Privacy Policy

NextPhase Partners, LLC ("NextPhase," "we," "us," or "our") operates the NextPhase Partners platform at thenextphasepartners.com (the "Platform"). This Privacy Policy explains how we collect, use, store, and protect your personal information.

By using the Platform, you agree to the collection and use of information as described in this Policy.

1. Notice at Collection

At or before the point we collect your personal information, we tell you what categories we collect and why. The categories, purposes, and retention periods are set out in Sections 2, 3, and 8 of this Policy. We do not sell your personal information. We do share a limited category of online identifiers for cross-context behavioral advertising, as described in Sections 6.5 and 7, and you can opt out at any time.

2. Information We Collect

2.1 Account and Profile Information

When you create an account we collect your name, email address, and password; company name, title, and industry; buyer profile information including acquisition criteria, capital range, and funding methods; and seller business information including industry, revenue, employee count, location, and business description.

2.2 Financial and Business Documents

Sellers may upload financial statements, tax returns, bank statements, payroll records, asset schedules, leases, and other business documents. This information is used solely to provide Platform services and is treated as strictly confidential.

Some of this information may constitute sensitive personal information under applicable state law, including financial account information contained in bank statements. We use sensitive personal information only to provide the services you have requested, and we do not use or disclose it for any other purpose.

2.3 Transaction Information

We collect records of Non-Disclosure Agreements executed, inquiries submitted, offers and deal documents exchanged, and communications conducted through the Platform.

2.4 Usage and Technical Data

We automatically collect IP address and device information; browser type and operating system; pages visited and features used; timestamps and session duration; and error logs and performance data.

On our public marketing pages we also collect cookie identifiers set by our analytics and advertising providers, including Meta cookie identifiers. These are online identifiers rather than account information, and Section 6.5 describes what is shared and with whom.

2.5 Payment Information

Payment processing is handled by Stripe. NextPhase does not store full payment card numbers. We retain records of subscription status, payment dates, and transaction amounts.

3. How We Use Your Information

We use collected information to provide, operate, and improve the Platform; authenticate users and maintain account security; generate valuations, sale materials, and other Platform outputs; match buyers with relevant listings based on acquisition criteria; process payments and manage subscriptions; send transactional emails; provide customer support; detect and prevent fraud, abuse, and security incidents; comply with legal obligations; and generate anonymized aggregate statistics and benchmarks.

We also use online identifiers collected on our public marketing pages to measure the effectiveness of our advertising. This is the only advertising purpose for which we use personal information, it applies only to those pages, and Sections 6.5 and 7 describe it in full.

4. Automated Processing and Artificial Intelligence

NextPhase uses artificial intelligence and automated systems as a core part of the Platform. This section explains what those systems do, what they are based on, and what choices you have.

4.1 Where Automated Processing Is Used

Document analysis. Uploaded documents are read by AI systems to extract financial figures, identify potential owner add-backs, catalog assets, and flag items that a buyer is likely to question.

Valuation. Your business valuation is produced by applying an industry earnings multiple to your calculated seller's discretionary earnings. The earnings calculation is performed by deterministic software, not by an AI model. AI systems assist in extracting the underlying figures from your documents and in drafting the narrative portions of the report.

Business readiness score. A score is generated from factors including years in business, revenue range, and completeness of the documentation you have provided.

Buyer matching. Listings are matched to buyers based on the acquisition criteria the buyer provides, including industry focus, geography, revenue range, and earnings range.

Sale materials. Confidential Information Memoranda, executive teasers, and listing descriptions are drafted by AI systems from the data and answers you supply.

4.2 What These Systems Do Not Do

No automated system on the Platform makes a decision that produces a legal or similarly significant effect about you. Automated outputs are informational. They do not determine your eligibility for credit, employment, housing, insurance, or any other service. They do not approve or deny you access to the Platform.

Every consequential decision on the Platform is made by a person. Sellers decide which add-backs to confirm, whether to publish a listing, whether to approve a Non-Disclosure Agreement request, and whether to approve a buyer introduction. A NextPhase advisor reviews a listing before it is published.

4.3 Your Choices

You may request a human review of any automated output, including a valuation, by contacting info@thenextphasepartners.com. You may correct any underlying data and have the output regenerated. You may request an explanation of how a particular output was produced.

If you prefer not to have your documents processed by AI systems, contact us and we will discuss whether the services you need can be provided by other means. Because automated document analysis is central to how the Platform works, opting out will limit the services available to you.

4.4 AI Subprocessors and Model Training

Uploaded documents and financial data are transmitted to Anthropic, PBC via secure API for AI inference. Anthropic does not retain or train its models on this data under its API data usage policies. NextPhase does not use your financial data to train AI models.

