Privacy Policy

Information users provide

Account information. Name, email address, and the authentication identifier from the sign-in provider used to create the account.

Deal information. The acquisition workspace: deal name, expected closing date, stage, notes, and the operational assets and findings recorded against it.

Business information. The business being transferred — legal and trading name, location, vendors, domains, and the accounts and services entered or discovered.

Participant information. The email addresses and roles of the people invited to a deal, so the platform can apply the right permissions to each of them.

Connected email access

A seller may connect a mailbox so that Acqufio can discover the operational accounts a business depends on — the vendors that invoice it, the services it renews, the registrar that holds its domain. Connecting a mailbox is optional and is always initiated by the mailbox owner.

Permissions requested

• Google — gmail.readonly. Read-only access to messages and their metadata.
• Microsoft — Mail.Read. The equivalent read-only permission, where the Outlook integration is enabled.

Acqufio never requests send, modify, or delete scope, and never asks for more scope than the current feature needs. No calendar, contacts, or file permissions are requested.

Connecting a mailbox and approving a scan are two separate actions, logged separately. No scan runs until the seller explicitly approves one, and every scan is bounded to a stated date window shown to the seller beforehand.

What Acqufio reads

Within an approved scan window, Acqufio queries the mailbox for messages that look like vendor, billing, and service correspondence, and reads from each matching message:

• message headers, including sender and recipient addresses;
• subject line and date;
• the message snippet returned by the provider;
• the message body, where the body is needed to identify a vendor, an account, a renewal date, or an ownership signal.

Message bodies are processed in memory during the scan and then discarded. There is no message-body column in the evidence store — a body is read for extraction and never written down. See what Acqufio stores.

Attachments are not downloaded. Nothing outside the approved scan window is read.

What Acqufio stores

Acqufio distinguishes raw source data from the extracted operational information the product is actually about.

Extracted operational information — stored

Vendor and service names, account descriptors, category, cost and billing cadence, renewal dates, ownership and transfer signals, severity, provenance label, and review status. Payment methods are stored only as a label — “Visa ending in 1234” — never as a number.

Evidence records — stored, seller-only

Message headers, sender address, subject, date, and a short snippet, kept in plaintext so a finding can be traced back to the evidence that produced it. These records are scoped to one deal and swept by the retention policy.

Refused — never stored

Vendor passwords, in any form and for any reason. Full card or bank account numbers. Government identifiers. Message bodies. Attachments. Mailbox contents outside a deal’s approved scan window.

When a credential has to change hands, Acqufio records that it must be rotated and instructs the parties to do it directly with the vendor. The platform is not a credential store.

Mailbox access and refresh tokens are encrypted at rest with AES-256-GCM and are used only to run discovery for the deal the mailbox was connected to.

What buyers and brokers can see

Connected mailbox contents are never exposed to other deal participants. The split is enforced in code and asserted by the test suite:

Seller

The only party who can read raw evidence. It is their correspondence.

Broker

Summaries only — counts, vendor, the sender’s domain, and dates. No subjects, no snippets.

Buyer

No evidence and no inventory browser. Everything a buyer learns arrives through a report the seller deliberately shares.

No combination of non-seller roles yields evidence access, because no non-seller role contains it. A share link carries read access to one report and nothing else, for every audience.

Permissions are per participant and per deal, and are read from the database on every request rather than cached in a session. Removing a participant takes effect on their next request.

AI processing

Acqufio uses a third-party large language model to turn message content into structured operational information. Message text from a matching message — headers, subject, and the body content held in memory during the scan — is sent to Anthropic’s API for that extraction. Model reasoning traces are not stored.

Anthropic acts as a subprocessor for this step. Acqufio does not use customer data to train models.

Anything the model produces is labeled AI inferred until a person or a vendor establishes it. The platform does not promote an inference to a confirmed fact on its own.

Data retention

Deal data, operational assets, and findings are retained for as long as the deal workspace exists, because the Business Handoff Report is a versioned transaction artifact that participants may need after closing.

Message bodies are not retained after extraction. Evidence records — sender, subject, date, snippet — are retained with the finding they support and are swept by a retention policy. Each report records what was kept and when a snippet was purged, and surfaces both in its methodology section.

A deal owner can request deletion of a deal and its data by writing to info@acqufio.com.

Revoking access

A seller can disconnect a mailbox inside Acqufio at any time. Disconnecting deletes the stored access and refresh tokens and stops all further discovery against that mailbox.

Access can also be revoked outside Acqufio, at Google Account → Third-party apps or, for Microsoft accounts, in the Microsoft account permissions page. Revocation there takes effect immediately and independently of Acqufio.

Operational assets and findings already created and reviewed remain in the deal after disconnection, since they form part of the report the participants rely on. Deleting them is a separate request.

Security

Mailbox tokens are encrypted at rest with AES-256-GCM. Account passwords are hashed with bcrypt. Invitation and report-share links are stored as SHA-256 hashes only — the link itself is shown once and cannot be recovered from the database.

Every server path that touches deal data checks the caller’s permission on that specific deal before it reads anything, and scopes every query to it. A refusal is indistinguishable from a record that does not exist, so deal identifiers cannot be probed. Report and deal reference numbers are human-facing identifiers and confer no access on their own.

The audit log is append-only, with no update or delete path in the application, and secret-looking values are stripped before a row is written. Consequential outbound actions to a vendor record who confirmed them before the call is made.

Acqufio does not hold a SOC 2 report or any other third-party security certification at this time, and does not claim one.

Data sale

Acqufio does not sell personal data. Acqufio does not share deal or mailbox data with advertisers, data brokers, or any party other than the subprocessors listed below.

Subprocessors

Contact

Questions about this policy, or a deletion request: info@acqufio.com