Privacy Policy

Introduction

Oppsheet, Inc. (“Company” or “We”) respect your privacy and are committed to protecting it through our compliance with this policy.

This policy describes the types of information we may collect from you or that you may provide when you use: (a) the website https://www.oppsheet.com (our “Website”); and (b) the Oppsheet marketplace service made available through third-party artificial intelligence assistant platforms (“AI Platforms”), including Anthropic PBC’s Claude, by means of a connector built on the Model Context Protocol (the “Connector,” and together with the Website, the “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect:

• On the Website.
• Through the Connector, when you interact with the Services by means of an AI assistant.
• In email, text, and other electronic messages between you and the Services.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries); or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or through the Services. In particular, this policy does not apply to information collected by any AI Platform provider (such as Anthropic PBC), by our authentication provider when you interact with its login pages, or by our payment processor when you interact with its checkout and billing pages, each of which is governed by that provider’s own privacy policy as described below.

Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing or using the Services, you agree to this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates.

Children Under the Age of 18

Our Services are not intended for children under 18 years of age. No one under age 18 may provide any information to or on the Services. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on the Services or through any of their features, register on the Services, use any of the interactive features of the Services, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us as set forth below.

Information We Collect; Collection, Use and Disclosure of your Personal Data

The Company as a Service Provider or Processor

Some of the Company’s services require the Company to process data that has been uploaded, stored, and shared via the Company’s clients and users. We do not review or analyze the content of the data. However, it may contain personal data which the Company process pursuant to its users’ instructions. We do not control such data; rather we handle this type of data as a data processor only. The Company processes such data as governed by written agreements in place with its clients and to the extent necessary to comply with applicable laws. As a result, the Company’s clients are responsible for obtaining and providing all appropriate notifications and consents when they collect personal data. Personal data that is transferred to the Company by its clients to be processed shall be deemed to have been collected with appropriate notifications and consents. The Company assumes no responsibility for obtaining or validating that appropriate consent has been obtained or notifications provided with respect to data provided by its client(s).

The Company as a Business or Controller

We collect several types of information from and about users of our Services, including information:

• By which you may be personally identified, such as name, postal address, email address, telephone number, or FINRA registration number (“personal information”); and/or
• About your internet connection, the equipment you use to access our Services, and usage details.

We collect this information:

• Directly from you when you provide it to us, whether through the Website or through the Connector.
• Automatically as you use the Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies (on the Website) and server logs.
• From third parties, for example, our business partners and the service providers described in this policy (such as our authentication provider and payment processor).

Information You Provide to Us

The information we collect on or through our Services may include:

• Information that you provide by filling in forms on our Website or by providing information conversationally through the Connector. This includes information provided at the time of registering to use our Services, subscribing to our service, posting material, or requesting further services. We may also ask you for information when you report a problem with our Services.
• Account and authentication information. When you create an account or sign in, our third-party authentication provider (currently Auth0, an Okta company) provides us with your email address and a unique authentication identifier. We do not receive or store your password. If you sign in using a third-party identity provider (such as Google or Microsoft, where offered), we receive your email address and an authentication identifier from that provider through our authentication provider; we do not receive your password for, or the contents of, your account with that provider.
• Profile information you provide, currently your name, firm or company, title, and country. Your firm, title, and country may be displayed to other users as described in “Anonymity and Contact Exchange” below.
• If you use the Services as a prospective acquirer, your stated acquisition preferences, such as industries, size ranges, geographies, and transaction types of interest.
• The contents of any listing you post offering a business or business assets for sale (“Listings”).
• Records of your activity on the Services, such as Listings delivered to you, interest signals you send or receive, connections you make, and related notifications and audit records.
• Membership and billing status. Payments are processed by Stripe, Inc. We receive and store your subscription status, subscription period dates, and a Stripe customer identifier. We do not receive or store your full payment card number; payment details are provided by you directly to Stripe and are governed by Stripe’s privacy policy.
• Records and copies of your correspondence (including email addresses), if you contact us.
• Your responses to surveys that we might ask you to complete for research purposes.
• Your search queries on the Services, including the parameters of Listing searches performed through the Connector at your direction.

You also may provide information to be published or displayed (hereinafter, “posted”) on the Services, or transmitted to other users of the Services or third parties (collectively, “User Contributions”), including Listings. Your User Contributions are posted on and transmitted to others at your own risk. Although the Services are designed to display Listings without identifying the user who posted them, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Services with whom you may choose to connect or share information. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons. If you provide us with any personal data relating to other individuals, including but not limited to within your User Contributions, you represent that you have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Privacy Policy.

Your Conversations with AI Assistants

When you use the Connector, you interact with an AI assistant operated by an AI Platform provider (currently Anthropic PBC). We do not receive your conversations with the AI assistant. We receive only the specific, structured requests that the AI Platform transmits to the Connector in order to carry out actions you direct — for example, the content of a Listing you ask the assistant to post, the preferences you ask it to save, or a request to display Listings matched to you — together with the authentication information needed to identify your account.

Your conversations with the AI assistant, including any information you share with the assistant that is not transmitted to the Connector, are collected and handled by the AI Platform provider under its own terms of service and privacy policy, which we encourage you to review. We do not control, and are not responsible for, the AI Platform provider’s collection, use, or retention of your conversations.

