Privacy notice

Our lists come from public records. From the California Department of Consumer Affairs licensee file we use only:

• name, license number and license type;
• the public address of record (street, city, county, ZIP);
• original issue date, expiration date and license status.

We add public deal announcements (which firm was acquired, by whom, with a link to the source), lists of firms known to be owned by private equity, and our own analysts' notes about firms. We place firms on the map at the center of their ZIP code, not at their street address.

We don't collect personal email addresses or phone numbers of CPAs, we don't buy data from data brokers, and we don't use social networks or sites whose terms forbid it.

We use this information to rank firms for corp-dev teams, brokers and acquiring firms who subscribe to SuccessionSignal, under terms that allow internal use only and forbid resale.

You can ask us to remove your name or your firm using the removal request form. We apply approved requests starting with the next monthly release: a removed firm no longer appears, and a removed person's name is dropped. Releases already published and files customers already downloaded don't change.

If your license details are wrong, the state record is the source; once it's corrected there, the next release reflects it. Tell us about any other error at [privacy@yourdomain.com].

• Account: name, work email, organization, role and team membership.
• Billing: Paddle.com, our Merchant of Record, sells to you and processes payment under its own privacy notice. We receive the billing contact, country, plan and payment status; we never see or store card numbers.
• Use of the service: watchlists, notes, saved views, alert rules, and an audit log of exports and list loads, which we keep to secure the service and enforce the data license.
• Forms: what you send in the sample-list or removal forms, to respond to you.
• Technical data: our servers and providers process IP addresses and request details to deliver the site, limit abuse and fix errors.

We use only the cookies needed to sign you in and remember your active organization. We don't use advertising or cross-site tracking cookies.

To see which pages help people, we count page views and a few actions (such as requesting a sample or starting checkout) with Mixpanel. These events go through our own server, use a random ID that lasts for one browser tab session, set no cookies, and never include your name, email or IP address.

We share information only with providers that run parts of the service for us, under contracts that limit their use of it:

• Supabase (database and sign-in)
• Cloudflare (file storage)
• Paddle (payments, tax and invoicing, as our Merchant of Record)
• Resend (email)
• Sentry (error reports, sent without IP addresses or cookies)
• Mixpanel (anonymous usage counts, described above)
• [Hosting provider] (servers)

We may also disclose information when the law requires it, to protect our rights or others' safety, or as part of a merger or sale of our business.

We don't sell our customers' personal information or share it for cross-context behavioral advertising.

We keep account information while your account is active and afterwards only as long as needed for legal, tax, security and license-enforcement purposes. We keep form submissions as long as needed to respond and follow up. Raw public-record files are kept so every release can be checked and reproduced.

Data is encrypted in transit. Access is limited by organization at the database level, our team's access is logged, and exports are watermarked and recorded.

You can see and change your account details in the app, change or turn off alert emails under Alerts, and ask us to access, correct or delete your personal information by emailing [privacy@yourdomain.com]. Depending on where you live, including California, you may have further rights under local law; we won't treat you differently for using them. We'll verify requests before acting on them.

• SuccessionSignal is a business service for use in the United States. It isn't directed to children.
• If we change this notice materially, we'll post the new version here with a new effective date and email account owners.

[Company legal name], [Street address, City, State ZIP]. [privacy@yourdomain.com]