1. Account security checks
We use Cloudflare Turnstile on account forms to help detect automated abuse. Cloudflare may process browser and connection information for this security check. This does not connect your calendar, change your email provider or give Cloudflare access to your private member workspace.
When you choose a new password through our signup or password-reset form, our server checks it against Have I Been Pwned's Pwned Passwords service. That service receives only the first five characters of a password hash, not your password, full hash, email address or account identity. We compare the result on our server and do not retain the lookup result or password in application logs. This form-level check does not scan or change existing passwords.
2. Who we are and what this policy covers
not.a.broker (“we,” “us,” and “our”) provides a membership platform for business acquisition research, seller information, related workspace tools, and the separate Targeted Search service. This policy covers information handled through notabroker.io, your account, business submissions, service applications and deliveries, and communications with our team. It applies to visitors, members, business owners, and people whose business contact information appears in our research or listings.
Other websites, independent buyers and sellers, and third-party services have their own privacy practices. Our Terms of Use explain the rules for using the platform; this policy explains our information practices.
3. Information we collect
Account and contact information: your name, email address, buyer or company name, account identifiers, authentication details, profile preferences, and information you provide when asking for help. If social sign-in is available and you choose it, the identity provider supplies information such as your account identifier, name, and email address under the permissions you approve.
Company membership information: company roles, named seat assignments, invitations and their email addresses, acceptance or expiry, access changes and who made them, purchased seat capacity and associated billing records. We use these records to deliver individual access, manage invitations and prevent shared or unauthorized sign-ins.
Availability waitlist: if you opt in, we store your email address, interest in a new membership or extra seats, and the request and consent dates. Authorized staff use this information to contact you about availability. Joining the waitlist does not enroll you in other marketing, reserve capacity, or trigger a charge. You can ask Support to withdraw your availability request.
Workspace and business information: research records, saved companies or leads, searches, notes, source links, acquisition interests, business submissions, and updates. Submissions and listings may include owner or representative names, business contact details, location, industry, financial ranges, employee ranges, seller context, and information about a potential sale. We also obtain business information from public sources, business representatives, research, and communications with owners.
Targeted Search information: the situation and search criteria you provide, such as industry, location, budget and goals; application, approval and service dates; subscription identifiers, payment status, paid periods and cancellation settings; custom research prepared for your search; and communications needed to coordinate the service. When you arrange appointments or check-ins with our team, this may also include the business contact information, availability and appointment details you choose to provide. Do not include calendar passwords or unnecessary sensitive information in your application.
Access-code applications: the code you apply, a hash of your normalized email address, quoted signup discount, first-application time and expiry. Account metadata also carries display details for your confirmation email and an application reference. We use the confirmed account email and private application record to check eligibility and pricing; signup applications do not reserve a paid use. Successful payments and temporary checkout reservations determine code availability.
Billing and communication information: subscription status, billing identifiers, invoices, payment history, support messages, email preferences, and delivery or complaint records. Stripe processes payment details through its payment interface. Our application does not receive or store full card numbers or card security codes.
Technical and activity information: IP addresses or identifiers derived from them, browser and device information, request and security logs, session information, and interactions needed to operate features. For eligible membership follow-ups, we record signup, checkout, and payment-form interaction timestamps, not the contents of payment fields.
4. How we use information
We use information to create and secure accounts, deliver the features included in your membership, review Targeted Search applications, provide private research deliveries and coordinate agreed appointments and check-ins, organize research and seller submissions, process membership and service payments, respond to support requests, maintain records, investigate abuse, and improve the service. We also use it to communicate about account access, confirmations, security, billing, and service changes.
Promotional membership emails are separate from operational messages. Where you opt in, we may send offers and relevant follow-ups. You can change your email preferences or use an unsubscribe link. Opting out of promotions does not stop necessary account, security, support, or billing messages.
Where a legal basis is required, we process information as necessary to provide requested services, meet legal obligations, pursue legitimate interests such as security and business administration, or act on your consent where required. You may withdraw consent for future consent-based processing without affecting processing already lawfully completed.
7. Retention and security
We retain information for as long as reasonably needed to provide the service, maintain account and transaction records, resolve disputes, prevent misuse, and satisfy legal obligations. Retention depends on the type of information and why it was collected. Closing an account or canceling a subscription does not automatically erase every record; billing, security, legal, and backup records may need to be retained longer.
Ending a Targeted Search term or membership does not automatically delete your application, Support history or existing research records, and it does not promise indefinite hosted availability. You may keep research provided to you for the use permitted by the Terms of Use. Contact support about account records or retention requests; copies provided to you are under your control.
We use technical and organizational safeguards, including authenticated access and restrictions on organization and member data. No website, storage system, or transmission method can be guaranteed completely secure. Keep your credentials private and notify us if you suspect unauthorized access.
8. Your choices and privacy requests
You can update available profile and email preferences in your account. To request access, correction, deletion, a copy of your information, or restriction of its use, email support@notabroker.io. Business owners and contacts can also ask us to review inaccurate or inappropriate information in a listing. Include enough detail to identify the relevant account or record; do not send passwords or full payment details.
Depending on your location and the law that applies, you may have rights to portability, objection, withdrawal of consent, an opt-out of certain disclosures or targeted advertising, and appeal of a request decision. We may verify identity or an authorized agent’s authority before responding. Some information may be withheld or retained where permitted or required by law, including to protect other people’s information. We respond within applicable legal time limits and do not unlawfully discriminate against you for exercising your rights.
If you disagree with our response, reply requesting a review. You may also have the right to contact the privacy regulator or supervisory authority where you live. Information already independently collected by another member or external website may need to be addressed with that party directly.
9. International use and age requirements
Our service and providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where required, international transfers must be subject to appropriate legal safeguards.
The service is intended for adults aged 18 or older. We do not knowingly seek personal information from children. If you believe a child has provided information to us, contact support so we can investigate and take appropriate action.
10. Updates and contact
We may update this policy as the service or our practices change. The date at the top identifies the current version. We will provide additional notice of material changes where required and obtain consent where applicable law requires it. For privacy questions or requests, contact not.a.broker at support@notabroker.io.