Probity Privacy Policy

Account information

Name, email address, and password (if you sign in with email) or the limited profile information Google or Microsoft provides when you sign in with those providers (see "Sign-in with Google or Microsoft" below). If you invite a team member, adviser, or seller into a deal, we collect the email address you provide for them and, once they accept, their own name and sign-in information.

Payment information

If you subscribe to Deal Check or Deal Desk, or purchase Cash Proof, our payment processor, Stripe, collects your card number, billing address, and related payment details directly. Probity does not receive or store your full card number. We receive from Stripe a payment status, a partial card identifier (such as the last four digits and card brand), billing history, and transaction identifiers, which we use to manage your subscription and provide receipts.

Documents you upload

The core of the product is a place to upload and analyze documents about a business you are evaluating: tax returns, financial statements, bank statements, general ledgers, contracts, payroll records, and similar files. These documents frequently contain personal information about people who are not Probity users: the seller, the seller's employees, the seller's customers or vendors named in contracts, and others. We store these documents as you provide them and process them to generate the analyses you request. See "Documents about other people" below for how we treat this category of data and what it means for you as the person who uploaded it.

Deal journal, notes, and pipeline data

Notes you write about a candidate business, status you set on your pipeline and diligence checklist, and any tags, flags, or comments you add.

Browser clipper data

If you use the Probity browser clipper or bookmarklet to save a listing from a business-for-sale marketplace, we store the listing information you clip (title, location, asking price, revenue, cash flow, URL, and similar fields) into your pipeline.

Forwarded emails

We offer two kinds of private forwarding address. Deal Desk subscribers may set up a listing-alert address (for example, deals-x7k2@in.useprobity.com) and forward marketplace and broker listing alerts to it; each listing becomes a candidate in your Screened inbox. Each deal with Deal Desk or Cash Proof can also have its own address (for example, deal-m4p9@in.useprobity.com); documents forwarded to it are stored as documents on that deal. We receive and process only what arrives at these addresses: sender, subject, body text, and attachments. A file attached to an email sent to the listing-alert address is held with the candidate it belongs to until you add that candidate to your pipeline, where it becomes a document on the deal, or dismiss it, in which case the file is deleted 30 days after dismissal. We do not connect to, read, or access your email account or mailbox by any other means, and we never request your email password. See the Sourcing Agent description on our pricing and product pages for how this feature works.

Usage and device data

Standard web and application logs: IP address, browser type, device type, pages and features used, timestamps, and error logs. We use this to operate, secure, and improve the product, and to enforce the usage limits described in our Terms of Service.

When the product hits an error, our error monitoring provider, Sentry (Functional Software, Inc.), receives an error report: the error message, the page or feature where it happened, technical details about your browser or our server, and your account's user id. We remove email addresses, request headers, cookies, request bodies, and query strings before a report is sent, and we do not use session replay or screen recording. We use these reports to find and fix failures.

Visit log and where you came from

When you load one of our public pages (the home page, pricing, guides, sample deal, calculators, legal pages, and the sign-up page), our own server records one row: the page path, the date, where you came from (the website that linked you here, or the utm_source, utm_medium, utm_campaign and utm_content values and any ref code in the link you clicked), and a visitor code. The visitor code is a one-way hash of your IP address, your browser type and the date, mixed with a secret key. It changes every day, so it lets us count distinct visitors within a day but cannot follow you from one day to the next, and we do not store your IP address in this log. Obvious crawlers and bots are not recorded. We use this to learn which channels bring visitors and sign-ups. We keep these rows for 13 months and then delete them. We do not send this log to any third party. The advertising pixels described under "Cookies and similar technology" are separate and run in your browser, not from this log.

Where your account came from

The first time you load a public page, we save a small first-party cookie (described below) that remembers where you first came from. When you create an account, we copy that into your account record: the source, campaign and invite code, the first page you landed on, and the date of your first visit. If you type an invite code before checkout, we check it with Stripe and store it with your subscription. We also attach the source and invite code to your checkout, so that a payment can be matched to the channel that brought you. This record is deleted when you delete your account. It is not sent to the advertising pixels described under "Cookies and similar technology" and is not shared with any third party.

