Skip to content
Value Alpha

Effective as of November 1, 2026 (previous version: October 30, 2026)

Value Alpha Privacy Policy

1. Who We Are

This Privacy Policy is issued by Value Alpha, Inc. (“Value Alpha,” “the Company,” “we,” “us,” or “our”), a corporation incorporated in the State of Delaware, United States, with its principal place of business in New York. We are the “controller” (for GDPR/UK GDPR purposes) and the “business” (for California Consumer Privacy Act purposes) of the Personal Information described below.

This Policy describes how we collect, use, share, retain, and protect Personal Information when you use our website at valuealpha.ai, our application at app.valuealpha.ai, and any related services (collectively, the “Service”). It also explains the privacy rights you have and how to exercise them.

This Policy is incorporated by reference into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Scope

This Policy applies to Personal Information we collect through the Service, through our marketing communications, and through any in-person or written interactions you have with us. It does not apply to third-party websites or services linked from the Service, even where we name those third parties below.

3. Age Restriction & Children’s Privacy

The Service is intended only for individuals at least 18 years of age. We do not knowingly collect Personal Information from anyone under 18. Consistent with the U.S. Children’s Online Privacy Protection Act (COPPA) we do not knowingly collect Personal Information from anyone under 13. Consistent with the CCPA/CPRA we do not knowingly sell or share Personal Information of anyone under 16. If you believe a minor has provided us Personal Information, contact us at [email protected] and we will delete it.

4. Information We Collect

We collect the following categories of Personal Information. We have used these categories for the past twelve months and intend to continue using them.

4.1 Information you provide directly

  • Identifiers & contact data - name, email address, password (stored hashed), organization name, role, country, and (if you sign in via a third-party identity provider) the identifier that provider gives us.
  • Sign-in provider data - if you choose “Continue with Google” or “Continue with LinkedIn”, the provider sends us your name, email address, profile picture URL and its user identifier for you. We use them only to create and authenticate your account and to show your name and picture inside the product. We do not request any other Google or LinkedIn data, never access your contacts, calendar, files or posts, and never post on your behalf. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
  • Commercial information - purchase history, subscription tier, billing address.
  • Payment information - payment method tokens issued by our payment processor; we do not store full card numbers.
  • Customer-submitted business & financial information - company descriptions, financial statements (PDF/Excel/CSV/image), assumptions, drug or product pipelines, and any other content you upload or type into the Service. We treat this as confidential and as “sensitive personal information” under California law where it identifies you.
  • Communications - support tickets, emails to or from us, replies to our inbound-email valuation flow, and feedback you submit through in-app surveys.
  • Marketplace (Rynek) data - if you use our business-sale marketplace, the buyer profile, application, access requests and decisions, listing, identity, phone check, signing records, sanctions screening and logs described in Section 7C.

4.2 Information collected automatically

  • Device & technical data - IP address, browser type, device type, operating system, language, time zone, and approximate location (derived from IP).
  • Usage data - pages viewed, features used, buttons clicked, valuations generated, time on page, referring URL, UTM parameters.
  • Cookie identifiers & similar technologies - see Section 14.
  • Inferences - derived signals such as plan tier, likely industry, or product fit drawn from your submitted information and usage.

4.3 Information we receive from third parties

  • Payment confirmation and limited transaction metadata from Stripe.
  • Authentication metadata from any single-sign-on identity provider you elect to use.
  • Aggregated marketing attribution data from advertising networks (e.g., LinkedIn, Google).

4.4 Sensitive information

We do not intentionally collect race, ethnicity, religion, philosophical beliefs, political opinions, trade-union membership, biometric data, health data, sexual orientation, government identifiers (e.g., SSN), or precise geolocation. We treat customer financial information you upload (your company’s financials) as confidential and we recommend you do not upload the personal financial information of natural persons unless necessary.

5. How We Use Your Information & Legal Bases

We use Personal Information only for the purposes listed below. For users in the European Economic Area, United Kingdom, or Switzerland, we identify the GDPR/UK GDPR legal basis we rely on.

