Privacy Policy

1. Introduction and Scope

buytoprofit (buytoprofit LLC, referred to here as “buytoprofit,” “we,” “us,” or “our”) operates an online marketplace and software platform at buytoprofit.com and related subdomains, applications, and services (collectively, the “Platform”) that helps people discover, evaluate, list, and pursue the purchase or sale of small businesses.

This Privacy Policy explains what personal information we collect, how and why we use it, with whom we share it, how long we keep it, how we protect it, and the rights and choices you have. It applies to visitors, registered users (buyers, sellers, and brokers), and others who interact with the Platform, except where a separate notice is provided.

This Policy does not apply to third-party websites, products, or services that we do not control, even if they link to or from the Platform. Please review the privacy notices of any third party you interact with.

2. Who We Are and How to Contact Us

Data controller: buytoprofit LLC.

Privacy contact: info@buytoprofit.com

3. Our Role on the Platform

buytoprofit is a neutral venue and software provider. We provide listing, search, communication, and deal-workflow tools. We are not a business broker, broker-dealer, investment adviser, accountant, appraiser, or law firm, and we do not act as an agent for any buyer or seller. We do not verify the accuracy, completeness, or quality of business financials or other information that users submit, and any “verified” indicator on the Platform refers only to identity or listing-status checks we describe in our Terms of Service, not to the accuracy of financial information. This affects how your information flows: much of what you submit is shared with, or visible to, other users so that transactions can proceed. See Section 7.

4. Information We Collect

We collect information in three ways: (a) information you provide directly; (b) information collected automatically when you use the Platform; and (c) information we receive from third parties. The categories below describe what we collect today and what we expect to collect as features such as paid subscriptions and identity verification are enabled; a category applies only when the corresponding feature is used.

4.1 Information you provide directly

• Account and profile data. Name, email address, password (stored only in hashed form by our authentication provider), and account type/role (buyer, seller, or broker). For brokers, firm name, professional details, and similar profile information.

• Seller and listing data. Business descriptions, location, industry, asking price, revenue, cash flow / seller’s discretionary earnings (“SDE”), years in operation, and other listing attributes, including financial figures and free-text narratives you choose to submit. For confidential listings, this may include sensitive non-public business information separated from public-facing fields.

• Seller intake and valuation-request data. Information submitted through the “Sell” intake form and any free valuation request, including business category, location, approximate revenue and SDE, asking-price expectation, years in operation, and your contact details.

• Inquiries, messages, and deal-room communications. The content of inquiries you send or receive, messages exchanged with other users, non-disclosure agreement (“NDA”) acknowledgements, and documents you upload to a data room.

• Saved items and preferences. Listings you save, searches you save, notification preferences, and similar settings.

• Payment data (when paid features are enabled). Subscription and purchase information processed through our payment processor. We do not collect or store full payment-card numbers on our own systems; card data is handled by the processor. We receive limited billing details such as plan, transaction status, and the last four digits/brand of a card.

• Identity-verification data (when enabled). If identity or “know-your-customer” verification is offered, you may submit government-ID images, selfies, or similar documents to our verification vendor. Where possible, such data is collected and processed by the vendor; we receive a verification result and limited metadata rather than the underlying documents.

• Support and other communications. Information you provide when you contact us, respond to surveys, or otherwise communicate with us.

4.2 Information collected automatically

• Device and usage data. IP address, browser type, device identifiers, operating system, pages and listings viewed, referring/exit pages, search queries, and timestamps.

• Cookies and similar technologies. See Section 6. Categories include strictly necessary, analytics/performance, and (if enabled) functional or marketing technologies.

• Log, security, and reliability data. Server logs, rate-limiting signals, and error/diagnostic data used to operate, secure, and debug the Platform. Our error-monitoring is configured to scrub personal data where feasible.

4.3 Information from third parties

• Authentication and payment providers (account status, transaction status).

• Identity-verification vendors (verification results), if and when enabled.

• Analytics providers (aggregated and event-level usage data), if and when enabled.

Sensitive information. Please do not submit special-category or sensitive personal data (for example, government identifiers, health, or financial-account credentials) except where the Platform specifically requests it for a stated purpose (such as identity verification). Business financial information you place in a listing is treated as described in this Policy and our Terms.

5. How We Use Personal Information, and Our Legal Bases

We use personal information to operate, provide, secure, and improve the Platform; to enable transactions between buyers and sellers; to communicate with you; to process payments; to prevent fraud and abuse; and to comply with law. Where the GDPR applies, we rely on the legal bases set out below.