Cookies and similar technology

We use strictly necessary cookies to keep you signed in, to sign you out automatically after two hours without activity or twelve hours after you sign in, and to protect the application against cross-site request forgery. We set one preference cookie only if you choose to hide the sample deal from your pipeline view. We set one first-party attribution cookie, named pb_ft, on your first visit to a public page. It holds the source, campaign and invite code from the link you arrived by, the first page you landed on and the date, it lasts 90 days, it is HttpOnly (page scripts cannot read it), and it is sent only to useprobity.com. It is not a strictly necessary cookie: if you block it, the site and sign-up work the same and your account is simply recorded without a source. We do not set it at all for visitors in the European Union, the rest of the European Economic Area, the United Kingdom or Switzerland. Our website analytics (Vercel Web Analytics, on the public marketing pages only) do not use cookies. Our sign-in and sign-up pages use Cloudflare Turnstile, a security check that tells people apart from automated scripts. Other than the advertising pixels described below, we do not use third-party advertising or cross-site tracking cookies.

Advertising pixels. On our public marketing pages (home, pricing, guides, sample deal, checklist, calculator, about, sign-up, and our advertising landing page) we use the Meta Pixel (Meta Platforms, Inc.) and the Reddit Pixel (Reddit, Inc.) to measure our ads and to show Probity ads to people who visited those pages. After you scroll, click, type, or keep one of these pages open for a few seconds, the pixel sends Meta and Reddit the page you viewed, your IP address and browser details, and a cookie or device identifier. When you create an account, it also tells them that a sign-up happened; it does not send your name, email address, or anything about your deals or documents. We do not load these pixels inside the signed-in app, on seller upload links, or on invitation pages. We load them only for visitors in the United States: they do not load anywhere else, including when we cannot tell where a visitor is. You can opt out through your browser's tracking controls, Meta's ad settings (facebook.com/adpreferences), Reddit's settings (reddit.com/settings/privacy), or the Digital Advertising Alliance opt-out (optout.aboutads.info). Because these pixels can count as "sharing" for targeted advertising under some state laws, we also honor the Global Privacy Control signal (see section 11). Some browsers also send a "Do Not Track" signal. There is no common standard for how a website should respond to it, so we do not change what we collect when we receive one; Global Privacy Control is the signal we honor.

If you choose to sign in with Google or Microsoft, we request only the authentication scopes needed to confirm your identity and email address (your name, email address, and profile photo, where the provider makes it available). We do not request, and do not have, access to your Gmail, Outlook, Google Drive, OneDrive, calendar, or any other data in your Google or Microsoft account. This is separate from and unrelated to the Sourcing Agent's email forwarding address described above, which requires no account connection at all.

We use the information above to:

• Provide the account, pipeline, deal journal, and staged diligence checklist you use whether or not you subscribe to Deal Check or Deal Desk.
• Run the analyses you request: the SDE Recast (tax return analysis), Cash Proof (bank statement analysis), spread refresh, and related outputs, using the AI processing described in section 4.
• Process payments and manage your subscription or Cash Proof purchase through Stripe.
• Operate the invited-user features: seller and broker upload links, and team member access for your attorney, CPA, lender, or other advisers, scoped to what you authorize.
• Secure the product: detect abuse, enforce the per-user rate limits and storage caps described in our Terms of Service, and investigate suspected fraud or violations of our Acceptable Use Policy.
• Send you service messages: sign-in links and password resets, purchase confirmations, billing and security notices, and the confirmation of an account or deal deletion.
• Send the notification emails you ask for. If you ask to be emailed when an analysis finishes, we send one message to your sign-in address.
• Send a verification code to the seller or broker you invite to upload documents, at the address you give us, so they can open the upload link.
• Comply with legal obligations, including responding to lawful requests from courts or regulators.

We do not use your account data, uploaded documents, or journal content to train our own products, and we do not sell your personal information for money. See section 11.