  • To deliver the Service - running the valuation pipeline, storing results, providing AI chat, dashboards, and shareable reports. Legal basis: performance of a contract (Art. 6(1)(b)).
  • To process payments & manage billing - through Stripe. Legal basis: contract performance and compliance with legal obligation (Art. 6(1)(b), (c)).
  • To provide customer support. Legal basis: contract performance and our legitimate interest in supporting users (Art. 6(1)(b), (f)).
  • To secure the Service and prevent fraud or abuse - including detection of competitor scraping and rate-limit enforcement. Legal basis: legitimate interest in operating a safe Service (Art. 6(1)(f)).
  • To improve the Service - through aggregated analytics, error monitoring, and product research. We do not train AI models on your customer-submitted content (see Section 6). Legal basis: legitimate interest (Art. 6(1)(f)).
  • To send transactional communications - receipts, report delivery, account notices, security alerts. Legal basis: contract performance (Art. 6(1)(b)).
  • To send marketing communications (including our newsletter, “The Brief”). Legal basis in the EU/UK: your consent (Art. 6(1)(a)); in the US: legitimate interest plus an opt-out mechanism, consistent with the CAN-SPAM Act.
  • To comply with law - tax, accounting, audit, regulator requests, court orders. Legal basis: legal obligation (Art. 6(1)(c)).
  • To establish, exercise, or defend legal claims. Legal basis: legitimate interest (Art. 6(1)(f)).

6. AI & Automated Processing

The Service uses large-language-model and machine-learning processing to generate valuation Reports, comparable-company matches, AI chat responses, and similar outputs. The following commitments apply to that processing:

  • We do not train our models on your customer-submitted financial or business content. Your uploaded data is used only to generate your own Reports and to operate the Service for you.
  • Our AI vendors are on enterprise / API tiers that do not train on customer data. Specifically, we use OpenAI and Google (Gemini) under API terms that prohibit those providers from training their foundation models on our customers’ inputs and outputs.
  • We may use aggregated, de-identified usage data (e.g., counts of valuations by industry) for internal product analysis. We do not re-identify de-identified data.
  • No solely automated decision producing legal effects. Reports are informational only and are not a basis for legal, financial, investment, or tax decisions (see Terms of Service §9.2). Because no Report produces legal effects or similarly significant effects on you, GDPR Article 22 does not restrict our processing. You may always contact us at [email protected] for human review of any output. The marketplace’s automated checks (publication, budget, reports, sanctions), and which of their outcomes a person decides, are described in Section 7C.

7. How We Share Personal Information

We do not sell your Personal Information for money, and we do not “share” it for cross-context behavioral advertising as those terms are defined under California law. We disclose Personal Information only to the categories of recipients below.

7.1 Service providers (sub-processors)

We use the following sub-processors. Each is bound by a written data-processing agreement and processes Personal Information only on our documented instructions.

  • Stripe, Inc. (USA) - payment processing, billing, fraud prevention.
  • Supabase, Inc. (USA) - authentication, application database, file storage.
  • Cloudflare, Inc. (USA) - hosting, CDN, DDoS mitigation, bot management.
  • Resend, Inc. (USA) - transactional and inbound email delivery.
  • Twilio Inc. (USA) - text-message verification codes for the marketplace phone check; receives the phone number, the message language and the one-time code (see Section 7C).
  • OpenAI, L.L.C. (USA) - text embeddings used for matching comparable companies (API tier, no training on customer data).
  • Google LLC (Google Cloud / Gemini API) (USA) - large-language-model processing (API tier, no training on customer data).
  • Firecrawl (USA) - public-web data ingestion for benchmark datasets; does not receive customer-submitted content.
  • PostHog, Inc. (USA / EU region available) - product analytics and error monitoring; the marketplace’s listing-view event carries a pseudonymous viewer reference (a salted hash), never your account identifier.
  • Google LLC (Google Ads) & LinkedIn Corporation (USA) - marketing-attribution pixels on our marketing pages only; loaded subject to your cookie consent in the EU/UK.

The authoritative list, together with how to be notified of changes and how to object to a new subprocessor, is at valuealpha.ai/subprocessors. You can also request it from [email protected].

7.2 Other recipients

  • Within your organization - if you use the Team / organization product, members of your organization with appropriate roles can see valuations and Personal Information you submit to the shared workspace.
  • People you share with - if you generate a share link or claim a shared valuation, the recipient receives the content you choose to share.
  • Professional advisors - auditors, accountants, lawyers, and insurers under confidentiality obligations.
  • Government, regulators, or law enforcement - where compelled by law, subpoena, court order, or to protect rights, property, safety, or to investigate fraud or abuse.
  • Successors - in connection with a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred subject to confidentiality protections substantially similar to this Policy.

