Privacy Policy
Effective Date: May 8, 2026 · Last Updated: May 8, 2026
1.Introduction
Acquisera LLC (“Acquisera,” “we,” “us,” or “our”) operates the Acquisera platform, a software-as-a-service application that enables corporate development professionals, private equity firms, investment banks, and other qualified subscribers to identify, research, and contact potential acquisition and merger targets (the “Service”).
This Privacy Policy describes how Acquisera collects, uses, stores, shares, and protects information in connection with the Service. It applies to all users of the Service, including individuals who create accounts, employees and authorized users of subscriber organizations, and visitors to acquisera.com.
By creating an account or accessing the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, you must not access or use the Service.
This Privacy Policy does not govern our use of cookies or tracking technologies, which are addressed in our separate Cookie Policy. Our obligations under the General Data Protection Regulation and other privacy and electronic marketing frameworks are set out in Section 9.
2.Who We Are
Acquisera LLC is the data controller for personal information collected through the Service. For questions regarding this Privacy Policy or your personal data, please contact us at:
Acquisera LLC1658 N Milwaukee Ave, Suite 297
Chicago, IL 60647
Email: support (at) acquisera.com (subject line: PRIVACY:)
3.Information We Collect
We collect information in the following categories:
3.1Account and Registration Data
When you create an account, we collect: full name; email address; company name and title; profile photograph (if uploaded); organization and team membership information; and account credentials (passwords are hashed and never stored in plaintext).
3.2Subscription and Billing Data
When you subscribe to a paid tier, we collect: subscription tier and billing history; payment method information; billing address and contact information; and records of add-on purchases and usage. Credit card details are collected and processed directly by Stripe, Inc. and are not stored on Acquisera's systems. For Managed tier subscribers using ACH direct debit, bank account information is collected and tokenized by Stripe.
3.3Usage and Platform Data
When you use the Service, we automatically collect: search criteria and parameters; pipeline runs initiated including tier used and companies delivered; projects created and their associated search history; email templates created and outreach activity; financial models created and saved; feature access patterns and session activity; log data including IP address, browser type, operating system, and timestamps; and error reports and diagnostic data.
3.4Communications Data
We collect information when you contact our support team, respond to surveys or feedback requests, or correspond with us by email.
3.5Third-Party Contact Data Sourced Through the Pipeline
Acquisera's pipeline surfaces publicly available professional contact information pertaining to individuals at companies identified as potential acquisition or merger targets. The scope, permitted use, and individual rights with respect to this data are governed exclusively by Section 6 of this Policy.
4.How We Use Your Information
Acquisera uses the information we collect for the following purposes:
4.1To Provide and Operate the Service
Creating and managing your account; processing and executing pipeline searches; delivering company and contact research results; enabling email outreach functionality; providing access to financial modeling and public company data tools; and managing subscription tiers, quotas, and feature access.
4.2To Process Payments
Processing subscription payments and add-on purchases through Stripe; maintaining billing records and issuing receipts; and handling payment failures, renewals, and cancellations.
4.3To Communicate With You
Sending transactional emails including account verification, password reset, billing confirmations, and subscription notifications; providing customer support; and notifying you of material changes to this Privacy Policy or our Terms of Service.
4.4To Measure Delivery of Outreach Email
Outreach messages sent by a subscriber through the Service carry a small tracking image. When a recipient's mail client loads that image, Acquisera records that the message was opened and marks it as such in the sending subscriber's pipeline. We also receive delivery status from our email provider: delivered, delayed, bounced, or reported as spam.
What we do not do. We do not track which links a recipient clicks, do not rewrite the links in outreach messages, and do not record a recipient's location, device, or IP address from these events. Nothing recorded here follows anyone across websites, and it is never combined with third-party advertising data.
What an “open” is worth. Less than it appears, and we say so plainly because the number is visible in the product. Many mail providers fetch remote images automatically whether or not a person read the message, and Apple Mail Privacy Protection is the most notable of them. Corporate security scanners do the same. An open therefore indicates that a message was retrieved, not that it was read by a human.
Bounce and spam-complaint events are processed for a separate and narrower reason: to stop sending to an address that is rejecting mail or whose owner has objected. That processing is what makes an objection effective, and it happens regardless of whether open tracking is enabled. Delivery events are retained with the associated outreach record and are covered by the retention schedule in Section 7. To object to this processing, see Section 8.5; the suppression route in Section 6.6 removes an individual from future delivery entirely.
4.5To Improve the Service
Analyzing platform usage patterns to identify and fix bugs; improving pipeline accuracy and AI model performance; developing new features; and conducting internal security audits and performance monitoring.
