifier may be processed outside Canada.
Email delivery. Transactional email is sent through Microsoft's email service, whose data location for our email resource is the United States. Your email address, name, and the content of the transactional message are processed there.
Payments. Stripe processes payment and billing data on its own infrastructure, which is not limited to Canada.
Marketing website forms. The service that receives contact, waitlist, and email sign-up submissions runs in Microsoft's cloud in the United States; the submissions are stored in Microsoft's cloud in Canada (Section 4).
Tenant-configured AI providers and MCP clients process data wherever that provider operates, under the Customer's own arrangement (Section 10).

What foreign processing means for you (PIPEDA transparency). Personal information processed in the United States or another foreign jurisdiction is subject to the laws of that jurisdiction, and may be accessible to its courts, law enforcement, and national security authorities under lawful access regimes. We use contractual and technical safeguards with our providers, but we cannot override foreign law.

Quebec residents (Law 25 section 17). For personal information communicated outside Quebec, we commit to conducting and maintaining the privacy assessment required by Law 25 section 17, considering the sensitivity of the information, the purposes of the processing, the safeguards applied (including contractual ones), and the legal framework of the destination jurisdiction, and to proceeding only where the assessment establishes the information would receive adequate protection. Our transfers are governed by written agreements with our providers, which will reflect the results of those assessments. The destination jurisdictions for our processing are Canada and the United States (and, for AI inference routing and tenant-configured providers, other regions where those providers operate).

12 Data retention

In one line: we keep personal information for as long as needed to provide the service and meet legal obligations, and we delete it on verified request or after account termination, per our retention schedule.

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to provide the service to the Customer, and to satisfy legal, accounting, audit, and dispute-resolution requirements. A detailed schedule is maintained in the Data Retention Schedule at https://acquiror.ai/legal/retention-schedule. Highlights:

Customer Data (deals, documents, financials, AI drafts and analysis records): retained for the life of the subscription. On termination, Customers have 60 days in which to ask us for an export (self-service export ends with access), followed by deletion within 90 days after that window, with backup copies purged within the backup retention cycle, as set out in the Data Processing Addendum. Deletion after the export window is carried out by us as an operational process.
AI question-and-answer history: deleted automatically after 90 days.
Generated export files (decision exports and memo PDFs): deleted automatically after 30 days.
Operational telemetry: monitoring and log data are retained for 30 days.
AI response cache: a cached response is not used after 24 hours and is retained until your organization's data is deleted.
Deleted documents: the file, its extracted text, and its search index entries are removed when you delete it; the file remains recoverable from storage for between 7 and 37 days, after which storage lifecycle rules remove it. Figures our AI features extracted from the document before it was deleted stay with the deal until the deal's structured records are deleted; text recognized from it may remain in the AI response cache until your organization's data is deleted, in question-and-answer history for up to 90 days, and its file name in operational logs for up to 30 days.
Deleted deals: deleting a deal removes its files and search index entries through a background job and marks the deal as archived; the deal's structured records, drafts, analyses, and decision history stay in your organization's data, hidden from use, until your organization's data is deleted or you ask us to delete them.
Billing and payment ledger records: retained for 7 years after the fiscal year end for tax, audit, and financial reporting purposes. Payment-provider webhook event records (including raw event payloads) are retained for the same period, with the billing records they verify.
Removed users: when an administrator removes a user, the user's sign-in is severed immediately; the user record stays with the tenant's audit trail until the tenant's data is deleted, or earlier on a verified request.
Terms acceptance records: kept for the life of your organization's account as evidence of acceptance, and deleted with the rest of the organization's data; they are not deleted individually.
Marketing-site prospect data: contact, waitlist, and email sign-up records are deleted automatically 24 months after they were submitted (a repeat sign-up with the same address is not stored again and does not extend that period), or earlier when you withdraw consent or ask. Suppression-list (unsubscribe) records are kept as long as necessary to honour your opt-out.

Deletion on request. The product offers self-service data export, and self-service deletion of documents, deals, contacts, tasks, and memo notes, but not self-service deletion of a whole organization or of an individual user's record. We honour verified deletion requests (from Customers for their tenant data, and from individuals for personal information we control) by deleting the information within 60 days of verification, except where retention is required by law or is needed to establish, exercise, or defend legal claims (for example, entries in the audit logs we keep for 7 years that record who exported or changed what), in which case we will tell you what we retained and why.

13 Your rights: Canada

In one line: Canadians can access and correct their personal information, withdraw consent, get a portable copy, and, in Quebec, request de-indexing.

Under PIPEDA and applicable provincial laws (including Quebec's Law 25 and the personal information protection acts of British Columbia and Alberta), you have the right to:

Access and correction

Ask whether we hold personal information about you, and request access to it
Request correction (rectification) of inaccurate or incomplete information
Ask how your information has been used and to whom it has been disclosed

Withdraw your consent and ask us to stop using your personal information (Section 7)
Request deletion of your personal information (Section 12)
Quebec (Law 25): request that computerized personal information collected from you be communicated to you, or to a person or body authorized to collect it, in a structured, commonly used technological format (data portability). This right covers information collected from you, not information created or inferred by us. For an individual user, we provide your own account and profile data in a structured format on request; deal data held in a Customer's tenant is provided through that Customer, whose administrator can export it.

