Privacy Policy

1. Operator, scope, and effective date

Effective date: for each account, the date the account is created and this agreement is accepted (published October 4, 2026). Ownsera is operated by Ownsera and its stakeholders (“Ownsera,” “we,” “us,” or “our”). Our business address is 5400 Glenridge Dr, Unit 420275, Atlanta, GA 30342. Privacy questions and requests may be sent to ops@ownseraiq.com. This Policy explains how we handle personal information in connection with our website, accounts, subscriptions, valuation and market-information features, communications, and support.

Personal information is information that identifies, relates to, or can reasonably be associated with an individual. Nonpublic company financial information can be commercially confidential even when it is not personal information. Our Terms and applicable customer agreements protect Customer Data separately. This Policy provides notice of our practices; it does not make acceptance of optional marketing, tracking, or unrelated data uses a condition of purchasing the service.

2. Notice at collection: information, purposes, and retention

The categories below describe the information handled through the service. The particular information depends on the features used. Provide only what is needed, and remove unnecessary individual identifiers from company information and uploads. Where a new feature collects materially different information or uses information for a materially different purpose, we will provide the relevant notice before that collection or use.

Account and contact information: names, email addresses, account identifiers, authentication information, organization details, and information supplied through an enabled sign-in provider. We use these to establish and authenticate accounts, manage access, communicate about the service, and prevent misuse. We retain them as needed for the account relationship, security, support, and applicable recordkeeping or legal obligations.

Subscription and payment information: plan, subscription status, billing-related contact details, transaction references, payment status, and other information returned by the payment integration. Stripe processes payment information under its applicable terms and privacy information. We use billing records to administer subscriptions, payments, cancellations, reconciliation, and disputes, and retain them according to those purposes and applicable accounting, tax, and legal requirements.

Company and valuation information: a company name if provided; industry, subsector, classification, geography, employee information expressed as counts or ranges, ownership percentage, revenue, EBITDA and adjustments, growth, margins, financial periods, currency, accounting and metric definitions, assumptions, saved estimates, and valuation checkpoints. We use these to provide the requested calculations, comparisons, histories, and workspace features. Retention depends on the workspace relationship, saved analyses, correction and audit needs, deletion instructions, and applicable legal obligations.

Uploaded and derived information: uploaded CSV or TSV content, including original submitted text; parsed financial data; generated analyses; saved results; and records of changes, which can include previous and revised values. We use these to import, explain, reproduce, correct, and support requested analyses. Retention considers the associated workspace and analyses, necessary audit and troubleshooting records, deletion requests, and legally required preservation.

Requests and communications: support messages; professional-service requests, including interest, professional category, timing, notes, contact and company information; and data contributions, including transaction details, source links, amounts, and notes. We use these to answer, review, administer, and document the request or contribution. We retain them as necessary for that purpose, related follow-up, permission records, dispute handling, and applicable obligations.

Device, session, and operational information: session and authentication identifiers, selected-company preferences, and technical information such as errors, diagnostic context, routes, and security or access records where generated by the service or its infrastructure. We use these to maintain sessions, remember requested settings, diagnose faults, protect the service, and document authorized activity. Retention depends on session duration, the chosen setting, necessary troubleshooting and security periods, and applicable recordkeeping requirements.

The categories and purposes above do not authorize sale of private workspace content, disclosure to another customer's workspace, targeted advertising using confidential financial inputs, or general model training. Any proposed optional use requiring consent or a separate agreement will be presented separately. The retention criteria in this notice apply to the relevant category, rather than establishing an indefinite right to keep everything submitted.

California supplement, where the CCPA applies: the collection categories above map to identifiers and customer records (account, contact, and billing); commercial information (subscriptions and transactions); professional or employment-related information (business role and submitted company information); internet or network activity (session and operational records); and inferences (identifiable derived analyses). Authentication credentials may constitute sensitive personal information. Submitted materials can contain additional categories; unnecessary sensitive records are excluded from permitted submissions.

The following disclosure describes our current practices and our practices during the preceding 12 months: categories collected, their sources and purposes; categories disclosed for business purposes and the corresponding recipient categories; categories sold or shared and the corresponding recipients; targeted-advertising activity; and whether sensitive personal information is used beyond permitted purposes that do not trigger a right to limit. Ownsera and its stakeholders do not sell personally identifiable information, do not share it for cross-context behavioral or targeted advertising, and have not done so in the preceding 12 months. Personally identifiable information is disclosed only to service providers that process it on our behalf to operate the Service (such as hosting, authentication and payment processing), under contracts that prohibit them from selling it or using it for their own purposes, or where required by law. We do not use or disclose sensitive personal information beyond purposes that do not trigger a right to limit. Public-source market facts and aggregate, non-identifying statistics are distinct from personally identifiable information. Before any of this changes, we will update this Policy and obtain any legally required consent first.

Read that disclosure with the category-specific purposes and retention criteria above and the rights procedures below. Where applicable, you may opt out of sale, sharing or targeted advertising and limit qualifying sensitive-information uses through our privacy controls or request process. Exercising a right will not result in unlawful discrimination or retaliation.