Anonymity and Contact Exchange: Information Shared with Other Users

The Services are designed to share your personal information with other users only as follows:

• Listings you post are displayed to other users without your name, firm, email address, or other contact information.
• If you signal interest in a Listing, the user who posted that Listing will see the firm, title, and country from your profile — not your name or contact information.
• If a Listing’s poster elects to connect with a user who has signaled interest, the email address associated with each party’s account is disclosed to the other party, and both parties are notified. This is the only circumstance in which the Services share your contact information with another user.
• We do not make platform-wide activity statistics (such as numbers of users, Listings, or interest activity) available to users of the Services, and individual users’ browsing and interest activity is not exposed to other users except as described above.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Website.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

When you use the Connector, we automatically collect server logs of requests made to the Services, including request metadata such as timestamps, the actions performed, and network information such as IP addresses. The Connector does not itself place cookies on your device; any cookies or similar technologies used by the AI Platform through which you access the Connector are governed by that provider’s own policies.

The information we collect automatically does include personal information. It helps us to improve our Services and to deliver a better and more personalized service, including by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Services according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Services.
• Maintain the security and integrity of the Services, including enforcing rate limits and investigating misuse.

The technologies we use for this automatic data collection on the Website may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website. For information about managing your privacy and security settings for cookies, see Choices About How We Use and Disclose Your Information.
• Web Beacons. Pages of our Website may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Sensitive Personal Data

We do not collect sensitive personal data. Unless we specifically make a request and it is relevant to the services that we provide, we ask that you do not provide us with any sensitive personal data (meaning information revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic, health, or biometric information, information about sex life or sexual orientation, or criminal convictions or offenses) through our websites or mobile applications, the Connector, or otherwise to us.

Third-Party Use of Cookies

Some content or applications, including advertisements, on the Website may be served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies to collect information about you when you use our website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see Choices About How We Use and Disclose Your Information.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Services and their contents to you, including through the Connector.
• To match Listings with prospective acquirers based on stated preferences, and to operate the delivery, interest-signal, and connection features of the Services, including the contact exchange described above.
• To administer memberships, including free trials, billing, renewal, and cancellation, through our payment processor.
• To provide you with information, products, or services that you request from us.
• To fulfill any other purpose for which you provide it.
• To provide you with notices about your account, including expiration and renewal notices.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• To notify you about changes to our Services or any products or services we offer or provide though them.
• To maintain the security and integrity of the Services, including authentication, fraud prevention, rate limiting, and enforcement of our Terms of Use.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

We may use the information we have collected from you to enable us to display advertisements to our advertisers’ target audiences. Even though we do not disclose your personal information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

Disclosure of Your Information

We may disclose aggregated information about our users without restriction.

We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our business. These currently include: Anthropic PBC (operator of the AI Platform through which the Connector is made available); Auth0 (Okta, Inc.) (authentication); Supabase, Inc. (database hosting); Render Services, Inc. (application hosting); and Stripe, Inc. (payment processing). Each processes information as needed to provide its services to us and pursuant to its own contractual and legal obligations.
• To another user of the Services, limited to the disclosures described in “Anonymity and Contact Exchange” above (anonymized profile fields with an interest signal, and email addresses upon a poster-initiated connection).
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Oppsheet, Inc.’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Oppsheet, Inc. about our Services’ users is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our terms of use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Oppsheet, Inc., our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Data Retention

We retain personal information for as long as your account is active and as needed to provide the Services to you. Following account closure or a verified deletion request, we will delete or de-identify your personal information, except that we may retain: (a) records we are required to retain by law, including billing and tax records; (b) audit and security records maintained for the integrity of the Services; and (c) records of connections and contact exchanges, which may be retained as evidence of the consent-based disclosure described above.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Website may then be inaccessible or not function properly.

We do not control third parties’ collection or use of your information to serve interest-based advertising. However these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI”) on the NAI’s website.

Residents of certain states may have additional personal information rights and choices. Please see Your State Privacy Rights for more information.

Accessing and Correcting Your Information

You can review and change your personal information by logging into the Website and visiting your account profile page, or, for information maintained through the Connector (such as your profile and stated acquisition preferences), by directing the AI assistant to display or update that information.

You may also send us an email at legal@oppsheet.com to request access to, correct, or delete any personal information that you have provided to us. We may not be able to delete your personal information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

If you delete your User Contributions from the Services, copies of your User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other users of the Services. Please also note that once your email address has been shared with another user through the contact exchange described above, we cannot retrieve or delete it from that user. Proper access and use of information provided on the Services, including User Contributions, is governed by our terms of use.

Residents of certain states may have additional personal information rights and choices. Please see Your State Privacy Rights for more information.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information. These rights may include:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information’s nature processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for:
  • targeted advertising (excluding Iowa);
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
• Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state. To exercise any of these rights or appeal a decision regarding a consumer rights request, please contact us using the Company’s contact information provided below.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure, including structural controls designed to prevent the identity of a Listing’s poster from being displayed to other users prior to a poster-initiated connection.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone, and not to authorize the Connector for anyone other than yourself. We urge you to be careful about the information you include in a Listing, which is displayed to other users; do not include information you do not wish other users to see.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Services. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Services.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat our users’ personal information, we will notify you through a notice on the Website home page. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this privacy policy to check for any changes.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact us at:

legal@oppsheet.com ATTN: Compliance Department.