SoForma

Privacy Policy

Effective Date: June 25, 2026

This Privacy Policy explains how SoForma, Inc. ("SoForma," "we," "us," or "our") collects, uses, discloses, and protects personal information when you access or use our platform at soforma.ai and any associated services (the "Platform").

This Policy works together with our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

If you do not agree with this Policy, you may not use the Platform.

1. Who This Policy Applies To

This Policy applies to:

  • Business owners ("Sellers") who use the Platform to prepare for or pursue a Transaction;
  • Certified public accountants and other advisors ("CPAs") engaged with Sellers through the Platform;
  • Prospective acquirers, investors, and their representatives ("Buyers") who use the Platform to discover or pursue Transactions;
  • Legal counsel ("Counsel") invited to review materials through the Platform; and
  • Visitors to our website who do not create an account.

This Policy does not apply to information you provide directly to other Platform users outside of the Platform's intended channels (for example, in a phone call or off-Platform email exchange).

2. Information We Collect

2.1 Information You Provide Directly

Account information. When you create an account, we collect your name, email address, password (stored hashed by our authentication provider), the role you selected (Seller, CPA, Buyer, or Counsel), and any organization information you provide. CPAs may also provide a CPA license number.

Profile and listing information. Sellers and CPAs may provide information about a business being prepared for sale, including financial data, operational information, customer or revenue concentration, owner intentions, and similar materials. This information is stored in your private workspace and is not shared with other users except as you explicitly direct through the Platform's disclosure controls.

Buyer profile information. Buyers may provide profile information such as firm, background, target industries, regions, and deal-size ranges, which a Seller may view when deciding whether to countersign a non-disclosure agreement ("NDA").

Uploaded content. You may upload documents, financial statements, contracts, evidence materials, and other files. We process these files to make them usable within the Platform and to generate derived information (such as identity-blinded teasers and summaries) at your direction.

Communication content. When you communicate through the Platform (including in-Platform messaging and any feedback or support requests you submit to admin@soforma.ai), we receive and store the contents of those communications.

NDA and access records. When a Buyer signs, and a Seller countersigns, an NDA through the Platform, we store the executed NDA (including the agreed text, the parties' signature metadata, and the date), and we store the per-item access grants the Seller chooses to provide to that Buyer.

Information about third parties you provide. Some Platform features ask you to provide information about people other than yourself (for example, inviting a CPA or a counterparty). When you provide information about another person, you represent that you have the authority or appropriate basis to do so. We will use that information to invite the third party to the Platform and, if they decline or do not respond, we will retain the invitation record but will not continue to contact them.

2.2 Information Collected Automatically

Usage information. We collect information about how you interact with the Platform, including pages viewed, features used, actions taken, and time spent. This information may be associated with your account.

Device and connection information. We collect technical information about the device and connection you use to access the Platform, including IP address, browser type and version, operating system, device identifiers, language, time zone, and referring URL.

Acceptance metadata. When you accept our Terms of Service or Privacy Policy, or sign an NDA through the Platform, we record the date and time, the version of the document accepted or the NDA text, and associated metadata such as IP address and user agent. This record is retained as evidence of agreement.

Cookies and similar technologies. We use cookies and similar technologies to operate the Platform, maintain your session, remember your preferences, and analyze usage. See Section 8 and our Cookie Notice for details.

2.3 Payment Information

When you purchase a Buyer subscription, our third-party payment processor (currently Stripe) collects and processes your payment details directly. SoForma does not receive or store full payment card numbers. We receive limited billing-related information from the processor, such as your subscription status, plan/tier, billing period, and identifiers needed to manage your subscription. Your payment information is handled in accordance with the processor's privacy policy.

2.4 Information We Do Not Collect

We do not knowingly collect information from individuals under 18 years of age. The Platform is not directed to minors. If we learn that we have collected information from a minor, we will delete it.

We do not collect biometric information, precise geolocation (beyond IP-derived approximate location), or full payment card credentials.