Quebec: de-indexing and cessation of dissemination

Quebec residents may ask us to cease disseminating their personal information, or to de-index any hyperlink attached to their name that provides access to it, where dissemination contravenes the law or a court order, or where the conditions of Law 25 section 28.1 are met (serious injury to reputation or privacy that clearly outweighs the public's interest in the information).

To exercise any of these rights, email privacy@acquiror.ai. We will verify your identity and respond within the timelines required by law. If personal information about you is held in a Customer's tenant data, we will refer you to that Customer per Section 8. If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec, or your provincial privacy regulator.

14 US State Privacy Notice

In one line: US residents get access, deletion, correction, portability, opt-out, and appeal rights, which we extend to every US user regardless of state.

This section applies to residents of US states with comprehensive privacy laws, including California (CCPA as amended by the CPRA). We extend the rights below to all US residents regardless of state, and regardless of whether the applicability thresholds of any particular state law are met.

Your rights

Know and access: what personal information we collect, use, and disclose, and a copy of it
Deletion: request deletion of your personal information
Correction: request correction of inaccurate personal information
Portability: receive your personal information in a portable and, where feasible, readily usable format
Opt out of sale, sharing, and targeted advertising: we state for clarity that we do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not process it for targeted advertising, so there is no such processing to opt out of; the right is stated so you know it exists
Limit use of sensitive personal information: we do not collect sensitive personal information through our account systems
Non-discrimination: you will not receive discriminatory treatment for exercising your rights

How requests work

Submit requests to privacy@acquiror.ai. We will verify your request, typically by confirming control of the email address associated with your information, and may request additional information where necessary to verify identity.
We respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will notify you of the extension and the reason. Where the request is for deletion, our response confirms the deletion and its date, which is within 60 days of verification (Section 12).
Appeals: if we decline your request, we will explain why and how to appeal. Submit appeals to privacy@acquiror.ai with the subject "Privacy appeal". We respond to appeals in writing within 60 days, and if we deny your appeal we will provide a way to contact your state Attorney General.
Authorized agents: you may use an authorized agent to submit requests where the law allows. We may require proof of the agent's written authorization and verify your identity directly.

Notes specific to California

California's privacy law covers personal information collected in a business-to-business context (there is no general B2B exemption in California). If you are a California resident whose business contact information we hold, the rights above apply to you. California's "Shine the Light" law: we do not disclose personal information to third parties for their own direct marketing purposes.

If your personal information is in a Customer's tenant data, we act as a service provider to that Customer and will refer or forward your request to them per Section 8.

15 Breach notification

In one line: if a breach creates real risk of harm we notify regulators and affected people as the law requires, and we notify affected Customers under the DPA.

Canada (PIPEDA): if a breach of security safeguards creates a real risk of significant harm to an individual, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible after determining the breach occurred. We maintain records of breaches of security safeguards as required by law.
Quebec (Law 25): if a confidentiality incident presents a risk of serious injury, we will promptly notify the Commission d'accès à l'information and affected persons, and we record every confidentiality incident in our incident register.
United States: we will notify affected individuals, regulators, and other parties as and when required by applicable state breach notification law.
Customers: where a breach affects personal data we process on a Customer's behalf, we notify the Customer under the timeline and content commitments in our Data Processing Addendum, so the Customer can meet its own notification duties.

16 Automated decision-making

In one line: Acquiror AI does not make decisions about individuals based exclusively on automated processing; its outputs are decision support that requires human verification.

Acquiror AI makes no decision about an individual based exclusively on automated processing of personal information. The platform's AI features (deal Q&A, document extraction, valuation narratives, drafting, analysis summaries) produce decision-support outputs about businesses and transactions. They are informational tools, they can be wrong, and they require review and verification by a qualified human before reliance, as our Terms of Service require. Account, billing, and access decisions are made or reviewable by people: for example, a subscription that ends automatically after repeated payment failures (Terms of Service, Section 9.5) can be reviewed by a person if the Customer asks privacy@acquiror.ai within 30 days.

If that ever changes for any decision about an individual, we will provide the notices and human review rights required by applicable law (including Quebec Law 25 section 12.1) before relying on such a decision.

17 Global Privacy Control

In one line: we do not sell, share, or target-advertise, so there is nothing for an opt-out signal to switch off, but we recognize GPC signals anyway.

Because we do not sell personal information, do not share it for cross-context behavioral advertising, do not process it for targeted advertising, and do not profile individuals in ways that produce legal or similarly significant effects, there is no processing for an opt-out preference signal to stop. We nonetheless acknowledge Global Privacy Control (GPC) and similar universal opt-out signals: we treat a valid signal as an opt-out of any such practice, now and in the future, so that if our practices ever changed, the signal would already be honoured. Our marketing site's consent-gated analytics (Section 20) are off unless you accept, which is consistent with an opt-out-by-default posture.