When you use any of the features below, Probity sends the relevant document text, file, or pasted text to Anthropic, our AI provider, through Anthropic's commercial API, to generate the result:

• SDE Recast and spread runs and refreshes, including the suggested groupings and tags for the lines of a recast.
• Cash Proof: your bank statements and the seller's profit and loss statements.
• Reading a CIM, and reading add-backs from a CIM or an add-back schedule.
• Identifying an uploaded document from its first pages when its contents are otherwise unclear.
• Screening a listing against your buy box, including listings from forwarded alert emails and listing text you paste in, and drafting questions for the broker.
• Checking a seller's NDA, including reading a scanned copy.
• The AI-Leverage Assessment of a deal.
• Q&A questions about a deal, visit question sets, and debrief summaries.
• Reading a request list you upload as a PDF or Word file or paste in as text.

The forecast is calculated from the recast and your own assumptions. It sends nothing to Anthropic.

Only the documents and context relevant to that specific deal and that specific request are sent; we do not send another user's data, and we do not send your entire account to Anthropic on every request.

Per Anthropic's published commercial terms, Anthropic does not train its models on API customer content by default, and content submitted through the commercial API is treated as the customer's confidential information under those terms. We have not independently audited Anthropic's infrastructure and are relying on Anthropic's own public representations, which are available at https://www.anthropic.com/legal/commercial-terms and https://www.anthropic.com/legal/privacy (also see our Subprocessors page for the current version of these terms we rely on).

Anthropic's published data retention policy for its commercial API states that inputs and outputs are deleted within 30 days of the request, except where Anthropic is legally required to keep them or they are flagged for a review of possible misuse. We rely on that published policy and have not arranged a shorter or zero-retention term. If this changes, we will update this policy and the Subprocessors page before the change applies to your documents.

AI-generated analyses can be incomplete or wrong. They are informational tools, not a substitute for your own review or for advice from your attorney, CPA, or lender. See the Terms of Service for the full disclaimer.

We use a small number of service providers (subprocessors) to run Probity. Each one processes only the data needed to perform its function, under a contract that requires it to protect that data. The current list, with purpose, data categories, and region, is on our Subprocessors page. Our subprocessors are Supabase (database and file storage, and sign-in, including the sign-in link and password-reset emails it sends), Vercel (application hosting and cookieless website analytics), Anthropic (AI analysis), Cloudflare (DNS and email routing for the Sourcing Agent, and bot protection on our sign-in and sign-up pages), Google and Microsoft (sign-in only), Stripe (payment processing), Resend (the account and service emails we send: analysis notices, purchase confirmations, account-deletion confirmations, and verification codes for the sellers and brokers you invite), Sentry (error monitoring), Cloudmersive (virus and malware screening of uploaded files), and Meta Platforms and Reddit (advertising pixels on our public marketing pages). We will update the subprocessor list before adding or replacing a subprocessor that touches your data.

• Invited users. If you invite a seller, broker, or adviser into a deal, they see only what you authorize them to see (see the Terms of Service and the Invited User Terms for the scope of their access).
• Service providers. The subprocessors listed above, under contracts limiting their use of your data to providing their service to us.
• Legal requirements. We disclose your uploaded documents, deal notes, journal entries, and Q&A content only when a law, subpoena, or court order requires it, and we will tell you before we disclose unless the law prohibits notice, so you have the chance to object. Other account information (such as your name, email address, and sign-in records) may also be disclosed if we believe in good faith that disclosure is necessary to prevent imminent physical harm or to investigate fraud or abuse of Probity.
• Business transfers. If CrestPoint Ventures LLC is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy or a successor policy of which you will be notified.
• With your direction. Any other sharing you specifically request, such as a lender export you choose to send outside the product.
• Our professional advisers. Our own lawyers, accountants, and insurers, under duties of confidentiality, when they need account or billing information to advise us or to handle a claim. This never includes your uploaded documents, deal notes, journal entries, or Q&A content, which are covered by the rule below.

We do not sell personal information for money and do not share it with data brokers. The advertising pixels described under "Cookies and similar technology" are covered in section 11.