3. Where information comes from

We receive information directly from users, from the organizations and administrators managing their workspaces, from authorized uploads and integrations, and from providers supporting authentication, subscriptions, infrastructure, and communications. Market information may come from public or licensed sources and user-submitted source materials. A public source can contain personal information; its availability does not automatically authorize every subsequent use.

If your organization provides your information or administers your account, its own notices and instructions may also apply. Sign-in and other integrations provide information according to the permissions you grant and the integration's configuration. Do not grant access to information that is unnecessary for the feature.

4. Our purposes and roles

We handle account, subscription, website, security, and direct communication information for purposes we determine, including providing the service, responding to requests, maintaining its integrity, complying with law, and establishing, exercising, or defending legal rights. Where applicable, we act as controller or business for that processing.

When a business customer provides personal information for processing within its private workspace and determines the purposes of that processing, we act as its processor or service provider to the extent applicable law and the relevant agreement so provide. A customer may itself act for another controller. Our Data Processing Addendum addresses that processing when properly completed and incorporated into the customer agreement. The parties' actual activities determine their legal roles; neither this Policy nor a contract transfers away obligations imposed by law.

5. Confidential business information and permitted access

Customer Data includes nonpublic financial inputs, uploaded materials, assumptions, and the private analyses derived from them. Our permission to process that content is limited by the Terms, your instructions, and any applicable customer agreement. It is not a license to publish it, add it to a shared transaction database, disclose it to another customer, sell it to data brokers, or use it to train models for general use.

Authorized organization administrators and users may access content according to their roles and the permissions granted to them. Personnel and approved providers may receive access where necessary to provide, secure, or support the service, comply with law, or carry out an authorized request, subject to applicable confidentiality and use restrictions. Consider carefully whom you invite and what you choose to export or disclose. A recipient may retain a copy outside the service.

6. Automated processing and AI

Valuation features use automated calculations and models to produce estimates from company inputs and market information. These estimates can be inaccurate or incomplete and require independent assessment. The service is not intended to decide an individual's eligibility for credit, employment, insurance, housing, healthcare, or other legally significant opportunities.

Certain administrative workflows may use AI to extract or organize information from source materials. Use of AI for source processing does not itself authorize transmission of your private financial inputs to an AI provider. If a feature requires an external AI provider to process nonpublic Customer Data, the feature must identify that processing and the applicable provider information before activation.

Ownsera does not authorize nonpublic Customer Data to be used for general-purpose model training, models made available to other customers, or shared benchmarking without a separate agreement defining that use and any required permissions. Processing a request to produce its result is distinct from training. Any authorized AI processing remains subject to the applicable customer agreement, provider restrictions, retention controls, and law.

7. Disclosures and service providers

We disclose information as necessary to providers supporting the service, including authentication and data infrastructure, payment processing, technical operations, and other specifically enabled functions. The service integrates Supabase and Stripe and uses Lovable for hosting, integration gateways, and operational diagnostics. The role of a provider depends on the particular processing; a payment provider may handle information for its own regulated or fraud-prevention purposes as described in its notice. A vendor's involvement does not authorize unrelated use of private Customer Data.

We may disclose information to your organization and its authorized users; to recipients you specifically authorize; to professional advisers subject to appropriate duties; or when reasonably necessary to comply with valid legal requirements, protect rights and safety, address fraud or security incidents, or defend legal claims. We evaluate requests for disclosure and provide notice when required and legally permitted.

Information may also be handled in connection with a financing, restructuring, merger, or transfer of business assets, subject to applicable law and continuing contractual confidentiality and privacy restrictions. Such a transaction does not itself authorize incompatible use of information or cancel required notices, choices, or consents.

8. Professional introductions and marketing

A request for professional assistance authorizes Ownsera to review the information provided for that request. It does not by itself authorize disclosure to an outside professional. We will seek separate affirmative permission identifying the proposed disclosure before giving that professional your request or associated nonpublic company information.

Optional marketing choices are separate from account registration and necessary service communications. You may stop marketing messages using the available unsubscribe mechanism or by contacting ops@ownseraiq.com. We may still send messages necessary to administer your account, subscription, security, or an outstanding request. We do not use an unsubscribe request as a reason to restrict privacy rights or ordinary service access.

9. Cookies, browser storage, and privacy signals

The service uses session and authentication storage and may remember a selected company in your browser. Our Cookie and Browser Storage Notice explains these functions and the controls for any optional technologies. Optional tracking must be activated only with the choice or other lawful authorization applicable to that use.

Where applicable law requires recognition of Global Privacy Control or another qualifying opt-out signal, we treat that signal as a request to stop the covered sale, sharing, or targeted-advertising activity for the relevant browser or identifiable account. A recognized signal does not disable storage needed to authenticate you or provide a requested feature. A legacy Do Not Track signal is different from Global Privacy Control; see the Cookie Notice for the service's treatment of each.