5. Documents You Upload About Other Businesses

If you use the Platform to evaluate a business you are considering acquiring, you may upload documents concerning a business you do not own. This section explains how that information is handled. It applies in addition to, not instead of, the rest of this Policy.

5.1 What We Do With Them

Documents you upload for deal evaluation are used for one purpose: producing the analysis you requested. They are processed by our AI subprocessor to extract figures and by our own software to perform calculations and consistency checks.

5.2 Who Can See Them

Only you, and NextPhase personnel supporting your account. These documents are not visible to sellers, to other buyers, to advisors, or to any other Platform user. They are stored separately from listing materials and are access-controlled to your account.

5.3 What We Do Not Do With Them

We do not use them to train AI models. We do not use them to build public benchmarks, market reports, or any dataset from which the business could be identified. We do not disclose them to the business owner, to any broker or intermediary, or to any party other than the subprocessors listed in Section 6. We do not use them for marketing.

5.4 Retention and Deletion

You may delete any evaluation and its documents at any time from the Platform. Deletion removes both the documents and the resulting analysis, subject to routine backup cycles and any legal retention obligation. Evaluations you do not delete are retained for the duration of your account and for up to 90 days after account closure.

5.5 Your Responsibility

Documents about a business you do not own frequently contain information belonging to that business and its owner, and may be subject to a confidentiality agreement you have signed. You are responsible for confirming that you are permitted to submit those documents to a service provider for analysis on your behalf. NextPhase is not a party to any such agreement and cannot advise you on its terms.

6. How We Share Your Information

6.1 Between Buyers and Sellers

Buyers can browse and view listings anonymously. A seller sees only aggregate view counts, never the identity or profile of someone who has merely viewed a listing.

A buyer's name and contact details are shared with a specific seller only once that buyer takes a deliberate step with that seller: requesting a Non-Disclosure Agreement on the listing, submitting an inquiry, or entering into deal documents.

A seller's identity and detailed business information are shared with a buyer only after a Non-Disclosure Agreement is executed and approved by the seller.

Advisors working on a seller's behalf see exactly what that seller sees, and no more.

Anonymized listing information, including industry, revenue range, and general geography, is visible publicly without authentication.

6.2 Service Providers

We share information with service providers who assist in operating the Platform. Each is bound by contractual confidentiality obligations and may use data only as needed to provide its services:

• Anthropic, PBC — AI inference for document analysis and content generation
• Supabase — database, authentication, and file storage infrastructure
• Amazon Web Services — underlying hosting infrastructure
• Stripe — payment processing
• Brevo — transactional email delivery
• Browserless — document and PDF generation

Each provider maintains its own privacy policy governing its handling of data. We review our subprocessors periodically and will update this list as it changes.

Two further recipients are not service providers in the sense above, and we list them separately because they receive data on their own account rather than solely on ours:

• Google — analytics across the Platform, receiving usage and device data as described in Section 7
• Meta — advertising measurement on our public marketing pages only, receiving the online identifiers described in Section 6.5. This is the sharing for cross-context behavioral advertising that Section 6.5 discloses. Meta receives no account, business or financial information.

6.3 Legal Requirements

We may disclose information if required by law, court order, subpoena, or government request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of NextPhase, our users, or the public. Where permitted by law, we will notify you before making such a disclosure.

6.4 Business Transfers

In the event of a merger, acquisition, financing, or sale of all or substantially all of our assets, user data may be transferred as part of that transaction. We will notify users by email or Platform notice before such a transfer occurs, and any acquirer will remain bound by the commitments in this Policy with respect to data transferred.

6.5 Sale and Sharing of Personal Data

NextPhase does not sell your personal information.

We do use the Meta advertising pixel on our public marketing pages, described in Section 7. Under California law that is "sharing" personal information for cross-context behavioral advertising, and we disclose it as such rather than claim otherwise. What is shared is limited to online identifiers and internet activity: the marketing page your browser requested, your IP address, and Meta cookie identifiers. Your name, email address, business details and financial information are never shared this way.

In the preceding twelve months we have shared that category of information for cross-context behavioral advertising. We have not sold personal information.

7. Cookies and Tracking Technologies

Strictly necessary cookies. The Platform uses cookies that are required for it to function, including authentication and session management. These cannot be disabled without preventing the Platform from working.

Analytics and advertising technologies. We use Google Analytics across the Platform and the Meta advertising pixel on our public marketing pages. Neither is strictly necessary. We activate them on notice through this Policy rather than asking first, and you can opt out at any time by the means described below — including a signal your browser can send on your behalf, which we honor automatically.