4.6To Comply With Legal Obligations
Maintaining billing and financial records as required by law; responding to valid legal process; enforcing our Terms of Service; and protecting the rights, property, and safety of Acquisera, our subscribers, and third parties.
4.6Our Data Practices: What We Do and Do Not Do
What we do not do: Acquisera does not sell, rent, or license your personal information or your organization's data to any third party. We do not use your personal account data, billing information, email content, or search criteria to train artificial intelligence models. We do not use your data for advertising or marketing purposes on behalf of third parties. We do not share your data with any party except as described in Section 5 of this Policy.
What we do: Acquisera uses pipeline output data to improve the accuracy and performance of the Service. This covers company research results, enrichment data, and fit scoring outcomes produced by the pipeline. This data is used solely to improve the Service provided to all subscribers and is not shared with or sold to any third party for model training purposes. Your personal account data, billing information, and email content are never used for this purpose.
6.Third-Party Contact Data Sourced Through the Pipeline
6.1Nature of This Data
Acquisera's platform surfaces publicly available contact information pertaining to individuals employed at or associated with privately held companies identified as potential acquisition or merger targets (“Target Contact Data”). It includes names, titles, professional email addresses, and LinkedIn profiles. This data is sourced through automated research processes drawing on publicly available business directories, professional networks, and third-party data providers including those listed in Section 5.1.
6.2Strict Prohibition on Sale or Transfer
Acquisera does not sell, license, transfer, or otherwise make available Target Contact Data to any third party for any purpose, under any circumstances. Target Contact Data is made accessible exclusively to paying subscribers of eligible subscription tiers and is governed by the restrictions set forth in this Section 6.
6.3Permitted Use
Subscribers are authorized to access and use Target Contact Data solely for the purpose of initiating direct professional contact with identified individuals in connection with a bona fide proposed acquisition, merger, strategic partnership, or other corporate transaction involving the company with which the individual is associated (“Permitted Purpose”). No other use is authorized.
6.4Prohibited Use
Subscribers are expressly prohibited from:
- (i) using Target Contact Data for marketing, advertising, solicitation, or any purpose unrelated to a corporate transaction constituting the Permitted Purpose;
- (ii) reproducing, distributing, sublicensing, exporting, or transferring Target Contact Data to any third party, including but not limited to data brokers, marketing platforms, customer relationship management systems not used exclusively in connection with an active corporate transaction, or any other commercial data service;
- (iii) aggregating, compiling, or storing Target Contact Data outside of the Acquisera platform for purposes beyond a specific active transaction for which the contact was originally identified;
- (iv) using Target Contact Data in any manner that violates applicable law, including but not limited to the CAN-SPAM Act of 2003, the Telephone Consumer Protection Act, the California Consumer Privacy Act, or any applicable anti-spam, data protection, or electronic communications legislation; or
- (v) using Target Contact Data to harass, threaten, or engage in any unlawful conduct toward any individual.
Violation of this Section 6.4 constitutes a material breach of our Terms of Service and may result in immediate termination of access to the Service, in addition to any other remedies available to Acquisera at law or in equity.
6.5Legitimate Interests Basis
The collection and processing of Target Contact Data is conducted on the basis of legitimate interests, specifically the facilitation of lawful business-to-business corporate development activity, which is a recognized lawful basis for the processing of professional contact information under applicable law. In pursuing this legitimate interest, Acquisera takes reasonable steps to ensure that: (i) Target Contact Data is limited to professional contact details and does not include sensitive personal information; (ii) data is sourced from publicly available or commercially licensed professional sources; (iii) the volume of data processed is proportionate to the stated purpose; and (iv) processing is conducted in a manner that does not override the fundamental rights and interests of the individuals concerned.
6.6Individual Rights and Suppression Requests
Any individual who believes their professional contact information has been surfaced through the Acquisera platform and wishes to request its removal may submit a verified suppression request to support (at) acquisera.com with the subject line “PRIVACY: Contact Suppression Request.” Upon receipt of a complete and verified request, Acquisera will:
- (i) suppress the individual's contact information from future delivery to any subscriber within a commercially reasonable time not to exceed thirty (30) days from receipt of a complete request;
- (ii) flag the individual's information within our systems to prevent re-surfacing in subsequent pipeline runs; and
- (iii) notify the requesting party of the actions taken within the same thirty (30) day period.
Acquisera will not charge any fee for processing a suppression request. Acquisera reserves the right to verify the identity of the requesting party prior to taking action.
