Privacy Policy

This Privacy Policy explains how Blue Collar Tycoon ("Company," "we," "us") collects, uses, discloses, and protects information when you use the Blue Collar Tycoon marketplace and Deal Studio (together, the "Services"). It should be read together with our Terms of Service.

Account information: name, email address, password (hashed, never stored in plain text), and role (buyer/seller/admin).

Business and financial information you provide: company details, revenue, profit, uploaded financial statements, tax returns, bank statements, and other documents you choose to upload for valuation, listing, or diligence purposes.

Marketplace activity: listings you create or view, saved listings, NDA requests and status, messages sent through the platform, and data-room access/view logs (including timestamp, IP address, and user agent, captured for security and confidentiality-enforcement purposes).

Payment information: processed directly by Stripe; we receive confirmation of payment and a reference token, not your full card number.

Usage data: pages visited, features used, device/browser information, and (once enabled) product-analytics events, collected to improve the Services.

AI processing data: content of documents you upload and questions you ask the in-app AI assistant may be transmitted to our AI providers (currently Anthropic) to generate extracted data, answers, and suggestions.

• To provide, operate, and improve the Services, including generating Calculated Outputs and AI-Generated Content;
• To facilitate marketplace connections between buyers and sellers, including NDA execution and data-room access;
• To process payments and manage subscriptions/listing tiers;
• To communicate with you about your account, transactions, and platform updates;
• To detect, investigate, and prevent fraud, abuse, or violations of our Terms; and
• To comply with legal obligations.

We do not sell your personal information.

We share information only as needed to run the Services:

• With other Users, as directed by you: when you publish a listing, request data-room access, sign an NDA, or send a message, the relevant counterparty(ies) see the information you've chosen to share through that flow.
• Service providers: Supabase (hosting, database, authentication), Stripe (payments), SignWell (e-signature), Resend (transactional email), and Anthropic (AI processing) — each processes data on our behalf solely to provide their part of the Services.
• Legal and safety: where required by law, subpoena, or to protect the rights, property, or safety of the Company or its Users.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to your information.

We use reasonable technical and organizational measures to protect your information, including encryption in transit, row-level access controls scoping each account to its own data, watermarking and access logging on confidential listing documents, and restricted, service-role-only access to sensitive fields.

No system is completely secure. We cannot guarantee that unauthorized access, hacking, data loss, or other breaches will never occur, and we are not liable for such events except where directly caused by our own gross negligence or willful misconduct. If a breach affecting your information occurs, we will notify you as required by applicable law.

We retain account and business information for as long as your account is active and as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. [Placeholder — Joshua/counsel to specify exact retention periods, e.g. for closed accounts, uploaded documents after a deal closes, and data-room access logs.]

You can access and update most account information directly in the Services. You may request deletion of your account and associated data by contacting us at legal@bluecollartycoon.com, subject to our right to retain information required for legal, security, or legitimate business purposes (such as financial records tied to a completed transaction).

If you are located in the EU/UK, California, or another jurisdiction with its own privacy law, you may have additional rights (such as access, correction, deletion, portability, or opting out of certain processing). [Placeholder — counsel to add jurisdiction-specific sections (GDPR/UK GDPR, CCPA/CPRA, etc.) if the Company expects users from those regions.]

We use cookies and similar technologies for authentication (keeping you signed in) and, where enabled, product analytics to understand how the Services are used. You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in.

The Services are not directed to, and we do not knowingly collect information from, anyone under 18.

We may update this Privacy Policy from time to time. Material changes will require you to accept the updated Policy (together with the Terms of Service) before continuing to use the Services.

Questions about this Privacy Policy or your data can be sent to legal@bluecollartycoon.com.