Your data, and how we protect it

• By default, the valuation you build stays in your browser — it is not sent to our servers.
• If you choose “Save to app”, that engagement is stored in our database encrypted at rest and is visible only to your account.
• We never sell your data and do not use your client information to train models or for advertising.
• You can delete any saved engagement — or all of them — at any time.

Account information. Your email address, and (if you sign in with a password) a one-way bcrypt hash of that password. If you sign in with Google, we receive your basic profile from Google. We never see or store your Google password.

Billing information. Payments are handled by Stripe. Your card number is entered directly with Stripe and is never stored on our servers — we keep only a Stripe customer reference and your current plan.

Valuation data. The figures and text you enter to build a valuation (including the subject business name, owner names, and financial information). See where this lives below.

In your browser (default). As you work, your engagement is auto-saved to your browser’s local storage on your own device. This data does not leave your computer and we cannot see it.

In our database (only if you choose “Save to app”). Saving an engagement to your account stores the full snapshot in our database, encrypted at rest with AES-256. Each saved engagement is scoped to your account; no other customer can access it.

During export. When you generate a Word or PDF report, the report content is sent to our server only to build the file, which is returned to you. It is not stored or logged.

• All traffic is encrypted in transit over HTTPS/TLS.
• Saved engagement data is encrypted at rest (AES-256-GCM) in addition to the database provider’s own disk encryption.
• Passwords are stored only as salted bcrypt hashes.
• Every request for saved data is scoped to the signed-in account, so a record can only be read or deleted by its owner.

We rely on a small set of reputable processors to run the service: hosting (Vercel), database (Neon, PostgreSQL), payments (Stripe), transactional email (Resend), and optional sign-in (Google). Each processes data only as needed to provide its part of the service.

We understand that the information you enter may be the confidential, non-public financial information of your clients. We act as a data processor on your behalf: we use that information solely to provide the valuation tools and reports you request, and we do not disclose it to third parties except as needed to operate the service or as required by law. If your firm requires a Data Processing Addendum, contact us at derrickcpa1@gmail.com.

Browser-stored data lives on your device until you clear it. For data saved to your account, you can delete any single engagement, or all of your saved engagements at once, from within the app. To delete your entire account and associated data, email us at derrickcpa1@gmail.com and we will remove it.

Valuation Processor provides analytical tools — not valuation, legal, tax, or accounting advice. You are responsible for the output and for applying professional judgment. See the in-app Terms of Service for details.

Questions about privacy or security? Email derrickcpa1@gmail.com.