Probity Privacy Policy

Account information

Name, email address, and password (if you sign in with email) or the limited profile information Google or Microsoft provides when you sign in with those providers (see "Sign-in with Google or Microsoft" below). If you invite a team member, adviser, or seller into a deal, we collect the email address you provide for them and, once they accept, their own name and sign-in information.

Payment information

If you subscribe to Pro or purchase a Diligence Room, our payment processor, Stripe, collects your card number, billing address, and related payment details directly. Probity does not receive or store your full card number. We receive from Stripe a payment status, a partial card identifier (such as the last four digits and card brand), billing history, and transaction identifiers, which we use to manage your subscription and provide receipts.

Documents you upload

The core of the product is a place to upload and analyze documents about a business you are evaluating: tax returns, financial statements, bank statements, general ledgers, contracts, payroll records, and similar files. These documents frequently contain personal information about people who are not Probity users: the seller, the seller's employees, the seller's customers or vendors named in contracts, and others. We store these documents as you provide them and process them to generate the analyses you request. See "Documents about other people" below for how we treat this category of data and what it means for you as the person who uploaded it.

Deal journal, notes, and pipeline data

Notes you write about a candidate business, status you set on your pipeline and diligence checklist, and any tags, flags, or comments you add.

Browser clipper data

If you use the Probity browser clipper or bookmarklet to save a listing from a business-for-sale marketplace, we store the listing information you clip (title, location, asking price, revenue, cash flow, URL, and similar fields) into your pipeline.

Forwarded emails (Pro subscribers, sourcing agent)

Pro subscribers may set up a private forwarding address (for example, deals-x7k2@in.useprobity.com) and configure their own email provider to forward listing alerts from business-for-sale marketplaces and brokers to that address. We receive and process only what arrives at that address: sender, subject, body text, and attachments. We do not connect to, read, or access your email account or mailbox by any other means, and we never request your email password. See the Sourcing Agent description on our pricing and product pages for how this feature works.

Usage and device data

Standard web and application logs: IP address, browser type, device type, pages and features used, timestamps, and error logs. We use this to operate, secure, and improve the product, and to enforce the usage limits described in our Terms of Service.

Cookies and similar technology

We use strictly necessary cookies to keep you signed in and to protect the application against cross-site request forgery. We do not currently use third-party advertising or cross-site tracking cookies. If that changes, we will update this policy and, where required, ask for your consent first.

If you choose to sign in with Google or Microsoft, we request only the authentication scopes needed to confirm your identity and email address (your name, email address, and profile photo, where the provider makes it available). We do not request, and do not have, access to your Gmail, Outlook, Google Drive, OneDrive, calendar, or any other data in your Google or Microsoft account. This is separate from and unrelated to the Sourcing Agent's email forwarding address described above, which requires no account connection at all.

We use the information above to:

• Provide the account, pipeline, deal journal, and staged diligence checklist you use whether or not you subscribe to Pro.
• Run the analyses you request: the SDE Recast (tax return analysis), Cash Proof (bank statement analysis), spread refresh, and related outputs, using the AI processing described in section 4.
• Process payments and manage your subscription or Diligence Room purchase through Stripe.
• Operate the invited-user features: seller and broker upload links, and team member access for your attorney, CPA, lender, or other advisers, scoped to what you authorize.
• Secure the product: detect abuse, enforce the per-user rate limits and storage caps described in our Terms of Service, and investigate suspected fraud or violations of our Acceptable Use Policy.
• Send you service messages (confirmations, security notices, billing notices) and, if you have not opted out, product updates.
• Comply with legal obligations, including responding to lawful requests from courts or regulators.

We do not use your account data, uploaded documents, or journal content to train our own products, and we do not sell your personal information. See section 11.

When you run an analysis (an SDE Recast, a Cash Proof, a spread refresh, a Q&A question, a visit question set, or a debrief summary), Probity sends the relevant document text or file to Anthropic, our AI provider, through Anthropic's commercial API, to generate the analysis. Only the documents and context relevant to that specific deal and that specific request are sent; we do not send another user's data, and we do not send your entire account to Anthropic on every request.

Per Anthropic's published commercial terms, Anthropic does not train its models on API customer content by default, and content submitted through the commercial API is treated as the customer's confidential information under those terms. We have not independently audited Anthropic's infrastructure and are relying on Anthropic's own public representations, which are available at https://www.anthropic.com/legal/commercial-terms and https://www.anthropic.com/legal/privacy (also see the Subprocessors list, SUBPROCESSORS.md, for the current version of these terms we rely on).