3. How We Use Information

We use the information we collect for the following purposes:

To provide and operate the Platform, including authenticating you, displaying relevant content, processing your uploads, generating derived information at your direction (such as identity-blinded listings), enforcing the access and disclosure controls you set, facilitating NDAs and per-item access between users, and operating in-Platform messaging.

To process subscriptions and payments, including establishing and maintaining your subscription, determining your access level, and managing renewals, cancellations, and lapses through our payment processor.

To support agreement formation and enforcement, including recording your acceptance of our Terms of Service and Privacy Policy and the NDAs you execute through the Platform, and maintaining records sufficient to administer them.

To communicate with you, including sending account-related notices, responding to your inquiries, alerting you to Platform activity (such as a new Buyer interest in your listing or a countersigned NDA), and, with your consent or where permitted by law, sending product updates and educational content.

To improve and develop the Platform, including analyzing usage patterns, identifying problems, testing features, and conducting research and development. Where feasible, we use aggregated or de-identified data for these purposes.

To protect the Platform and its users, including detecting and preventing fraud, abuse, security incidents, harmful or illegal activity, and violations of our Terms of Service.

To comply with legal obligations, respond to lawful requests from public authorities, and exercise or defend legal claims.

We do not sell your personal information, and we do not use your personal information for cross-context behavioral advertising.

4. How We Share Information

We share personal information only in the circumstances described below.

4.1 With Other Platform Users at Your Direction

Within an engagement. When a Seller engages a CPA (or a CPA accepts a Seller's invitation), the parties to that engagement share access to the relevant disclosures, evidence, and communications, as determined by the engagement's permissions.

Through identity-blinded listings. When a Seller makes a listing discoverable, we display certain derived, identity-blinded information about the business (such as industry, approximate revenue range, and high-level financial characteristics) to other authenticated users. We do not display the Seller's name, business name, or other directly identifying information unless and until the Seller grants identity access to a specific Buyer.

Through NDAs and per-item access. When a Buyer signs and a Seller countersigns an NDA, the Seller may grant that Buyer access to specific items (which may include the Seller's identity, specific disclosures, and specific documents). A Seller may view a Buyer's profile when deciding whether to countersign. Access is controlled by the Seller on a per-item basis and may be adjusted or, for some items, revoked.

4.2 With Service Providers

We engage third-party service providers to help us operate the Platform. These providers process personal information on our behalf and are bound by contractual obligations to handle it confidentially and only for the purposes we authorize. Categories of service providers include:

  • Cloud infrastructure, database hosting, and authentication (for example, Supabase);
  • Payment processing (for example, Stripe);
  • Web and product analytics (for example, Google Analytics via Google Tag Manager, and our product analytics tooling);
  • Email delivery;
  • Security monitoring and fraud detection.

Upon written request to admin@soforma.ai, we will provide a current list of subprocessors handling your data.

4.3 In Connection with a Transaction Involving SoForma

If SoForma is involved in a merger, acquisition, financing, sale of assets, or similar corporate transaction, your information may be transferred as part of that transaction, subject to the receiving party's commitment to honor this Policy.

4.4 For Legal and Safety Reasons

We may disclose information if we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, legal process, or government request; enforce our Terms of Service or other agreements; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of SoForma, our users, or others.

4.5 With Your Consent

We may share information for any other purpose with your specific consent.

We do not sell personal information for monetary or other valuable consideration. We do not share personal information for the purpose of cross-context behavioral advertising.

5. Your Rights and Choices

Depending on where you live, you may have certain rights regarding your personal information. We honor these rights for all users, regardless of jurisdiction:

  • Access. You may request a copy of the personal information we hold about you.
  • Correction. You may request that we correct inaccurate information.
  • Deletion. You may request that we delete your personal information, subject to exceptions described below.
  • Portability. You may request that we provide your personal information in a portable, machine-readable format.
  • Withdrawal of consent. Where we rely on your consent, you may withdraw it at any time.
  • Objection. You may object to certain processing of your personal information.