7.Data Retention
| Data Category | Retention Period |
|---|---|
| Account and profile data | Duration of account plus 30 days following deletion |
| Pipeline search history and results | Duration of the active subscription |
| Contact data surfaced by the pipeline | Duration of the active subscription, or upon suppression request per §6.6 |
| Email outreach records | Duration of the active subscription |
| Billing and payment records | 7 years from date of transaction (tax and legal compliance) |
| Security and access logs | 90 days |
| Support communications | 2 years from date of last communication |
When a subscription ends or an account is deleted, Acquisera will delete or anonymize the associated data within 30 days, except where longer retention is required by applicable law.
8.Your Rights and Choices
8.1Access
You have the right to request a copy of the personal information Acquisera holds about you. Contact support (at) acquisera.com with the subject line “PRIVACY: Access Request.” We will respond within 30 days.
8.2Correction
If any personal information we hold about you is inaccurate or incomplete, you may update it directly through your account settings or by contacting support (at) acquisera.com with the subject line “PRIVACY: Correction Request.”
8.3Deletion
You may request deletion of your account and associated personal data at any time by contacting support (at) acquisera.com with the subject line “PRIVACY: Deletion Request.” We will process deletion requests within 30 days, subject to retention obligations described in Section 7. Deletion of your account does not affect billing records, which are retained for the period required by applicable law.
8.4Data Portability
You may request an export of your personal account data and search history in a machine-readable format by contacting support (at) acquisera.com with the subject line “PRIVACY: Portability Request.”
8.5Objection to Processing
You may object to our processing of your personal information where we are relying on legitimate interests as the legal basis by contacting support (at) acquisera.com with the subject line “PRIVACY: Objection to Processing.” We will consider and respond within 30 days. Note that objecting to certain processing may affect our ability to provide the Service.
8.6Marketing Communications
Acquisera does not send marketing emails without your consent. If you receive any unsolicited communication from Acquisera, you may unsubscribe at any time using the unsubscribe link in the email or by contacting support (at) acquisera.com with the subject line “PRIVACY: Unsubscribe.”
8.7California Residents: CCPA Rights
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act:
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
- Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
- Right to Opt-Out of Sale: Acquisera does not sell personal information. You therefore have nothing to opt out of with respect to the sale of your data.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
To submit a CCPA request, contact support (at) acquisera.com with the subject line “PRIVACY: CCPA Request.” We will respond within 45 days as required by law.
9.Regulatory Compliance
The Service operates across several privacy and electronic marketing regimes. This Section identifies the frameworks that apply to Acquisera's processing of personal information and describes how our practices are designed to meet them. It does not limit any right described in Section 8.
9.1CAN-SPAM: Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (United States)
The CAN-SPAM Act governs commercial electronic mail messages sent to recipients in the United States. It is an opt-out framework: prior consent is not required to send a commercial message, but every message must meet defined standards and must honor a recipient's request to stop.
Allocation of responsibility. Outreach composed in the Service is sent from the subscriber's own connected mailbox. The subscriber is the “sender” of that message for purposes of the Act and remains responsible for its content and for honoring opt-out requests. Acquisera provides the mechanisms described below; Section 5.3 of our Terms of Service prohibits any use of Contact Data that violates the Act.
Messages sent through the Service are designed to carry: accurate header and sender information identifying the originating subscriber; a subject line that is not deceptive as to the message's contents; a valid physical postal address for the sender; and a clear, functioning mechanism to decline further messages. Opt-out requests must be honored within ten (10) business days and the resulting address may not be sold or transferred. Acquisera suppresses any address for which it receives an opt-out or suppression request as described in Section 6.6.
9.2GDPR: General Data Protection Regulation (European Economic Area and United Kingdom)
Where Acquisera processes personal data of individuals located in the European Economic Area, the GDPR applies; where those individuals are located in the United Kingdom, the equivalent provisions of the UK GDPR and the Data Protection Act 2018 apply. Acquisera acts as controller for that processing.
Lawful basis. Acquisera relies on legitimate interests under Article 6(1)(f) for the processing of professional contact data in connection with business-to-business corporate development activity. The assessment supporting that basis is described in Section 6.5. Processing is limited to professional contact details; Acquisera does not process special categories of personal data within the meaning of Article 9, and does not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22.
Data not obtained from the data subject. Target Contact Data is sourced from third parties and public sources rather than from the individual, which engages Article 14. Acquisera is committed to providing the information Article 14 requires at or before the point of first contact, and on request at any time thereafter. That information is the identity of the controller, the purposes and lawful basis of processing, the categories of data concerned, the source from which it was obtained, and the rights available.