AI-generated analyses can be incomplete or wrong. They are informational tools, not a substitute for your own review or for advice from your attorney, CPA, or lender. See the Terms of Service for the full disclaimer.

We use a small number of service providers (subprocessors) to run Probity. Each one processes only the data needed to perform its function, under a contract that requires it to protect that data. The current list, with purpose, data categories, and region, is in SUBPROCESSORS.md, published alongside this policy. As of this draft, our subprocessors are Supabase (database and file storage), Vercel (application hosting), Anthropic (AI analysis), Cloudflare (DNS and email routing for the Sourcing Agent), Google and Microsoft (sign-in only), and, once payments launch, Stripe (payment processing). We will update the subprocessor list before adding or replacing a subprocessor that touches your data.

• Invited users. If you invite a seller, broker, or adviser into a deal, they see only what you authorize them to see (see the Terms of Service and INVITED_USER_TERMS.md for the scope of their access).
• Service providers. The subprocessors listed above, under contracts limiting their use of your data to providing their service to us.
• Legal and safety. We may disclose information if required by law, subpoena, or court order, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Probity, our users, or the public.
• Business transfers. If CrestPoint Ventures LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy or a successor policy of which you will be notified.
• With your direction. Any other sharing you specifically request, such as a lender export you choose to send outside the product.

We do not sell personal information and do not share it with data brokers.

• Active accounts. We keep your account data, uploaded documents, and journal content for as long as your account is open, so the product continues to work as you expect.
• Deletion on request. You can delete a document, a deal, or your entire account from within the product, or by writing to hello@useprobity.com. Deleting a document or deal removes it from active storage and from any future analysis. Deleting your account removes your account data and uploaded documents from active storage; some records (such as billing history we are required to keep for tax and accounting purposes, or records needed to resolve an open dispute) may be retained longer, as described below.
• Diligence Room read-only retention. A Diligence Room purchase includes 12 months of post-close access to the converted "company room," during which your documents remain available to you and any team members you keep active. If you kill a deal and transfer your Diligence Room slot to a new deal (as described in the Terms of Service), the killed deal's documents remain stored in read-only form for the remainder of your slot's active period, so you retain a record of what you reviewed.
• Backups and point-in-time recovery. Our hosting provider maintains routine backups for disaster recovery, independent of your in-product deletion actions. Deleted data is removed from active storage immediately but may persist in backup copies for a limited window before those backups age out and are overwritten in the ordinary course of our provider's backup cycle. We do not restore an individual deleted item from backup except to recover from a system failure, and backup copies are not used for any purpose other than disaster recovery.
• Legal holds. We may retain specific records longer than the periods above if we are notified of a legal claim, subpoena, or regulatory inquiry that requires preservation.

We use industry-standard safeguards appropriate to the sensitivity of diligence documents:

• Row-level security on every database table, so your data is scoped to your account by default, in addition to server-side authorization checks on every action.
• Encryption in transit (TLS) and at rest for documents and account data.
• Time-limited signed URLs for document access, rather than permanent public links.
• Audit logging of AI analysis calls, and, as our audit trail features expand, of document views and downloads.
• Per-user and per-account rate limits and spend controls on AI processing, so a single account cannot be used to run up unbounded costs or extract data at scale.

No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse of information will never occur. If we learn of a security incident affecting your personal information, we will notify you and any applicable regulator as required by law.

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect about you, to request deletion, to request correction of inaccurate information, to request a portable copy of your data, and to opt out of the sale or sharing of personal information and of certain profiling. We do not sell or share personal information as those terms are defined by the CCPA/CPRA (see section 11). To exercise any of these rights, contact hello@useprobity.com. We will verify your request using your account email before responding. You will not receive discriminatory treatment for exercising a privacy right.

Other US state privacy laws

As of this draft (2026), the following states have comprehensive consumer privacy laws in effect that may apply to Probity's processing of your personal information, in addition to California. Rights are broadly similar across these laws: access, correction, deletion, data portability, and opt-out of targeted advertising, sale, and certain profiling. Some laws (noted below) also give you the right to appeal a denied request.