7A. Polish Company Data (KRS / rejestr.io)

When you value a Polish company on the Service, we retrieve publicly available data from the Polish National Court Register (Krajowy Rejestr Sądowy, “KRS”) via our data provider rejestr.io. This includes the company’s name, identifiers (KRS, NIP, REGON), PKD industry classification codes, registered address, legal form, and financial information disclosed in publicly filed annual financial statements. Under Polish law, KRS data is public.

Controller status. With respect to Personal Data obtained from KRS records (including names of board members, ultimate beneficial owners, and other natural persons named in the register), Value Alpha, Inc. is an independent data controller - distinct from rejestr.io and from the Polish Ministry of Justice (which operates KRS). Our legal basis is Article 6(1)(f) GDPR - legitimate interest in providing business valuation analysis services to our customers.

Source attribution. Polish company data sourced from rejestr.io is displayed on the Service with the attribution “Source: rejestr.io” (or in Polish, “Źródło: rejestr.io”), in accordance with rejestr.io API Terms.

Rights for data subjects in KRS records. If you are a natural person named in KRS data (e.g., as a board member) and wish to exercise GDPR rights (access, rectification, erasure, objection) with respect to our processing, contact us at [email protected]. Please note that we do not have authority to modify source records held by the Polish Ministry of Justice - for corrections to the underlying KRS register itself, we will refer you to the registering court.

Retention. KRS-derived data is cached on the Service for up to fourteen (14) months from the filing date, after which it is refreshed from the source. Cached records are subject to the same retention and deletion rights as other Personal Data described in this Policy.

7B. US Public Business Records (Business Directory)

When we publish pages about US small businesses (our business directory and business value estimator), we use public records released by the US Small Business Administration (“SBA”): the Paycheck Protection Program loan-level data and the 7(a) loan data, both published as works of the US Government. A business page may show the business’s name as filed (and a trade name where one is recorded), its city and state, its industry code and the staff range it reported in 2020 or 2021. Figures about similar businesses come from SBA loan data and the US Census Bureau’s Statistics of US Businesses, and are not the named business’s own figures.

What we leave out. We do not publish pages for sole proprietors, self-employed individuals, independent contractors or non-profit organizations, or for businesses whose name reads as a person’s name. We do not show loan amounts, street addresses, lender details or any information about owners. These records concern businesses. Where a record could still relate to an identifiable person, our legal basis is legitimate interest (Article 6(1)(f) GDPR) in providing accurate public business information and business valuation services; under the CCPA/CPRA, information lawfully made available from government records is treated as publicly available information.

Removal and corrections. Any business page can be removed. Use the “Request removal of this page” link on the page, or email [email protected]. We confirm the request by email, remove the page, and keep the business on a suppression list so it is not published again when our data is refreshed. No account is needed. A verified owner can also correct the industry, staff range or name we show.

Retention. The email address on a removal request is deleted thirty (30) days after the request is completed; we keep a one-way hash of it, the date and the removed record’s identifier so the page stays removed. We do not alter the SBA’s records; for corrections to the government records themselves, please contact the SBA.

7C. Rynek Business-Sale Marketplace

Rynek is our marketplace where business owners publish anonymous listings and approved buyers and investors ask for access to the details. If you use Rynek, we process the data below in addition to your account data. The Rynek terms, the NDA, the introduction agreement and the seller agreement refer to this Section for the information required by Articles 13 and 14 GDPR.