We use one third-party advertising pixel: the Meta pixel, and only on our public marketing pages. It records that a browser viewed a marketing page and reports that to Meta so we can measure our advertising. It is not present on any page behind sign-in, and it is not present on the valuation pages where you have entered information about your business — those pages load no advertising script at all. We do not use session replay or keystroke recording anywhere on the Platform.

Global Privacy Control. We recognize and honor the Global Privacy Control (GPC) signal. If your browser or extension transmits a GPC signal, the Meta pixel is not loaded at all, and we treat the signal as a request to opt out of any sale or sharing of your personal information and of any non-essential tracking.

8. Data Retention

We retain your data as follows:

• Account and profile data — for the duration of your account and up to 90 days after closure
• Uploaded financial documents — for the duration of your active engagement and up to 90 days after account closure
• Non-Disclosure Agreement records — 7 years
• Payment and transaction records — 7 years
• Usage and page-view logs — 90 days
• Application error and diagnostic logs — 12 months
• Audit logs of administrative actions — 7 years

You may request deletion of your data at any time by contacting info@thenextphasepartners.com. We will honor deletion requests except where retention is required by law, necessary to complete a transaction, or necessary to establish or defend legal claims.

9. Data Security

NextPhase implements security measures including AES-256 encryption at rest for stored data; TLS 1.3 encryption in transit; row-level security controls limiting data access by user role; signed URLs with limited expiry for document access; audit logging of data access and modification events; and role-based access controls for Platform administrators.

All Platform data is stored on servers located in the United States, using Supabase infrastructure hosted on Amazon Web Services in the US-East region. We do not transfer personal information outside the United States except as necessary for AI inference by our subprocessor, which is also United States based.

No security measure is perfect and we cannot guarantee absolute security. In the event of a breach affecting your personal information, we will notify you and any applicable regulator within the timeframes required by law, and in any event without unreasonable delay.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights. NextPhase extends these rights to all users regardless of residency:

• Right to know — what personal information we collect, the purposes for which it is used, and the categories of parties with whom it is shared
• Right to access — obtain a copy of the personal information we hold about you
• Right to correct — have inaccurate personal information corrected
• Right to delete — request deletion of your personal information, subject to legal retention requirements
• Right to portability — export your uploaded documents and account data
• Right to opt out of sale or sharing — send a Global Privacy Control signal, or email us; we do not sell personal information, and we stop sharing it for advertising on request
• Right to opt out of targeted advertising — the same opt-out applies; see Section 7
• Right to opt out of profiling — see Section 4.3
• Right to limit use of sensitive personal information — we use sensitive personal information only to provide the services you have requested
• Right to non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right

10.1 How to Exercise Your Rights

Contact info@thenextphasepartners.com. We will verify your identity by confirming control of the email address associated with your account, and may request additional information where the request concerns sensitive data. We respond within 45 days, and may extend once by an additional 45 days where reasonably necessary, in which case we will notify you.

10.2 Authorized Agents

You may designate an authorized agent to make a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your own identity directly.

10.3 Right to Appeal

If we decline a privacy request, you may appeal by replying to our decision or writing to info@thenextphasepartners.com with the subject line "Privacy Appeal." We will respond to an appeal within 45 days with a written explanation of our decision. If your appeal is denied, you may contact the attorney general of your state.

11. State-Specific Disclosures

California. This Policy serves as the notice required by the California Consumer Privacy Act as amended by the California Privacy Rights Act. The categories of personal information we collect are described in Section 2, the purposes in Section 3, and the categories of recipients in Section 6. California residents have the rights listed in Section 10. We do not sell personal information. We do share personal information for cross-context behavioral advertising as that term is defined under California law, limited to the online identifiers described in Section 6.5, and California residents may opt out as described in Sections 7 and 10.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws. Residents of these states have the rights listed in Section 10, including the right to appeal described in Section 10.3.

Nevada. Nevada residents may submit a request that we not sell their personal information. We do not sell personal information.

12. Children's Privacy

The Platform is intended for business users and is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected such information, we will delete it promptly. If you believe a minor has provided us with personal information, contact info@thenextphasepartners.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For non-material changes we will post the updated Policy and update the version number and effective date.

For material changes, including changes to the categories of information we collect, the purposes for which we use it, the parties with whom we share it, or your rights under this Policy, we will post the updated Policy with a new version number and effective date, and notify registered users by email in advance of that date. Your continued use of the Platform on or after the effective date constitutes acceptance of the revised Policy.

If you do not agree to a revised Policy, stop using the Platform. You may close your account and request deletion of your data as described in Section 8. We maintain prior versions of this Policy with their effective dates.

14. Contact Us

NextPhase Partners, LLC

Email: info@thenextphasepartners.com

Website: thenextphasepartners.com

For privacy requests, use the subject line "Privacy Request." For appeals, use "Privacy Appeal."

Last updated: September 22, 2026