1. Who we are (data controller)
The data controller for the personal data processed through this platform is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] ("Pomegranat.io", "we", "us"). You can contact us about privacy matters at [PRIVACY CONTACT EMAIL].
Pomegranat.io provides live business valuations and facilitates M&A connections for professional-services and software firms. This policy explains what personal data we collect, why, and how we protect it.
2. What data we collect
(a) Account and personal information. Name, email address, password (hashed), role, and company affiliation you provide when registering or using the platform.
(b) Financial and business documents you upload. Profit & loss statements, balance sheets, cash-flow statements, management accounts, forecasts, invoices, contracts, payroll and headcount data, customer and revenue data, pitch decks and similar materials, together with the data extracted from them.
(c) Data pulled from connected third-party tools via API. If you connect a tool, we pull the data needed to provide the service: accounting systems (e.g. QuickBooks Online, Xero, Sage — financial statements, invoices, contacts) and CRM systems (e.g. HubSpot, Salesforce, Pipedrive — accounts, contacts, deals/pipeline). Connection is via a unified-API integration provider acting on our behalf.
(d) Usage and technical data. Log data, IP address, device and browser information, pages visited, and actions taken on the platform.
3. How we use your data
We use the data described above solely to provide the valuation and M&A-matching services to you: generating your valuation and Enterprise Value Dashboard, benchmarking you against anonymised peer data, advising on improving your operational and financial metrics, and — only if you choose — presenting an anonymised profile to prospective buyers.
In particular, data obtained from connected platforms (including Intuit/QuickBooks data) is used only to provide the service to the connecting user. It is not sold or rented, not used for advertising, and not shared with other users except as you direct (for example, when you share a profile with a prospective buyer).
4. Sub-processors and third parties
We share data only with the categories of vetted service providers needed to operate the platform, under written agreements:
• The unified-API integration provider (Merge) used to connect your accounting/CRM tools;
• The connected platforms themselves (e.g. QuickBooks Online, Xero, Sage, HubSpot, Salesforce, Pipedrive), as necessary to maintain the connection you authorised;
• The AI / document-analysis provider used to read and extract data from your uploaded documents;
• Cloud hosting and database infrastructure providers.
The current list of sub-processors is: [SUB-PROCESSOR LIST].
We do not sell personal data to anyone.
5. Data security
Data is encrypted in transit and at rest. Access to data is restricted through role-based access controls and row-level security so that only you (and personnel under strict need-to-know controls) can access it. Connection tokens for third-party tools and your financial data are stored encrypted and are never exposed to your browser beyond what is needed to display your own information.
6. Data retention and deletion
We keep your data for as long as your account is active or as needed to provide the services, and thereafter only as required to meet legal obligations. You may disconnect a connected tool at any time — this stops all future syncs from that tool while data already pulled is retained as a snapshot unless you ask us to delete it. You may request deletion of your account and associated data at any time via [PRIVACY CONTACT EMAIL].
7. Your rights under [GOVERNING DATA-PROTECTION LAW] (incl. GDPR)
We process personal data on the following lawful bases: performance of a contract (delivering the services you signed up for), legitimate interests (operating, securing and improving the platform, producing anonymised benchmarks), and consent where required.
You have the right to: access your personal data; rectify inaccurate data; request erasure; request a portable copy of your data; object to or restrict certain processing; and withdraw consent at any time (without affecting prior lawful processing). To exercise any of these rights, contact [PRIVACY CONTACT EMAIL].
Where data is transferred internationally, we use appropriate safeguards (such as standard contractual clauses) as required by [GOVERNING DATA-PROTECTION LAW]. You also have the right to lodge a complaint with [SUPERVISORY AUTHORITY].
8. Cookies and analytics
We use strictly necessary cookies to keep you signed in and to operate the platform. We do not use third-party advertising cookies. [ANALYTICS DETAILS, IF APPLICABLE]
9. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date above. Continued use of the platform after the effective date constitutes acceptance.
10. Contact
Privacy questions or requests: [PRIVACY CONTACT EMAIL] · [LEGAL ENTITY NAME], [REGISTERED ADDRESS].
See also our Terms of Service and NCNDA Policy.