Who at Probity sees your documents. No one at Probity opens or reads your uploaded documents, deal notes, journal entries, or Q&A content unless you ask us to (for example, to help with a support request), a law requires it as described above, or we need to investigate a security incident affecting your account. Automated processing that runs the analyses you request is not a person viewing your content.

Other websites. Probity links to websites we do not operate, including the business-for-sale marketplaces your clipped listings come from and the sign-in and payment pages of Google, Microsoft, and Stripe. Their own privacy policies apply when you use them, and we are not responsible for their practices.

• Active accounts. We keep your account data, uploaded documents, and journal content for as long as your account is open, so the product continues to work as you expect.
• Deletion on request. You can delete a document, a deal, or your entire account from within the product, or by writing to hello@useprobity.com. Deleting a document or deal removes it from active storage and from any future analysis. Deleting your account removes your account data and uploaded documents from active storage; some records (such as billing history we are required to keep for tax and accounting purposes, or records needed to resolve an open dispute) may be retained longer, as described below.
• Billing and tax records. We keep invoices, payment and refund records, the Stripe transaction identifiers that go with them, and the record of your acceptance of the Terms of Service and this policy for seven years after the transaction or, if later, after your account closes, to meet tax, accounting, and audit obligations and to resolve payment disputes. These records hold your name, email address, billing history, and a partial card identifier, never your full card number, which only Stripe holds.
• Forwarded attachments on a dismissed candidate. A file attached to an email forwarded to your listing-alert address and held with a Screened candidate is deleted from storage 30 days after you dismiss that candidate, if you never added it to your pipeline.
• Cash Proof read-only retention. A Cash Proof purchase includes 12 months of post-close access to the converted "company room," during which your documents remain available to you and any team members you keep active. If you kill a deal and transfer your Cash Proof slot to a new deal (as described in the Terms of Service), the killed deal's documents remain stored in read-only form for the remainder of your slot's active period, so you retain a record of what you reviewed.
• Backups and point-in-time recovery. Our hosting provider maintains routine backups for disaster recovery, independent of your in-product deletion actions. Deleted data is removed from active storage immediately but may persist in backup copies for up to 30 days before those backups age out and are overwritten in the ordinary course of our provider's backup cycle. We do not restore an individual deleted item from backup except to recover from a system failure, and backup copies are not used for any purpose other than disaster recovery.
• Legal holds. We may retain specific records longer than the periods above if we are notified of a legal claim, subpoena, or regulatory inquiry that requires preservation.

We use industry-standard safeguards appropriate to the sensitivity of diligence documents:

• Row-level security on every database table, so your data is scoped to your account by default, in addition to server-side authorization checks on every action.
• Encryption in transit (TLS) and at rest for documents and account data.
• Time-limited signed URLs for document access, rather than permanent public links.
• Audit logging of AI analysis calls, and, as our audit trail features expand, of document views and downloads.
• Per-user and per-account rate limits and spend controls on AI processing, so a single account cannot be used to run up unbounded costs or extract data at scale.
• Automatic sign-out after two hours without activity, and twelve hours after sign-in in any case.

No system is perfectly secure, and we cannot guarantee that unauthorized access, loss, or misuse of information will never occur. If we learn of a security incident affecting your personal information, we will notify you and any applicable regulator as required by law.

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect about you, to request deletion, to request correction of inaccurate information, to request a portable copy of your data, and to opt out of the sale or sharing of personal information and of certain profiling. We do not sell personal information for money. The advertising pixels described under "Cookies and similar technology" may count as "sharing" under the CCPA/CPRA, and you can opt out as described there (see section 11). To exercise any of these rights, contact hello@useprobity.com or write to us at the mailing address in section 15. We will verify your request using your account email before responding. You will not receive discriminatory treatment for exercising a privacy right. You may also use an authorized agent to submit a request on your behalf; we will ask the agent for proof of your signed permission and may ask you to confirm the request directly.

Other US state privacy laws

As of 2026, the following states have comprehensive consumer privacy laws in effect that may apply to Probity's processing of your personal information, in addition to California. Rights are broadly similar across these laws: access, correction, deletion, data portability, and opt-out of targeted advertising, sale, and certain profiling. Some laws (noted below) also give you the right to appeal a denied request.