What we process and where it comes from

  • Buyer profile - country and entity type, entity name and registry number, budget band, financing, experience and sectors, all typed by you into your application for access to Rynek; the purpose stated in the application; our decision and its reason.
  • Access request - a short note to the seller (no email address, phone number, links, company names or registry numbers), a frozen copy of your profile as it stood when you asked, and the seller’s decision with its time and the seller’s IP address and browser identifier.
  • Phone check - when it is switched on, the phone number you confirm with a code sent by text message. Twilio sends and checks the code and receives the number, the language of the message and the code. The number only confirms that a person is on the other side; we do not pass it to the seller as a contact number.
  • Acceptance and signing records - when you accept the terms or a consent, we record the time, your IP address and your browser identifier and, where the text has one, its version and hash. When you sign the NDA, the introduction agreement or the seller agreement, we also record the name you typed, the version and hash of the text and of any translation shown beside it and, when you sign for a company or another entity, its name and your capacity, and we keep the signed text. If you end an introduction agreement, we record when, your IP address and your browser identifier. We email you a confirmation of each signature (the document, its version and fingerprint, the name and the time) with a link to the full text in your account.
  • Listing and reveal data (sellers) - the anonymous teaser (sector, region, bands for revenue, earnings, asking price, cash flow, growth, headcount and the age of the business, the exact asking price, revenue and EBITDA where you enter them, a yearly financial table rounded to the thousand, and the description) and, held separately, the identifying data: legal and trade name, registry number (KRS or NIP in Poland, EIN in the United States), address, website, the named contact person with email and phone, exact figures, the attached valuation (with its income statements if you choose to share them) and the files in the listing’s Data Room.
  • Sanctions screening - we compare your name (or, if your profile has none, the part of your email address before the @), your entity’s name and a listing’s legal name against the public OFAC, UN and EU sanctions lists on our own servers. Nothing is sent to those lists’ servers. We keep the result, the list versions and any matching list entries with their scores, and store the compared name as a salted hash. Our staff are told of every match by email.
  • Evidence records and logs - every read of a seller’s revealed data and every Data Room download (account identifier, IP address, browser, time), and a pseudonymous record of each read of a buyer’s contact card; the pseudonymous introduction register (requests, decisions, introductions, reveals and terminations, chained by cryptographic hashes and holding no name, email address or IP address), beside the NDA receipts, consents, access requests and agreements, which are hash-chained too; content reports (the reason and details given and, from a reporter who is not signed in, an email address and a salted hash of their IP address), moderation cases and appeals; reported closings; the waitlist.
  • Invitations - if our staff invite you to Rynek, we create your account and its approval from the email address they enter, with their note.

Who sees what, and when

  • A listing is anonymous and is shown only to signed-in users whose access to Rynek we have approved and who have accepted the NDA for the listing’s country. Listings are never public.
  • Before deciding on your request, the seller (and, where the listing is shared with a team, the team’s owners and admins) sees your buyer profile (intent, country, entity type, budget band, financing, experience, sectors and your note) without your entity’s name and without any contact data. Once the seller approves, each side receives the other’s contact card (business or entity, name, email, a phone number where one is given, and the seller’s website) in the app and by email.
  • The seller’s identity, contact details, the figures held back for the reveal and Data Room files reach the buyer only after the seller approves the request and both sides have a clear sanctions screening. Every read of that data and every file download is logged.
  • Our staff see applications, profiles and screening results on an admin desk; every read and every decision is logged. We are also told by email of new applications, sanctions matches, listings and edits awaiting review, reports, appeals and waitlist sign-ups.
  • After an introduction, each party processes the other’s contact data on its own responsibility, as an independent controller, solely to assess and, if it comes to that, carry out the transaction, under the NDA.

Automated steps and the human decision

When you publish, a listing goes through automatic checks: completeness, anonymity, the documents you must accept and sign, whether the business is publicly traded, whether it is already listed (the same registry number or legal name) and the sanctions screening. If a check fails, the listing is not published and you are told why, or asked to contact us. A listing may also wait for review by a member of our staff, and editing a published listing takes it off the market until a person approves the change. A request for a listing whose asking price exceeds your declared budget band by more than our margin is refused automatically; you can update your band and ask again. A listing reported by three independent reporters within 30 days is paused automatically, and the requests waiting on it are closed, until a member of our staff decides. A sanctions match is never a final decision on its own: while it stands, your application waits and your requests, publishing and reveals are blocked, and a member of our staff either confirms the match and refuses access, or clears it. You can contest the decision at [email protected]. Applications for access to Rynek are decided by a person.

Legal bases

  • Performance of a contract (Art. 6(1)(b)) - profile, application, access requests, listing, reveal, saved searches, contact cards, signed copies.
  • Legitimate interest (Art. 6(1)(f)) - the introduction register and the acceptance records, to establish, exercise or defend legal claims; the phone check and the access logs, to prevent fraud and abuse; the comparison against the OFAC list; the pseudonymous listing-view records, to measure interest in listings.
  • Legal obligation (Art. 6(1)(c)) - the comparison against the EU and UN sanctions lists, which are implemented in EU law, and the handling of content reports and the reasons we give for moderation decisions. We carry out sanctions screening under the EU sanctions rules and, for the OFAC list, on the basis of our legitimate interest.
  • Consent (Art. 6(1)(a)) - the waitlist and news about Rynek; you can withdraw it at any time.

