Legal
Privacy policy for peakbeyond.ai
Who we are and what this covers
peakbeyond.ai is the confidential transaction portal of Peak Beyond, LLC, 435 Merchant Walk Square, Suite 300-132, Charlottesville, VA 22902 (“Peak Beyond”, “we”). Peak Beyond advises clients who are selling a business or raising capital. The portal presents an opportunity to prospective buyers and investors without naming the business, takes their requests for information and, once a non-disclosure agreement (NDA) is in place, shows the confidential information to the people Peak Beyond has approved.
We are the data controller (the “business”, under US state laws) for the personal data described here. This policy covers peakbeyond.ai only. Our public website, peakbeyond.com, has its own privacy policy.
The portal is for businesses and the professionals who represent them. There is no public sign-up: an account exists only when your Peak Beyond advisor creates one for you.
What we collect
When you request information about an opportunity
The request form asks for your first and last name, company, job title, business email address, phone number, the kind of buyer you are and a description of your interest, and optionally your company's website. It is emailed to Peak Beyond, with your address as the one we reply to, and kept in the portal so your advisor can work through requests. Sending a request never grants access to confidential information. To keep spam out, we briefly keep one-way codes made from your IP address and your email address (never the addresses themselves) to limit how many requests one network or one address can send.
If Peak Beyond gives you access
Your advisor creates an account with your email address, and usually your name and company, and records your role (a prospective buyer or investor, the client, or Peak Beyond), the status of your NDA and whether you have been given access to a transaction. We keep the date your account was created and when you last signed in. The NDA itself is not stored in the portal. If your advisor sends you an invitation, it is emailed to you with a link that works for 30 days.
Signing in
There are no passwords. When you sign in, we email you a six-digit code and a sign-in link, which work once and expire after 15 minutes; we store only one-way codes made from them. After you sign in, a session keeps you signed in for up to 14 days.
Viewing confidential information
We record which sections of a confidential presentation you open and when you last viewed one, and we keep an audit trail of sign-ins, sign-outs and access decisions (who made them and when). Pages marked sensitive show your email address across the page as a watermark, which is only displayed, not stored. Your advisor can see this activity.
Technical logs
Like any website, our hosting provider records technical details of each request (your IP address, your browser, the address requested and the time) for a short period, for security and troubleshooting. Our own logs record what a sign-in attempt did, never your email address.
We don't use analytics, advertising or tracking of any kind on the portal, and the emails we send contain no tracking.
Why we use it and our legal bases
- To answer your request and run the transaction process: reviewing your interest, corresponding with you, and giving you access under an NDA. (Steps you ask for before entering into a contract; performing the NDA; and our legitimate interest, and our client's, in running a confidential sale or capital raise.)
- To protect confidential information: signing you in, limiting access to approved people, recording who viewed what, watermarking sensitive pages and keeping an audit trail. (Legitimate interests in keeping our client's information confidential and enforcing the NDA.)
- To keep the portal secure: spam and abuse prevention, rate limits and technical logs. (Legitimate interests in securing our systems.)
- To meet legal obligations: responding to privacy requests, and keeping records the law requires.
Every decision about access is made by a person at Peak Beyond; we make no automated decisions that produce legal or similarly significant effects. We do not sell personal data, share it for cross-context behavioral advertising, use it for targeted advertising or profiling, or collect sensitive personal data.
International transfers
We and our providers are based mainly in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, transfers of your data rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and, where a provider is certified, the EU–US Data Privacy Framework with its UK extension and the Switzerland–US framework.
How long we keep it
These are our retention policies. Each applies unless a legal obligation, or a legal hold that preserves information for a dispute or investigation, requires us to keep information longer. When a period ends, we delete the information or irreversibly anonymize it.
- Information requests: in the portal for no more than 24 months; in our email for as long as we're discussing the opportunity with you, and no longer than three years after our last contact.
- Your account, NDA and access status, and your viewing activity: while the transaction process is open, and for up to three years after it ends (after it closes, as recorded by Peak Beyond), as a record of who received confidential information under an NDA. If a process is reopened, the period starts again when it next closes.
