ACQUIREMAN1. Who we are and what this policy covers
This Privacy Policy explains how ACQUIREMAN PRIVATE LIMITED (CIN U66190UW2026PTC251071), with its registered office at G-268, Beta-2, Alpha Greater Noida, Noida, Gautam Buddha Nagar – 201310, Uttar Pradesh, India (“Acquireman”, “we”, “us”), collects, uses, shares, stores and protects personal data when you use www.acquireman.com, Acquireman AI, our onboarding, KYC, NDA and data-room features, and any related services (together, the “Platform”).
For the purposes of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), Acquireman is the Data Fiduciary for the personal data described in this policy, and you are the Data Principal. Where the EU or UK General Data Protection Regulation (“GDPR”) applies to you, Acquireman is the “controller”.
This policy also serves as our notice under Section 5 of the DPDP Act. It should be read together with our Terms of Use, Cookie Policy and Acquireman AI Terms. It does not cover third-party websites or services that we link to, which have their own policies.
2. Personal data we collect
We collect only the personal data we need for the purposes described below. The table lists each category.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and sign-in | Email address, password (stored only in hashed form by our authentication provider), sign-in method; if you use Google sign-in, your name, email address and profile picture from Google. | You; Google (if you choose Google sign-in) |
| Buyer / investor profile | Full name, email, country, company or fund name, investor type, typical ticket size, investment preferences, optional Telegram or WhatsApp handle. | You |
| Seller / founder and listing details | Founder name, contact details, company name, country of incorporation, industry, revenue, valuation expectations and other information about the business you choose to list or discuss. | You |
| Identity verification (KYC) | Copy of passport, proof of address, company incorporation certificate, and verification status and notes. | You |
| NDAs and agreements | Name, company, address, electronic signature, signing date and time, IP address, browser/device information and a copy of the signed document. | You; generated when you sign |
| Data-room activity | Which deals and documents you were granted access to, and when. | Generated when you use the Platform |
| Acquireman AI | Your messages, information you share about yourself or your company, the AI's responses, assessment reports generated for you, and your consent record (version, date and time, marketing choice). | You; generated by the service |
| Meetings and communications | Name, email, meeting details and notes when you book a call (via Calendly), and the content of emails or messages you send us. | You; Calendly |
| Technical and security data | IP address, browser and device type, pages requested, date and time, error and security logs. Cookies and similar storage are described in our Cookie Policy. | Your device; our hosting provider |
| Website statistics (cookieless) | Pages visited, referring website, approximate country, browser, operating system and device type, collected without cookies through Vercel Web Analytics. Visitors are counted using a temporary code that is discarded within 24 hours and is not linked to your identity or IP address. We remove search terms and other query details from page addresses before they are recorded. | Your device; Vercel |
| Privacy choices | Your cookie choices and privacy requests, with the date, time and policy version. | You |
Please share only what is needed. Do not send us passwords, bank or card details, or unpublished price-sensitive information about listed companies. If you give us personal data about other people (for example co-founders, shareholders or employees), you confirm that you are allowed to share it with us for these purposes.
3. Why we use your personal data
We use personal data only for the specific purposes below:
| Purpose | Data used | Basis |
|---|---|---|
| Create and secure your account, sign you in and keep you signed in | Account and sign-in; technical data | Consent; legitimate use for a service you requested |
| List and market opportunities, build buyer and investor profiles, and make introductions you ask for | Profile, listing and contact details | Consent |
| Verify identity and authority, prevent fraud and control access to confidential deal information (KYC, NDA approval, data-room gating) | KYC, NDA and data-room data | Consent; compliance with law |
| Provide Acquireman AI, generate your assessment report and follow up with you about it | Acquireman AI data; account data | Consent (given in the Acquireman AI consent box) |
| Schedule and hold meetings, answer your questions and provide advisory or incubation services you engage us for | Meetings and communications; profile data | Consent; performance of an agreement |
| Send occasional insights and relevant opportunities | Name, email, stated interests | Separate, optional consent only — you can unsubscribe at any time |
| Keep the Platform secure, detect abuse, keep logs and respond to incidents | Technical and security data | Legitimate use; compliance with the DPDP Rules (security safeguards and log retention) |
| Understand how the website is used so we can improve it | Website statistics (aggregate and anonymous) | No cookies or identifiers are used; reports show totals only |
| Comply with law, court orders and lawful requests from authorities; establish, exercise or defend legal claims | Any relevant data | Compliance with law |
We do not use your personal data for automated decisions that produce legal or similarly significant effects on you. Acquireman AI ratings are indicative and are always reviewed by a person before we act on them.
