Privacy policy

This policy covers the NoBrokerBizDeals web application (the “Service”). The data controller name and address should be inserted here for your legal entity.

• Account data: email address, password (stored by our auth provider), profile fields you provide, and role (buyer, seller, etc.).
• Listing and content: teasers, creative finance fields, optional images, and messages you send through the Service.
• Technical data: IP address, device and browser type, pages viewed, and approximate location derived from IP (via analytics tools).
• Cookies and similar technologies: session cookies for authentication; analytics cookies if you enable PostHog or similar vendors.

We use data to provide and secure the Service, authenticate users, display listings, enable buyer–seller messaging, improve product experience, comply with law, and enforce our Terms. We do not sell your personal information as a commodity; if we introduce advertising or data partnerships, we will update this policy and any required consents.

Authentication and primary application data are processed by Supabase (hosted Postgres). Supabase’s privacy policy and DPA govern their processing. Database rows are protected by row-level security policies; never share service-role keys in client-side code.

When NEXT_PUBLIC_POSTHOG_KEY is configured, the app may load PostHog’s JavaScript SDK to collect page views, feature usage, and diagnostic events. PostHog may set cookies or use local storage. Review PostHog’s documentation and your region’s consent requirements (e.g. EU/UK). You can disable PostHog by removing the key from your environment.

Paid features may be processed by Stripe. We do not store full card numbers on our servers; Stripe handles payment data under its own terms and privacy policy.

We retain data while your account is active and as needed for legal, tax, or fraud prevention. Listings and messages may be retained according to backup and moderation policies. You may request deletion where applicable law requires, subject to legitimate business or legal holds.

Depending on your location, you may have rights to access, correct, delete, or export personal data, and to object to certain processing. Contact us to exercise these rights. We may verify your identity before responding.

The Service is not directed at children under 16. We do not knowingly collect personal information from children.

Data may be processed in the United States or other countries where our subprocessors operate. Use appropriate safeguards (e.g. Standard Contractual Clauses) if you serve EU/UK users—your counsel should document this.

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date.

Privacy inquiries: add your operational privacy contact or Data Protection Officer details here.