Delivery measurement. Recording that an outreach message was opened, as described in Section 4.4, is processed on the same legitimate-interests basis and is limited to the fact and time of retrieval. No link clicks, location, device, or IP address are recorded from these events, and nothing derived from them is used for profiling within the meaning of Article 4(4) or for automated decision-making within the meaning of Article 22. An objection under Article 21(2) ends this processing along with the messaging itself.
Rights. Data subjects may exercise the rights of access, rectification, erasure, restriction, portability, and objection as described in Section 8. The right to object to processing for direct marketing purposes under Article 21(2) is absolute: on receipt of such an objection, Acquisera will cease the processing and suppress the individual's information without further assessment. Individuals also have the right to lodge a complaint with their national supervisory authority, or with the Information Commissioner's Office in the United Kingdom.
Acquisera's systems and personnel are located in the United States, and personal data processed under this Section is transferred to and stored there. Requests relating to this Section should be sent to support (at) acquisera.com with the subject line “PRIVACY: GDPR Request.”
9.3CCPA / CPRA: California Consumer Privacy Act, as amended by the California Privacy Rights Act (California)
The CCPA applies to personal information of California residents. The exemption that previously covered information collected in a business-to-business context expired on January 1, 2023. Professional contact information about a California resident is therefore personal information under the CCPA, and Acquisera treats it as such. That includes the name, title, and business email address of a target company's principal.
No sale and no sharing. Acquisera does not sell personal information and does not share it for cross-context behavioral advertising, as those terms are defined by the CCPA. There is accordingly no sale or share from which a California resident needs to opt out. Because Acquisera does not sell personal information, it does not consider itself a “data broker” required to register under California Civil Code § 1798.99.80 et seq.
Acquisera does not collect or process sensitive personal information as defined by the CCPA, and does not use or disclose personal information for purposes other than those disclosed in Section 4 of this Policy. The categories of personal information collected, the sources of that information, the business purposes for its collection, and the categories of recipients are set out in Sections 3, 5, and 6.
California residents' rights to know, delete, correct, and to non-discrimination, together with the process for submitting a request and our response window, are described in Section 8.7.
9.4Other Jurisdictions
Most other United States state privacy statutes, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, exclude from their scope information about individuals acting in a commercial or employment context. Target Contact Data generally falls within that exclusion. California is the principal exception, as described in Section 9.3. Acquisera nonetheless applies the same handling standards to all Target Contact Data regardless of the residence of the individual concerned.
Where commercial electronic messages are sent to recipients in Canada, Canada's Anti-Spam Legislation applies. CASL is a consent-based framework rather than an opt-out framework, and it is the responsibility of the sending subscriber to establish express or implied consent before sending, to identify itself, and to provide a functioning unsubscribe mechanism honored within ten (10) business days.
10.Security
Acquisera implements technical and organizational measures designed to protect your information against unauthorized access, disclosure, alteration, or destruction. Our security practices include:
- Encryption: All data is encrypted in transit using TLS and encrypted at rest via our database infrastructure.
- Tenant Isolation: Row-level security policies enforce strict data isolation at the database layer, ensuring no subscriber can access another subscriber's data under any circumstances.
- Credential Security: Account passwords are hashed and salted and are never stored in plaintext. API keys and service credentials are stored as environment variables and are never committed to source code or exposed to the client layer.
- Access Controls: Pipeline execution infrastructure uses scoped service-role keys with limited permissions. Application-layer tenant scoping enforces data boundaries as an additional control layer independent of database-level policies.
- Environment Separation: Production and development environments are fully separated with independent credentials and databases.
- Security Audits: We conduct periodic internal security audits of our codebase and infrastructure and remediate identified vulnerabilities on a priority basis.
No method of electronic storage is completely secure. While we implement commercially reasonable security measures, we cannot guarantee absolute security. In the event of a data breach likely to result in risk to affected individuals, we will notify users as required by applicable law.
11.Children's Privacy
The Service is not directed to individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor without verified parental consent, we will take steps to delete that information promptly. Contact support (at) acquisera.com with the subject line “PRIVACY: Minor Data Concern” if you believe we may have collected information from a minor.
12.Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on this page with a new “Last Updated” date and notify registered users by email at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the changes. If you do not agree, you must stop using the Service and may request deletion of your account pursuant to Section 8.3.
13.Contact Us
For questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact:
Acquisera LLCAttn: Privacy
1658 N Milwaukee Ave, Suite 297
Chicago, IL 60647
Email: support (at) acquisera.com (subject line: PRIVACY)
We will respond to all privacy inquiries within 30 days.
This Privacy Policy draft has not been reviewed by licensed legal counsel. Acquisera intends to obtain attorney review prior to final publication. Nothing in this document constitutes legal advice.
© 2026 Acquisera LLC All rights reserved.