To exercise any of these rights, email admin@soforma.ai with the subject line "Privacy Rights Request." We will respond within 45 days, or sooner if required by applicable law. We may need to verify your identity before fulfilling your request.

Limits on these rights. Some information is retained for legal, regulatory, security, or administration reasons that override deletion requests. Notably:

  • Records of your acceptance of legal agreements (Terms of Service, Privacy Policy) and the NDAs you execute through the Platform are retained as evidence for the duration of any potential legal claim period.
  • Information needed to comply with legal obligations, administer subscriptions and billing, or resolve disputes is retained accordingly.

If we cannot fulfill a request, we will explain why. You will not be discriminated against for exercising your privacy rights.

6. Data Retention

We retain personal information for as long as needed to provide the Platform and fulfill the purposes described in this Policy. Specifically:

  • Account and profile information. Retained while your account is active and for a reasonable period after account closure (typically 90 days) to allow account recovery and resolve open matters.
  • Uploaded content. Retained while your account is active. After account closure, deleted or de-identified within a reasonable period unless retention is required for an open Transaction, dispute, or legal obligation.
  • NDA and access records. Retained for the period necessary to evidence the agreement and administer access, and as required by law.
  • Subscription and billing records. Retained as needed to administer your subscription and to meet tax, accounting, and legal requirements.
  • Acceptance and consent records. Retained for up to seven (7) years following the acceptance event, after which identifying metadata (IP address and user agent) is removed, while the core acceptance fact (user, document version, timestamp) is retained as part of the permanent acceptance history.
  • Communication logs. Retained for the period necessary for support, security, and dispute resolution, typically not longer than seven years.
  • Aggregated and de-identified data. May be retained indefinitely for analytics and product improvement.

7. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

  • Encryption of data in transit (TLS) and at rest;
  • Role-based access controls and authentication;
  • Database row-level security policies that segment data by user, role, and engagement, and that enforce per-item access under NDAs;
  • Logging and monitoring of access to sensitive data;
  • Confidentiality obligations for personnel with access to systems;
  • Secure software development practices and regular review of dependencies and configurations.

No method of transmission or storage is perfectly secure. While we work hard to protect your information, we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

You are responsible for maintaining the security of your account credentials. Notify us immediately at admin@soforma.ai if you believe your account has been compromised.

8. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Platform, maintain your session, remember your preferences, and analyze usage. We do not use cookies for cross-context behavioral advertising. Categories include essential cookies (authentication, session, core functions), functional cookies (preferences), and analytics cookies (aggregate usage). Our payment processor and analytics providers may set their own cookies. For details, see our Cookie Notice.

9. International Data Transfers

SoForma operates in the United States, and personal information we collect is stored and processed in the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those of your country. By using the Platform, you consent to this transfer.

10. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you using solely automated processing. The Platform may use algorithms to surface content or assist users in their workflow, but final decisions about Transactions, access grants, and engagement are made by users, not by SoForma.

11. Third-Party Links and Services

The Platform may link to or integrate with third-party services. We are not responsible for the privacy practices of those third parties. Your interactions with them are governed by their own privacy policies.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through the Platform before the changes take effect (except changes required to address legal, regulatory, or security matters, which may take effect sooner). The effective date at the top indicates when the current version became effective. Prior versions are available upon request. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

13. State-Specific Disclosures

Residents of certain U.S. states may have additional rights under applicable state law:

  • California residents have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and limit the use of sensitive personal information, and the right to opt out of sale or sharing of personal information. As stated above, we do not sell personal information or share it for cross-context behavioral advertising.
  • Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Kentucky and other states with comprehensive privacy laws give residents similar rights. The rights described in Section 5 are available to all users.

To exercise any state-specific right, follow the procedure in Section 5.

14. Contact

Questions about this Policy may be sent to admin@soforma.ai.