Processors

Rynek data is stored in Supabase in the United States. Emails, including the contact cards and the signing confirmations, are sent by Resend. Text-message codes are sent by Twilio, which receives the phone number, the message language and the code. PostHog receives a listing-view event with a pseudonymous viewer reference (a salted hash, never your account identifier), from which it builds no profile. Section 8 describes the transfer safeguards and Section 7.1 the full list of sub-processors.

Retention

The retention periods for Rynek data are listed in Section 9.

Your rights on Rynek

The data export in Settings (“Download my data”) includes your Rynek data, except your moderation and report records and the IP address and browser identifier stored with your signed documents and seller agreements; you can ask us for those at [email protected]. In Settings you can use “Erase my marketplace data” at any time: we delete your profile, applications, saved searches, waitlist entry, phone codes and the reveal data of your listings; we withdraw your open listings and remove their headline, description, sector and region; we delete the revenue, earnings and asking-price figures and the financial table of every listing you own; and in the evidence records (NDA acceptances, consents, access requests, agreements, terminations, screening results) we remove your account identifier, IP address and browser identifier, keeping a one-way digest of the last two so that each record still verifies. What stays, to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR): the pseudonymous introduction register; the evidence records without you; the text of the signed documents with the typed name, and in a seller agreement the parties you excluded; screening results with the salted name hash; reported closings; content reports and moderation cases until their retention periods end; the access log until its 90 days end; the record of our staff’s actions, which can include your email address; and each listing record, withdrawn, with its remaining bands and its link to your account. Closing your account erases your Rynek data in the same way. Your other rights (access, correction, restriction, objection, complaint) are described in Sections 11 and 12.

8. International Data Transfers

We are based in the United States and most of our sub-processors are based in the United States. If you access the Service from the European Economic Area, the United Kingdom, Switzerland, or any other jurisdiction outside the United States, your Personal Information will be transferred to, processed in, and stored in the United States.

For transfers of EU/EEA, UK, and Swiss personal data to the United States we rely on the European Commission’s Standard Contractual Clauses (2021/914), together with the UK International Data Transfer Addendum and the Swiss equivalent, with each sub-processor. A copy of the safeguards used for a specific transfer is available on request at [email protected].

9. How Long We Keep Information

We keep Personal Information only as long as necessary for the purposes set out in this Policy, unless a longer period is required or permitted by law. The default retention periods are:

  • Account & profile data - for the life of your account, plus up to 24 months after your last login or your account closure (whichever is earlier), unless you ask us to delete it sooner.
  • Customer-submitted financial & business content (valuations, uploads) - for the life of your account, deleted on account closure (subject to legal-hold and tax-records exceptions below).
  • Transaction & tax records - up to seven (7) years after the transaction, as required by US tax recordkeeping rules.
  • Support communications - up to 3 years after the last interaction.
  • Marketing data & consent records - until you withdraw consent or unsubscribe, plus 30 days for suppression-list purposes.
  • Identifiable analytics data - up to 14 months; aggregated/de-identified analytics retained indefinitely.
  • Server & security logs - up to 90 days, longer where needed to investigate an incident.
  • Removal requests for public business pages - the requester’s email address is deleted 30 days after the request is completed; a one-way hash of it, the date and the removed record’s identifier are kept so the page stays removed (see Section 7B).
  • Marketplace (Rynek) operational data - text-message code records (number, code digest, IP address) are deleted one day after the code expires; the log of reveal reads and Data Room downloads after 90 days; content reports 24 months after our decision on them, with a reporter’s email address removed 6 months after it; the text of a seller’s appeal 24 months after the moderation case closes (the case and its statement of reasons stay with the evidence records); a listing-view record loses its link to the listing after 14 months; a waitlist entry is deleted after 24 months unless an account was opened with its email address; a sanctions screening result loses its link to your account after 5 years (the result and the salted name hash stay). These jobs run daily.
  • Marketplace (Rynek) evidence records - the pseudonymous introduction register, signed documents with the typed name, the acceptance records, moderation cases and reported closings are kept to establish, exercise or defend claims under the NDA, the introduction agreement and the seller agreement (Art. 17(3)(e) GDPR). No automatic deletion is set for them yet; once you erase your Rynek data they no longer carry your account identifier, IP address or browser identifier.
  • Marketplace (Rynek) profile and listing data - profile, applications, saved searches and reveal data, until you erase them in Settings or close your account; your listings are then withdrawn and stripped as described in Section 7C.
  • Backups - encrypted backups may persist for up to 35 days after the corresponding production record is deleted.