10. Retention and deletion

We retain information only for as long as reasonably necessary for the purposes and category-specific criteria described above, subject to applicable law and customer agreements. Relevant considerations include account and workspace status, the sensitivity of the information, the purpose of saved histories, applicable accounting and legal requirements, necessary security records, and the establishment, exercise, or defense of claims.

Deleting a company record, cancelling a subscription, and closing an account are different actions. A self-service control may affect only the records described by that control. To request broader deletion of personal information or account closure, contact ops@ownseraiq.com. We assess the request, identify applicable exceptions, and explain retained categories where required.

Deletion may require processing across active systems and providers. Restricted backup, audit, payment, or legal-preservation records may be retained for their permitted purpose and disposal cycle. We do not use that retention exception to continue unrelated uses. Where information is deidentified, we apply safeguards against identification and reidentification consistent with applicable law; merely removing a company or person's name is not sufficient.

11. Your rights and how to request them

Depending on applicable law, you may request confirmation of processing, access, correction, deletion, or a portable copy of personal information; object to or restrict certain processing; withdraw consent; opt out of sale, sharing, targeted advertising, or covered profiling; or limit certain uses of sensitive personal information. Some laws also provide rights to information about specified recipients or automated decisions. These rights concern personal information and do not automatically entitle a person to another customer's confidential records or proprietary materials.

Submit requests to ops@ownseraiq.com. You do not need to purchase a subscription to submit a request. We may request proportionate information to verify your identity or an authorized agent's authority where appropriate. We do not require verification for opt-outs where the law prohibits it, and we do not require unnecessary sensitive records as proof.

We respond within the time required by the applicable law and explain any lawful extension, exception, or denial. If your jurisdiction provides an appeal right, reply to the decision or contact ops@ownseraiq.com with 'Privacy Appeal' and the request reference. We will review the appeal and explain the outcome and available regulator complaint route. You may also complain directly to the competent privacy authority where the law permits.

Where we process information for a customer, we may refer a request to that customer and assist it as required. We remain responsible for requests concerning processing for which we determine the purpose. We do not unlawfully discriminate or retaliate because a person exercises privacy rights. Nothing in the Terms or this Policy waives rights or remedies that cannot lawfully be waived.

12. Additional information for the EEA and United Kingdom

Where EU or UK data protection law applies, we use a lawful basis appropriate to each purpose. This may include performing a contract with you or taking steps you request before entering it; legitimate interests in administering business accounts, responding to requests, supporting and securing the service, and protecting legal rights, after considering affected individuals' rights; compliance with legal obligations; and consent for processing that requires or is based on consent.

A contract with an organization is not automatically a contract with each of its employees. For business contacts and organizational users, legitimate interests or another appropriate basis may apply instead. You may request further information about the basis for particular processing. Withdrawing consent does not affect the lawfulness of earlier processing based on that consent.

Rights of access, rectification, erasure, restriction, portability, objection, withdrawal, and complaint apply subject to their legal conditions. If a representative or data protection officer is required, the applicable contact details will be provided before processing requiring that appointment begins; you may contact ops@ownseraiq.com for the relevant contact.

13. Processing locations and international transfers

Information may be processed where Ownsera and its authorized providers operate. We do not represent that all information remains in one country. Applicable international-transfer restrictions must be satisfied before a restricted transfer is made, including relevant remote access.

Where required, we use an applicable adequacy decision or properly completed contractual or other approved safeguards, together with required assessments and supplementary measures. An entity's certification applies only to the entity and processing it actually covers. This Policy does not assert Ownsera's certification under the Data Privacy Framework or automatically incorporate incomplete standard contractual clauses. Contact ops@ownseraiq.com for information about safeguards applicable to your information.

14. Sensitive records, children, and security

Ownsera is intended for adult business users. Do not submit children's personal information or unnecessary government identifiers, complete payment-card details, account passwords, patient records, individual payroll records, or similarly restricted sensitive material through valuation forms, uploads, or prompts. If a specific service requires specially protected data, it must be covered by a separate approved arrangement before submission.

If you believe a child has provided personal information or restricted information was submitted unintentionally, contact ops@ownseraiq.com so we can investigate and take appropriate action. An eligibility rule does not displace obligations that arise when we learn of prohibited collection.

We maintain safeguards appropriate to the information and processing for which we are responsible. No system eliminates every security risk. We will provide incident notices required by applicable law. A general security statement does not represent that Ownsera holds a particular audit report or certification.

Ownsera and its stakeholders use commercially reasonable efforts and industry-standard technical, administrative, and physical safeguards to prevent unauthorized access to, or accidental disclosure of, personally identifiable information. While we apply these safeguards to protect your information, no transmission or storage system can be guaranteed completely immune from unauthorized third-party interference.

15. Changes and contact

We will identify this Policy's effective date and provide appropriate notice of material changes. Where a different use requires consent, a new notice, or a separate agreement, we will obtain or provide it before beginning that use. A revision does not retroactively override applicable confidentiality commitments or legal rights.

Contact: Ownsera and its stakeholders, 5400 Glenridge Dr, Unit 420275, Atlanta, GA 30342, ops@ownseraiq.com.