Most of these laws apply only to businesses that meet a revenue or data-volume threshold (for example, controlling personal data of a set number of state residents in a calendar year). This policy describes the rights available under each law without representing that Probity currently meets every state's applicability threshold at our size; see COUNSEL_QUESTIONS.md for the specific determination counsel should make before this policy is published. Where a law applies to us, we will honor its rights and appeal process; where it does not yet apply, we intend in practice to honor the same request process for every resident who asks, regardless of state, as a matter of consistency rather than legal obligation.

To exercise a right under any of these laws, email hello@useprobity.com from your account email address. We will respond within the time period the applicable law requires (generally 45 days, with one 45-day extension available where the law allows it). You may designate an authorized agent to submit a request on your behalf, subject to verification.

Right to appeal

If we deny your request under a state law that provides an appeal right (this includes Colorado, Connecticut, Virginia, Montana, Oregon, Texas, Delaware, Iowa, Nebraska, New Jersey, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island as of this draft), you may appeal by replying to our denial email within a reasonable time. We will respond to your appeal within 45 days (60 days in states that provide for that period). If we uphold the denial, we will tell you how to submit a complaint to your state attorney general or applicable regulator.

Probity is a US product hosted in the United States, and most of our users are in the United States. If you access Probity from the European Economic Area, the United Kingdom, or another jurisdiction with its own data protection law, this section applies to you in addition to the rest of this policy.

Who is the controller. For your own account data (your name, email, notes, and the documents you upload), CrestPoint Ventures LLC is the controller. For personal information about third parties contained in documents you upload (a seller's tax return, an employee list), you are the controller and Probity acts as a processor on your instructions; see "Documents about other people" below.

Legal basis for processing. We process your account data to perform our contract with you (providing the service you signed up for), and we process usage and security data based on our legitimate interest in operating and protecting the product. Where we rely on consent (for example, for a cookie or communication that is not strictly necessary), you may withdraw that consent at any time.

International transfer. Your data is transferred to and processed in the United States. Where required, we rely on the standard contractual clauses approved by the European Commission, and the UK's International Data Transfer Addendum, as the transfer mechanism with our subprocessors, or on another lawful transfer mechanism available to us.

Your rights. In addition to the rights described in section 9, you have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

EU/UK representative. Whether Probity is required to appoint an Article 27 representative in the EU and/or the UK at our current scale is an open question for counsel; see COUNSEL_QUESTIONS.md. Until that is resolved, EEA and UK users should direct requests to hello@useprobity.com.

We do not sell your personal information for money, and we do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA (which include some forms of sharing for cross-context behavioral advertising). We do not run cross-site advertising and do not have an advertising subprocessor. If that ever changes, we will update this policy and provide the "Do Not Sell or Share My Personal Information" mechanism the law requires before making the change, and we will not make that change retroactive to data already collected without your consent.

Probity is built for a specific situation: you, the buyer, are collecting documents about a business you do not yet own, from a seller you are usually bound to by a non-disclosure agreement. Many of those documents (tax returns, payroll records, bank statements, employee files) contain personal information about people who have never used Probity and never agreed to this policy: the seller, the seller's employees, customers named in contracts, and others.

Your responsibilities as the uploader. You are responsible for having the right to upload each document you put into Probity, whether that right comes from the seller's consent, the terms of your NDA, or another lawful basis. You are responsible for complying with any confidentiality obligation you owe the seller, and for using the personal information in these documents only for the purpose you obtained it (evaluating and, if you proceed, closing the acquisition). Probity is not a party to your NDA with the seller and has no visibility into its terms.

Our role for this category of data. For personal information about third parties contained in the documents you upload, Probity acts as a service provider or processor, not as an independent controller: we store and process this information to provide you the analysis you requested, and we do not use it for our own purposes, sell it, or disclose it except as this policy describes. If a third party named in a document you uploaded contacts us directly about their information, we will generally direct them to you as the party who controls that data, consistent with our role as a processor for this category.

Seller and broker uploads. If you invite a seller or broker to upload directly into a Diligence Room, the same rules apply to what they upload: it is stored under your deal, visible only within the scope you set, and it is your data to manage, export, or delete.

Probity is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. If you believe a child has provided us information, contact hello@useprobity.com.

We may update this policy as the product or the law changes. If we make a material change, we will notify active account holders by email and post the updated policy here with a new draft or effective date at the top. Continued use of Probity after a change takes effect means you accept the updated policy.

Questions about this policy, or to exercise any of the rights above: hello@useprobity.com.