Privacy policy

We collect information you provide and information generated as you use the platform.

• Account information: name, email, phone, password, and role.
• Profile content: bio, location, buying criteria, and firm details for brokers.
• Listing content and any documents you upload.
• Verification evidence: statements and registration records. For an identity check, our verification provider collects an image of your government ID and a selfie on our behalf; we receive the outcome, its dates, the provider's number for the check and its confirmation of deletion, never the images.
• Usage data: searches, saved listings, messages, and deal room activity such as document opens.

We use information to operate accounts, match listings to saved searches, review verification submissions, produce valuation estimates, provide the deal room and its activity logs, prevent fraud and misuse, and communicate with you about your account.

Visibility depends on what you do, not on a single global setting.

• Sellers you message see your profile, badges, and NDA status — never the underlying documents.
• Buyers see listing content the seller published, and the deal-room documents the seller opens to them. Basic documents open to any buyer who signs the listing's NDA. Financial documents open to a buyer who has signed it and whom the seller approves, or, if the seller chooses, to every verified buyer who has signed it. Sensitive documents open only to a buyer who has signed it and whom the seller approves. An operator whose application the owner accepts sees the basic and financial documents.
• Sellers and brokers see document activity for materials they released, including who opened what and when.
• Your searches and saved listings are private to you. A valuation run is private until you share its link: for 30 days after the run, anyone with the link can open it, and a signed-in user with the link can copy its figures into a new listing.
• Verification documents you upload are seen only by the reviewers who assess them, and are deleted once a reviewer decides. If you apply to a partnership listing as an operator, the listing — its owner, and the broker firm handling it — also sees the results of your operator verification: your references' names, how they know you, when they were reached and the reviewer's note on each, your operating history, and your capital band.

Your profile has one privacy switch, Show your track record, which decides whether sellers see the businesses you already own and operate. Everything else sellers see follows from what you do, as Who can see what describes, and badges cannot be hidden. Sellers see how many times their listing was viewed, never by whom.

Account and listing data are retained while the account is active. When you delete your account, we delete your profile, saved searches, saved listings, notifications and notification choices, draft listings with their photos and files, verification records, and the valuations you ran with their shared links, and we clear your email address, phone number, location and profile photo from your account. The listings you viewed keep only a count of views that no longer names you, and our record of the emails we sent you is no longer linked to your account, except the record of a license decision, which keeps your account number. Listings you published are not deleted: a live or under-offer listing is withdrawn and kept, with its photos and deal-room files, and a sold listing stays on the site as sold. A stranger sees only a sold listing's title, sector, place and the month it sold. Listings a broker firm holds stay with the firm.

Other records stay after you delete your account, because they belong to a deal or to another person as well as to you:

• your name on your account;
• conversations and the messages you sent;
• offers you made, your document requests, and the document access you were given, which is revoked;
• each deal room's activity log, and closing records;
• signed NDAs, and an operator's signed background attestation;
• questions you asked on listings, which stay public once answered;
• notices other users hold that mention you, and a broker firm's activity log, which keeps your name;
• Supabase's security log of sign-ins, which records each sign-in with your email address and IP address. Supabase's log service keeps each entry for 7 days.
• Revanu's log of each verification file a reviewer opened and each review decision, which names the account it concerns. Each entry is deleted 24 months after it was written.

Identity verification is handled by our verification provider: we receive the outcome, its dates, the provider's number for the check and its confirmation of deletion, never the images, and we ask the provider to delete them 90 days after the check starts. That is never later than 90 days after it completes, and it includes checks that were never finished. We keep the result, when the check started and finished, a reference and the provider's number for the check, the consent you gave and when, and when the provider deleted the images. If you sign an NDA after an identity check, its record keeps the check's date. After you delete your account, we keep the provider's number for each check and its dates, so that our request to delete the images still reaches the provider.

Biometric data. For an identity check, our verification provider, Persona, collects an image of your government ID and a selfie on our behalf and derives biometric data from them, including the geometry of your face, for the sole purpose of verifying your identity. We ask Persona to destroy the images and the biometric data 90 days after the check starts, whether or not the check finished, and Persona confirms each deletion to us. We never receive, store, sell, lease, trade or disclose your biometric data. This is our retention schedule and destruction guideline for biometric data.

If you prove funds by connecting a bank account, that connection is handled by our banking provider and is read once and then removed: your bank login never reaches us, and we never receive or store your account number, your transactions, or the balance itself. We keep only a range, whether the account was in your name, the date, and a reference.

We share personal data with these service providers, under contract and only as needed to provide the service:

• Supabase hosts our database, sign-in and file storage. It holds the account, listing, deal and verification data this policy describes, and a security log of sign-ins.
• Vercel runs our website and servers, and handles every request to them, including your IP address and browser details.
• Resend delivers our emails, sign-in emails included. It handles your address and the message, which can include names, offer terms and a signed NDA's record.
• Persona runs identity checks. It collects your government ID image, your selfie and biometric data derived from them directly from you, on its own site. We send it only a reference of our own.
• Plaid connects a bank account if you prove funds that way. You sign in to your bank in Plaid's window. We send Plaid our identifier for your account and your name, so it can tell us whether the bank account is in your name.
• Mapbox turns place names into map locations: the places you type into a location search, and a listing's city and state when it is published.
• Sentry receives reports of errors: what failed and where, the page address without its query string, and your browser details. The account is not attached; names we can detect, the text people write, email addresses, phone numbers, IP addresses, dollar figures and document names are removed before a report is sent.

If you sign in with Google or LinkedIn, that service shares your name and email address with us. We do not use an outside analytics service. We do not sell personal information.

You may request access to your data, correct inaccuracies, export a copy, or request deletion. Requests can be made from account settings or through support.

We use encryption in transit and at rest, restrict internal access to verification evidence to trained reviewers, log administrative access, and support two-factor authentication on accounts.

Revanu is the data controller for the personal data described in this policy. Questions about it, requests under the Your rights section, and complaints go to support@revanu.com or through the contact page at revanu.com/contact. We reply from the same address.