Where we rely on legitimate interests, we have considered the impact on you and your rights. You may object to such processing as described in Section 13.

6. Cookies and Similar Technologies

We use cookies and similar technologies (collectively, “cookies”) to operate the Platform, remember your preferences, keep you signed in, secure the service, and, where enabled and permitted, measure usage and performance.

Categories we use

• Strictly necessary cookies. Required for core functionality such as authentication/session management, security, and load handling. These cannot be switched off through our consent tool.

• Analytics / performance cookies. Help us understand how the Platform is used so we can improve it. Not currently used; if enabled, they load only after you consent where the law requires it.

• Functional cookies. Remember choices you make (such as preferences). Enabled only where applicable.

• Marketing/targeting cookies. Used to deliver or measure marketing. Not currently used.

Your choices. Where required by law, non-essential cookies are set only after you consent through our cookie banner, and you can change or withdraw your choices at any time via the banner’s “Cookie settings” control. You can also control cookies through your browser settings; blocking some cookies may affect functionality. Our consent tool records your choices and the date they were made.

Global privacy signals. Where required (for example, under California law), we treat recognized opt-out preference signals (such as Global Privacy Control) as a valid request to opt out of “sale”/“sharing” for the relevant browser or device.

7. How and With Whom We Share Information

7.1 With other users (inherent to a marketplace)

Because the Platform exists to connect buyers and sellers, certain information is shared with other users by design:

• Public listing information is visible to other users and visitors. For confidential listings, identifying details are withheld from public view and disclosed only through the controlled flow described in Section 8.

• When you send an inquiry, contact a seller, or enter a deal room, relevant profile and contact information and your messages are shared with the other party to enable the transaction.

• Documents you place in a data room are made available to counterparties you authorize, subject to applicable NDAs.

7.2 With service providers (processors / subprocessors)

We share information with vendors that process it on our behalf under contract and only for the purposes we specify. Current and anticipated providers are listed in Appendix A. Categories include hosting and infrastructure, database and storage, authentication, transactional email, payment processing, rate limiting/caching, error monitoring, analytics (if enabled), and identity verification (if enabled).

7.3 For legal, safety, and compliance reasons

We may disclose information if we believe in good faith that it is necessary to comply with law or legal process; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of buytoprofit, our users, or others.

7.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy.

7.5 With your direction or consent

We share information at your direction or with your consent, for example when you choose to connect a third-party service.

We do not sell your personal information for money. We do not sell personal information in the ordinary sense, and we do not currently “share” it for cross-context behavioral advertising as those terms are defined under California law. If this ever changes, we will update this Policy and provide any legally required opt-out (“Do Not Sell or Share My Personal Information”).

8. Confidential Listings, NDAs, and Data Rooms

Sellers may designate listings as confidential. For confidential listings, identifying information is not shown publicly; instead, an anonymized title and limited category-level details are displayed. A prospective buyer may request access, and additional information, and any data-room documents, is disclosed only through a controlled flow that may require agreeing to an NDA. We log access events to support security and the integrity of the process. Even so, once information is disclosed to a counterparty, we cannot fully control that party’s subsequent use; the NDA and our Terms govern those obligations between users.

9. AI Features and Automated Processing

The Platform offers, or will offer, AI-assisted tools (for example, document analysis, summary generation, and valuation-range estimates). When you use these tools, the inputs you provide are processed to produce outputs.

• Outputs are informational, not advice. AI-generated valuation ranges, summaries, and analyses are estimates and informational aids only. They are not appraisals, financial, legal, tax, or investment advice, and should not be relied upon as such.

• Processing by AI providers. Inputs may be processed by third-party AI service providers under contract.

• No solely-automated decisions with legal effect. We do not use these tools to make decisions that produce legal or similarly significant effects about you without human involvement. If that ever changes, we will provide the disclosures and safeguards the law requires.

10. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy, including to provide the Platform, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Retention periods depend on the type of data and the context.

• Account and profile data: for the life of the account and for a reasonable period afterward.

• Listing, inquiry, and deal-room data: as needed to provide the service and for records, then deleted or de-identified.

• Seller intake / valuation-request data: retained to respond to the request and for follow-up and records.

• Payment and transaction records: as required by tax and accounting law (often several years).

• Logs and security data: for a limited period appropriate to security and reliability needs.