18 Business transfers

In one line: if Umplify itself is acquired, merges, is financed, or sells assets, personal information can transfer as part of that transaction, and this policy continues to protect it.

We are a company that builds software for acquisitions, so we say this plainly: if Umplify Technologies Inc. is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be disclosed to the parties evaluating or completing the transaction (under confidentiality obligations) and may be transferred as part of the transaction. Any successor's use of personal information remains subject to this policy, and we will notify affected users of any change in control or in how their personal information is handled, including any new choices available.

19 Minors

In one line: Acquiror AI is an 18-plus business service, and we do not knowingly collect personal information from minors.

Acquiror AI is a business-to-business service intended for professional use by adults. It is not directed at anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us personal information, contact privacy@acquiror.ai and we will delete it.

20 Cookies and telemetry

In one line: the product uses only essential authentication and session storage; the marketing site uses consent-gated Google Analytics; nothing does ad tracking.

In the product: we use essential authentication, session, and preference storage through Microsoft's identity service and MSAL (the Microsoft Authentication Library, a browser library) to sign you in and keep your session secure. We do not use third-party analytics, advertising cookies, tracking pixels, or session-replay tools inside the product. The product loads its icon font from Google Fonts, so Google receives your browser's IP address and user agent for that request and nothing else. Operational telemetry goes to Microsoft's cloud monitoring service (Section 3).
On the marketing site (acquiror.ai): the site does not set advertising or cross-site tracking cookies and runs no ad pixels. It uses Google Analytics 4, off by default: a consent bar asks for your choice at first visit, and the analytics script is not loaded, and no analytics cookie or identifier is stored, until you click Accept. If your browser sends a Global Privacy Control or Do Not Track signal, the bar is not shown and analytics never load. If you accept, IP anonymization is requested and advertising features are off. Pages with a form run a Cloudflare Turnstile bot check. Clearing the site's data in your browser brings the consent bar back.

A separate cookie policy with the full inventory is maintained at https://acquiror.ai/legal/cookie-policy.

21 Changes to this policy

In one line: we version this policy, archive old versions, and give notice of material changes before they take effect.

We may update this policy as the product and our legal obligations evolve. Each version carries a version number and effective date, and prior versions are archived and available on request (see the version history in Section 22). For material changes, we will give at least 30 days' advance notice by email to Customer administrators or by prominent notice in the product or on the website before the change takes effect, consistent with the modification provisions of our Terms of Service. For Customers, a material change to this policy binds them as Section 15 of the Terms of Service provides; for visitors to the marketing site, the updated policy applies to use of the site after its effective date.

22 How to contact us, and version history

In one line: privacy@acquiror.ai reaches our Privacy Officer for any question, request, or complaint.

Privacy requests, questions, complaints: privacy@acquiror.ai (Privacy Officer, Umplify Technologies Inc.)
General: hello@acquiror.ai

Version history

Version	Effective date	Notes
1.0	June 5, 2026 (last updated August 2, 2026)	Waitlist-era policy covering the acquiror.ai marketing site and waitlist only. Superseded by this policy on October 15, 2026.
2.0 to 2.1	Not published	Drafts of the first product-scope policy: AI processing disclosures, processor-role clarification, subprocessor list reference, US state rights bundle expansion, updated data-location statements, and admission of individual Customers acting for business purposes.
2.2 to 2.3	October 15, 2026	First published product-scope policy (2.3 corrects the marketing-site section before the effective date). Covers the Acquiror AI product and the marketing site. States retention periods, data locations (including email and backups), the tenant-configured AI providers, and the marketing site's form data as they operate on the effective date.
2.4	October 15, 2026	Describes our service providers at vendor level (Microsoft and Stripe) by function and processing location instead of naming individual cloud services. No change to the facts, data locations, or your rights.
2.5	October 15, 2026	Adds the display of a paying Customer organization's name and logo on our website and marketing materials under Section 17 of our Terms of Service, with the opt-out by email. An individual Customer's name is shown only with their consent.
2.6	October 15, 2026	Removes the mailing address from Section 22. Email to privacy@acquiror.ai remains the way to reach us; no change to your rights.
2.7	October 18, 2026	Section 04 describes the marketing site's forms as they operate on the effective date: the contact form, the waitlist (reopened until accounts open), and the email sign-ups. No change to your rights.
2.8	October 20, 2026	Alignment with the product code as of October 19, 2026: Section 03 lists the user-record fields in full, the extracted-text copy, search index entries, extracted financial figures, and scanned-page images sent for text recognition, the content of the AI response cache, the question text in operational logs, and the retention of the MCP prompt audit record; Section 06 narrows the no-training statement to what we and Microsoft state; Section 10 says a tenant provider's responses are stored like any other AI output and describes the model-listing check; Section 11 discloses Microsoft's abuse-monitoring store; Section 12 describes deleted deals. Section 04 (marketing site) updated for the waitlist notification to us, the business-email rule, and the automated purge as the site runs them. Sections 03 and 12 describe the terms acceptance records the product keeps from this version on. No change to your rights.