When the applicable retention period expires we delete or irreversibly anonymize the data.

10. Data Security

We use technical and organizational measures designed to protect Personal Information, including: encryption in transit (TLS), encryption at rest for application data and file storage, role-based access controls and database row-level security, principle-of-least- privilege staff access, audit logging, anti-debugging protections on the production app, rate limiting, and periodic credential rotation. Payment information is processed end-to-end by Stripe under PCI-DSS Level 1 standards; we do not see or store full payment card numbers.

No security measure is perfect and we cannot guarantee absolute security. If we become aware of a Personal Data breach we will notify affected users and applicable supervisory authorities without undue delay and, where required, within the timeframes set by applicable law (including 72 hours to relevant EU supervisory authorities under GDPR Article 33).

11. Your Privacy Rights - Overview

Depending on where you live you may have the rights listed below. We honor these rights regardless of jurisdiction where we can do so without violating other legal obligations.

  • Access - request a copy of the Personal Information we hold about you.
  • Correction / rectification - ask us to correct inaccurate or incomplete information.
  • Deletion / erasure - ask us to delete your Personal Information.
  • Portability - request your Personal Information in a portable, machine-readable format.
  • Restriction / objection - restrict or object to certain processing based on our legitimate interests.
  • Withdraw consent - where processing is based on consent, withdraw it at any time (without affecting prior processing).
  • Opt out of targeted advertising, sale, or share - see Sections 13 and 14.
  • Non-discrimination - we will not deny service, charge different prices, or provide a lesser quality of service because you exercised a privacy right.
  • Appeal - if we deny a request, you may appeal as described in Section 13.3.

To exercise any of these rights, email us at [email protected] (with [email protected] on copy if you prefer). We will verify your identity using information already associated with your account before fulfilling a request. You may designate an authorized agent to submit a request on your behalf; we will require proof of authorization.

12. EU, EEA, UK & Swiss Residents - GDPR / UK GDPR Rights

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Section 11 under Articles 15–22 of the GDPR (and the UK GDPR and Swiss FADP equivalents). We will respond to verified requests without undue delay and within one month, which we may extend by two further months for complex requests (we will tell you if we do).

You also have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en. UK residents may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

EU/UK representative (Article 27). We are established in the United States and offer the Service to individuals in the EEA, including a Polish-language service and Polish pricing. We are appointing an Article 27 representative and will publish their name and contact details here. Until that is complete, you can reach us directly at [email protected] for any request under the GDPR, and you retain the right to complain to your local supervisory authority (in Poland, the President of the Personal Data Protection Office, UODO).

13. California Residents - CCPA / CPRA Rights

13.1 Categories of Personal Information collected, used, disclosed, and sold/shared

In the past 12 months we have collected the following categories of Personal Information (as defined in Cal. Civ. Code § 1798.140): identifiers; customer records; commercial information; internet or other electronic network activity information; geolocation (approximate, derived from IP); professional or employment-related information; inferences; and we treat account log-in credentials and customer-submitted financial information as sensitive personal information.

We have disclosed each of those categories to the sub-processor categories listed in Section 7 for the business purposes listed in Section 5. We have not sold and we have not “shared” (for cross-context behavioral advertising) any category of Personal Information in the past 12 months. We have not used or disclosed sensitive personal information for purposes other than those permitted by Cal. Code Regs. tit. 11, § 7027(m).

13.2 Your California rights

  • Right to know the categories and specific pieces of Personal Information we have collected about you, the sources, the business purposes, and the categories of recipients.
  • Right to delete Personal Information we have collected from you, subject to statutory exceptions.
  • Right to correct inaccurate Personal Information.
  • Right to opt out of sale or sharing - we do not sell or share, so there is nothing to opt out of, but if our practices change we will provide a “Do Not Sell or Share My Personal Information” link.
  • Right to limit use of sensitive personal information - because we use sensitive personal information only for purposes permitted under the CPRA without need for a limitation right (e.g., providing the service you requested), no separate limitation link is required, but you may still email us to request additional restrictions.
  • Right to non-discrimination for exercising any CCPA/CPRA right.