- The audit trail (sign-ins, access and NDA changes, sections viewed): for the same period as your account and access records; after that, only in a form that no longer identifies you. It is not limited to the most recent entries, and entries aren't changed in normal operation.
- Signed NDAs, when the portal begins to store them: for the period that applies to signed agreements, which may be longer; this policy will say so before any is stored.
- Sign-in codes and links: 15 minutes, or until used. Sessions: up to 14 days, or until you sign out or your access ends. Invitation links: 30 days.
- Migration backup: During migration, we may create a one-time backup export that is kept in private storage for migration verification and rollback protection. It is retained until the migration and rollback period have been accepted and is deleted only after authorization, subject to legal obligations and holds.
- Anti-spam codes: up to 24 hours. Technical request logs: the short period our hosting provider keeps them.
Your rights
Depending on where you live, you have the right to:
- Know and access what personal data we hold about you and get a copy, including in a portable, machine-readable format;
- Correct data that is inaccurate;
- Delete your data, unless we must keep it (for instance, the record that you received information under an NDA, while that record is needed);
- Object to or restrict how we use it;
- Opt out of the sale or sharing of personal data, targeted advertising and profiling. We do none of these;
- Not be discriminated against for using any of these rights;
- Complain to a data protection authority: in the UK the Information Commissioner's Office, in the EU the authority where you live or work.
US state privacy notice (including California)
This section adds to the rest of the policy for residents of California (CCPA as amended by the CPRA) and of other states with consumer privacy laws. In the past twelve months the portal has collected the categories of personal information below. We have not sold or shared (for cross-context behavioral advertising) personal information, including of anyone under 16, and we don't use or disclose sensitive personal information.
| Category | What we hold | Source | Why | Disclosed to | Kept |
|---|---|---|---|---|---|
| Identifiers | Name, email address, phone number | You; your Peak Beyond advisor, when they add you | Answering your request; giving and controlling access; signing you in | Service providers above; the client whose business is offered | See “How long we keep it” |
| Professional information | Company, job title, company website, the kind of buyer you are | You; your Peak Beyond advisor | Evaluating your interest and running the transaction process | Service providers above; the client whose business is offered | See “How long we keep it” |
| Commercial information | Your NDA status and whether you have access to a transaction's confidential information | Your Peak Beyond advisor | Controlling access to confidential information | Service providers above; the client whose business is offered | See “How long we keep it” |
| Internet or network activity | Sign-ins, which sections of a confidential presentation you opened and when you last viewed one, and technical request logs (IP address, browser, the address requested, time) | Your use of the portal | Protecting confidential information; showing the advisor who has reviewed what | Service providers above | See “How long we keep it” |
| Content of communications | What you write in an information request | You | Answering your request | Service providers above | See “How long we keep it” |
How we verify requests. We match the email address you give us to the data we hold and may ask you to confirm a code we send there. We never ask for more than we need.
Authorized agents. Someone you have authorized may make a request for you; we will ask for your signed permission and may confirm your identity with you directly.
Response times. We confirm a request within 10 business days and answer within 30 days, and tell you if we need an extension where the law allows one.
Appeals. If we decline your request, you can appeal by replying to our answer with the word “Appeal”. Someone who wasn't involved in the first decision will review it and reply within 45 days, or sooner where your state requires. If you disagree with the outcome, you can contact your state's Attorney General.
Make a privacy request
Use the privacy request form on peakbeyond.com and say that your request is about peakbeyond.ai, or ask your Peak Beyond advisor. You'll get a reference number and the date we'll answer by.
Children
The portal is for businesses and isn't directed to children. We don't knowingly collect personal data from anyone under 16.
Security
Confidential pages are shown only to signed-in people with access, and anyone else is told the page doesn't exist. There are no passwords to steal; sign-in codes, links and sessions are stored only as one-way codes. Ending someone's access or NDA signs them out at once. All traffic is encrypted in transit (HTTPS only), confidential pages are never stored by shared caches, and a strict Content Security Policy keeps any third-party code off the portal.
No service can promise perfect security, but if a breach affects your personal data we will notify you and the relevant regulator as the law requires.
Changes and contact
For questions about this policy or your data, use the privacy request form or ask your Peak Beyond advisor.