Most of these laws apply only to businesses that meet a revenue or data-volume threshold (for example, controlling personal data of a set number of state residents in a calendar year). This policy describes the rights available under each law without representing that Probity currently meets every state's applicability threshold at our size. Where a law applies to us, we will honor its rights and appeal process; where it does not yet apply, we intend in practice to honor the same request process for every resident who asks, regardless of state, as a matter of consistency rather than legal obligation.

To exercise a right under any of these laws, email hello@useprobity.com from your account email address. We will respond within the time period the applicable law requires (generally 45 days, with one 45-day extension available where the law allows it). You may designate an authorized agent to submit a request on your behalf, subject to verification.

Right to appeal

If we deny your request under a state law that provides an appeal right (this includes Colorado, Connecticut, Virginia, Montana, Oregon, Texas, Delaware, Iowa, Nebraska, New Jersey, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island as of 2026), you may appeal by replying to our denial email within a reasonable time. We will respond to your appeal within 45 days (60 days in states that provide for that period). If we uphold the denial, we will tell you how to submit a complaint to your state attorney general or applicable regulator.

Sensitive personal information

Documents you upload, especially tax returns, payroll records, and bank statements, often contain information that state privacy laws treat as sensitive, such as Social Security numbers, taxpayer identification numbers, and financial account numbers. We process it only to store and protect your documents and to run the analyses you request, and we do not use it to infer characteristics about anyone. Our analyses do not need Social Security numbers, so you are welcome to redact them before you upload. The CCPA/CPRA lets us use sensitive personal information for these purposes without offering an opt-out, so we do not provide a separate "Limit the Use of My Sensitive Personal Information" link. If we ever use sensitive personal information for another purpose, we will add that link and update this policy first.

Profiling and automated decisions

Probity analyzes the finances of a business you are evaluating. We do not use personal information to profile people or to make decisions about them that produce legal or similarly significant effects, such as decisions about credit, employment, housing, insurance, or access to essential services. The Terms of Service prohibit using Probity's outputs to make credit or employment decisions about a consumer.

Probity is a US product hosted in the United States, and most of our users are in the United States. If you access Probity from the European Economic Area, the United Kingdom, or another jurisdiction with its own data protection law, this section applies to you in addition to the rest of this policy.

Who is the controller. For your own account data (your name, email, notes, and the documents you upload), CrestPoint Ventures LLC is the controller. For personal information about third parties contained in documents you upload (a seller's tax return, an employee list), you are the controller and Probity acts as a processor on your instructions; see "Documents about other people" below.

Legal basis for processing. We process your account data to perform our contract with you (providing the service you signed up for), and we process usage and security data based on our legitimate interest in operating and protecting the product. We keep billing and tax records because the law requires us to. Where we rely on consent (for example, for a cookie or communication that is not strictly necessary), you may withdraw that consent at any time.

International transfer. Your data is transferred to and processed in the United States. Where required, we rely on the standard contractual clauses approved by the European Commission, and the UK's International Data Transfer Addendum, as the transfer mechanism with our subprocessors, or on another lawful transfer mechanism available to us. You may ask for a copy of the safeguards we rely on by writing to hello@useprobity.com.

Your rights. In addition to the rights described in section 9, you have the right to ask us to restrict our processing of your personal data, to object to processing we base on our legitimate interests (and, at any time, to processing for direct marketing), and to withdraw any consent you have given, without affecting processing that took place before you withdrew it. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

EU/UK representative. Probity has not appointed a representative in the EU or the UK. EEA and UK users should direct requests to hello@useprobity.com.

We do not sell your personal information for money. Our use of the Meta Pixel and Reddit Pixel on public marketing pages (see "Advertising pixels" under "Cookies and similar technology") may count as "sharing" for cross-context behavioral advertising under the CCPA/CPRA, and as targeted advertising under some other state laws. Apart from those pixels, we do not run cross-site advertising.

Your privacy choices. The Meta and Reddit pixels load only for visitors in the United States, and never when your browser sends Global Privacy Control. Outside the United States they do not load at all.