11. How We Protect Information

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit, access controls and role-based permissions, row-level security on our database, isolation of sensitive non-public data, rate limiting, secure secret management, and error monitoring configured to reduce exposure of personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Breach notification. If a personal-data breach occurs, we will respond in accordance with applicable law, including notifying affected individuals and regulators where required and within required timeframes.

12. International Data Transfers

We are based in the United States and use service providers that may process information in the United States and other countries. If you access the Platform from outside the United States, your information will be transferred to, and processed in, the United States, where data-protection laws may differ from those in your jurisdiction.

Where we transfer personal data subject to the GDPR outside the EEA/UK, we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum/IDTA), together with any necessary supplementary measures.

13. Your Privacy Rights and Choices

Depending on where you live and which laws apply, you may have some or all of the following rights regarding your personal information:

• Access / know: obtain confirmation of, and access to, the personal information we hold and how we use it.

• Correction / rectification: correct inaccurate or incomplete information.

• Deletion / erasure: request deletion, subject to legal exceptions.

• Portability: receive certain information in a portable format.

• Restriction / objection: restrict or object to certain processing, including processing based on legitimate interests and direct marketing.

• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

• Opt out of “sale” or “sharing” and limit use of sensitive data: to the extent these apply under U.S. state law.

• Non-discrimination / non-retaliation: we will not discriminate against you for exercising your rights.

• Appeal: where provided by law, appeal a decision on your request.

How to exercise your rights. Contact us at info@buytoprofit.com. We will verify your request as required by law and respond within the legally required timeframe. You may use an authorized agent where permitted. If you are in the EEA/UK, you also have the right to lodge a complaint with your local data-protection authority; if you are in the U.S., you may have the right to complain to your state Attorney General or applicable agency.

14. California Privacy Notice (CCPA/CPRA)

This section provides additional disclosures for California residents under the CCPA/CPRA.

Categories of personal information collected (last 12 months)

In the past 12 months, we have collected the following statutory categories: identifiers (e.g., name, email, IP address); customer-records information (e.g., contact and, for sellers, business-related financial figures they submit); commercial information (e.g., subscriptions, transactions, items saved); internet/network activity (e.g., usage and interactions); geolocation (approximate, from IP or features you use); professional/employment information (for brokers); and, if identity verification is enabled, government identifiers and similar sensitive information.

Sources, purposes, and disclosures

Sources, business/commercial purposes, and the categories of recipients are described in Sections 4, 5, and 7. We disclose personal information to service providers for business purposes as described in Appendix A.

Sale / sharing of personal information

We do not sell personal information for monetary value, and we do not currently share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information

We use sensitive personal information (such as identity-verification data, if enabled) only for the purposes permitted by the CCPA/CPRA, such as providing the service and preventing fraud, and not to infer characteristics about you.

Your California rights and how to exercise them

California residents have the rights to know, delete, correct, and opt out of sale/sharing, and to limit the use of sensitive personal information, as well as the right to non-discrimination. To exercise these rights, contact us at info@buytoprofit.com, or use the “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” controls if and when such processing occurs. We honor Global Privacy Control signals as described in Section 6.

15. Children’s Privacy

The Platform is intended for users who are at least 18 years old and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under the age required to form a binding contract in their jurisdiction). If we learn that we have collected such information, we will delete it. If you believe a minor has provided us information, contact us at info@buytoprofit.com.

16. Third-Party Links and Services

The Platform may contain links to, or integrate with, third-party websites and services. Their use of your information is governed by their own privacy policies, not this one. We encourage you to review those policies.

17. Marketing Communications

We may send you product updates and marketing communications where permitted by law and your choices. You can opt out at any time using the unsubscribe link in those messages or by contacting us. We will still send you non-promotional transactional and service messages (such as confirmations, security notices, and account communications).

18. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date and, for material changes, provide additional notice as required by law. Your continued use of the Platform after an update means you acknowledge the updated Policy, to the extent permitted by law.

19. How to Contact Us

If you have questions, requests, or complaints about this Policy or our handling of your information, contact us at:

buytoprofit LLC

Email: info@buytoprofit.com

Appendix A: Categories of Service Providers

We rely on third-party service providers ("subprocessors") in the categories below to operate the Platform. To help protect the security of the Platform and our users, we describe these providers by category and function rather than naming individual vendors. We maintain an internal list of the specific providers behind each category, each engaged under a data-processing agreement (DPA); we will provide further detail to regulators or, where legally required, to data subjects, subject to appropriate confidentiality.