13.3 How to submit a California request & appeal

Email [email protected] with subject “California Privacy Request” and tell us which right you want to exercise. We will respond within 45 days (extendable once by another 45 days with notice). If we deny your request you may appeal by emailing [email protected] with subject “Privacy Request Appeal” within 60 days of our denial. We will respond to the appeal within 60 days.

13.4 Notice of financial incentives

We do not currently offer any financial incentive or price/service difference in exchange for the collection, sale, or retention of Personal Information.

14. Residents of Other US States

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Montana, Iowa, Tennessee, New Jersey, Indiana, New Hampshire, Minnesota, Maryland, Rhode Island, or any other US state that has enacted a comprehensive consumer privacy law, you have rights substantially similar to those described in Section 13.2, including rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, or profiling that produces legal effects. To exercise these rights email [email protected] with the name of your state and “Privacy Request” in the subject line. We will respond within the timeframe required by your state’s law (typically 45 days).

Where your state law provides an appeal right, you may appeal a denial by emailing [email protected] within the time provided under your state’s law.

15. Cookies & Similar Technologies

A “cookie” is a small text file stored on your device. We and our service providers use the following categories:

  • Strictly necessary - authentication, session security, load balancing, CSRF protection. Cannot be turned off.
  • Functional - language, theme, and other preferences.
  • Analytics - PostHog product analytics and error monitoring. Session recordings in the app are separate and need their own permission (see below).
  • Marketing - Google Ads and LinkedIn Insight pixels on our marketing pages only; not loaded on app.valuealpha.ai.

In the EU/UK we load Analytics and Marketing cookies only after you give consent through our cookie banner; you can withdraw consent at any time through the “Cookie settings” control in the website footer. In the US you can opt out of Analytics and Marketing cookies through the same control or your browser settings.

We honor the Global Privacy Control (GPC) browser signal as a valid opt- out of sale and sharing under the CCPA/CPRA, and as a withdrawal of consent for non-essential cookies where required by EU/UK law. Most browsers do not yet send a standardized “Do Not Track” signal in a way we can act on uniformly, so we do not separately respond to DNT.

Session recordings

In the app (app.valuealpha.ai) we record how the valuation form and the payment screen are used only if you choose “Allow recording” when we ask. This permission is separate from analytics consent: we ask every visitor, in every country, and if you do not answer, nothing is recorded. A recording captures the page layout, clicks, scrolling and movement between steps on those two screens. All text on the screen and everything you type is replaced in your browser before anything is sent; images, files and embedded content are not recorded, and neither is browser console output or network traffic. Recordings are processed by PostHog, Inc. as our service provider, stored in the United States and deleted after 30 days. We use them only to find and fix problems on those screens, never for advertising, and we do not sell or share them. You can turn recordings off at any time in Settings, under Cookies and tracking, and a Global Privacy Control signal turns them off automatically. We keep a record of each answer you give (its date and the version of the question shown). Legal basis in the EU/UK: consent (Art. 6(1)(a) GDPR). On our website (valuealpha.ai) the same rules apply to the valuation calculator, the only page we record there: we ask on that page first, your answer there is separate from your answer in the app, and you can change it at any time under Cookie settings at the bottom of any page.

16. Marketing Emails & Newsletter (“The Brief”)

We send transactional emails (receipts, report delivery, account notices, security alerts) and, with your permission where required, marketing emails such as product updates and our newsletter The Brief. You can unsubscribe from marketing emails at any time via the unsubscribe link in any marketing email or by emailing [email protected]. Unsubscribing does not affect transactional emails necessary to deliver the Service.

We comply with the US CAN-SPAM Act, Canada’s CASL, and applicable EU/UK marketing rules under the ePrivacy Directive / PECR.

17. Third-Party Links & Integrations

The Service may contain links to or integrations with third-party websites or services (for example, broker listings or news sources referenced in your reports). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices.

18. Changes to This Policy

We may update this Policy from time to time. When we make a material change we will update the “Effective” date at the top and, where required by law, provide additional notice (such as an in-app banner or email). Your continued use of the Service after the effective date of an updated Policy constitutes acceptance of the changes.

19. Contact Us

Value Alpha, Inc.
A Delaware corporation · New York, United States
Privacy requests: [email protected]
Legal / appeals: [email protected]

We aim to respond to privacy inquiries within seven (7) business days.