How to opt out of this sharing. Turn on Global Privacy Control in your browser or a browser extension. When your browser sends that signal, our pages do not load the Meta or Reddit pixels for it. Brave and the DuckDuckGo browser send the signal by default. In Firefox, open Settings, then Privacy & Security, and turn on "Tell websites not to sell or share my data". In other browsers, an extension such as Privacy Badger or DuckDuckGo Privacy Essentials sends it. More about the signal is at globalprivacycontrol.org. You can also use your browser's tracking controls, Meta's or Reddit's ad settings, or the Digital Advertising Alliance opt-out listed under "Advertising pixels." The pixels never load inside the signed-in app, so using Probity while signed in shares nothing with Meta or Reddit. The pixels identify a browser, not a named person, and we keep nothing that links a browser's pixel activity to your account, so an opt-out has to be set in the browser itself. Questions about opting out: hello@useprobity.com.

If we expand advertising beyond these pixels, we will update this policy first and provide a "Do Not Sell or Share My Personal Information" link where the law requires one. We will not apply that change to data already collected without your consent.

Probity is built for a specific situation: you, the buyer, are collecting documents about a business you do not yet own, from a seller you are usually bound to by a non-disclosure agreement. Many of those documents (tax returns, payroll records, bank statements, employee files) contain personal information about people who have never used Probity and never agreed to this policy: the seller, the seller's employees, customers named in contracts, and others.

Preferred basis: seller-direct upload. Wherever possible, we ask the seller or the seller's broker to upload documents directly, through a link you send them. Before their first upload, the seller or broker accepts the Invited User Terms, which include their own consent to have the documents stored in Probity and analyzed for you (see the Invited User Terms). Where a document comes in this way, the seller's own consent is the basis for our processing of any personal information it contains, in addition to your responsibilities below.

Your responsibilities as the uploader. If you upload a document yourself rather than through the seller-direct path, you are responsible for having the right to upload it, whether that right comes from the seller's consent, the terms of your NDA, or another lawful basis. Before your first upload on each deal, we ask you to confirm that your NDA or the seller's consent permits you to store and analyze the seller's documents in third-party software, including AI-assisted analysis; that confirmation is also a warranty under the Terms of Service. You are responsible for complying with any confidentiality obligation you owe the seller, and for using the personal information in these documents only for the purpose you obtained it (evaluating and, if you proceed, closing the acquisition). Probity is not a party to your NDA with the seller and has no visibility into its terms.

NDA checker. If you use Probity's NDA checker to review your own NDA for upload restrictions, the NDA document you submit is analyzed and is not kept as a deal document by default; only the resulting flags and the clause excerpts quoted in them are stored against your deal. The checker's results are informational, not legal advice, and are described further in the Terms of Service, section 5.

Our role for this category of data. For personal information about third parties contained in the documents you upload, Probity acts as a service provider or processor, not as an independent controller: we store and process this information to provide you the analysis you requested, and we do not use it for our own purposes, sell it, or disclose it except as this policy describes. If a third party named in a document you uploaded contacts us directly about their information, we will generally direct them to you as the party who controls that data, consistent with our role as a processor for this category.

Seller and broker uploads. If you invite a seller or broker to upload directly onto your deal using the seller upload link (available on every deal, not only one with Cash Proof), the same rules apply to what they upload: it is stored under your deal, visible only within the scope you set, and it is your data to manage, export, or delete.

Deletion confirmation. If you delete an entire deal, we issue a dated confirmation listing what was deleted, intended to help you document a return-or-destroy obligation to the seller; see the Terms of Service, section 14.

Probity is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it. We have no actual knowledge of selling or sharing the personal information of anyone under 16. If you believe a child has provided us information, contact hello@useprobity.com.

We may update this policy as the product or the law changes. If we make a material change, we will notify active account holders by email and post the updated policy here with a new date at the top. Continued use of Probity after a change takes effect means you accept the updated policy.

Questions about this policy, or to exercise any of the rights above: hello@useprobity.com.

By mail: CrestPoint Ventures LLC, Attn: Probity, 9169 W. State St., #4017, Garden City, ID 83714.