If we want to use your personal data for a new purpose, we will tell you first and, where required, ask for your consent.
4. Your consent and how to withdraw it
Where we rely on consent, we ask for it through a clear, unticked checkbox or button, separately for each purpose where practical (for example, the cookie banner, the Acquireman AI consent box and the optional marketing checkbox). You may give consent directly to us or, once available, through a Consent Manager registered with the Data Protection Board of India.
You can withdraw your consent at any time, as easily as you gave it, by:
- using Cookie settings in the website footer (for cookies and third-party features);
- clicking “unsubscribe” in any marketing email;
- submitting a request on our Data Deletion & Privacy Requests page; or
- emailing contact@acquireman.com.
Withdrawing consent does not affect processing that took place before you withdrew it. After you withdraw, we will stop the related processing within a reasonable time and ask our service providers to do the same, unless the law requires or permits us to keep the data. Some features (for example, data rooms or Acquireman AI reports) cannot be provided without the related data.
5. Acquireman AI
- Your messages are sent to our AI model providers (currently Groq, Inc. and, as a backup, Cerebras Systems Inc.) to generate a response. We do not use your conversations to train AI models, and we choose providers and settings that limit how long they keep your data (for example, zero data retention with our primary provider).
- If you are not signed in, your conversation is kept only in your own browser; we do not store it on our servers.
- When you generate an assessment report while signed in, we store the report and the conversation that produced it, and share them with the Acquireman team so that we can follow up with you. We treat this information as confidential and never publish it or share it with buyers, investors or other third parties without your permission.
- AI output can be wrong. See the Acquireman AI Terms for details.
7. International transfers
Some of our service providers process data outside India, as shown above — our main database is hosted in Singapore. Transfers outside India are made in line with Section 16 of the DPDP Act and any restrictions notified by the Government of India. Where the GDPR applies, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (and the UK Addendum) with our providers.
8. How long we keep personal data
We keep personal data only for as long as needed for the purpose it was collected, or as required by law. When it is no longer needed, we erase it or make it anonymous.
| Data | Retention period |
|---|---|
| Account and profile | While your account is active; erased after three (3) years of inactivity (with 48 hours’ notice) |
| KYC documents | three (3) years after your account is closed or your last transaction-related interaction with us, unless a longer period is required by law |
| Signed NDAs and agreements | the term of the agreement plus three (3) years, to protect the rights of the parties |
| Acquireman AI reports and related conversations | three (3) years after your last interaction with us, or earlier if you withdraw consent |
| Acquireman AI conversations when not signed in | Kept only in your browser; never stored on our servers |
| Security, access and processing logs | At least one (1) year, as required by the DPDP Rules, then deleted |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we do not contact you again |
| Consent and privacy-request records | As long as needed to show we handled your choice correctly, and at least one (1) year |
Where we erase data because you have not used the Platform for the period above, we will tell you at least 48 hours beforehand, so you can sign in or contact us if you want us to keep it. Copies in encrypted backups are overwritten in the normal backup cycle.
9. How we protect personal data
We use reasonable security safeguards appropriate to the sensitivity of the data, including:
- encryption in transit (HTTPS/TLS) and encryption at rest with our database and storage providers;
- access controls, so that KYC documents and data rooms are available only to authorised people;
- separation of secret keys from the website code, and least-privilege access for our team;
- logging and monitoring to detect and investigate unauthorised access;
- backups, and contractual security obligations on our service providers.
No system is completely secure. If a personal data breach occurs, we will inform affected users without delay — in plain language, explaining what happened, the likely consequences, what we are doing and what you can do — and we will notify the Data Protection Board of India and other authorities as required by law (including a detailed report to the Board within 72 hours).
10. Your rights
Under the DPDP Act, you have the right to:
- Access — a summary of the personal data we process about you, the processing activities, and the identities of the Data Fiduciaries and Data Processors we have shared it with;
- Correction, completion and updating of inaccurate or incomplete data;
- Erasure of personal data that is no longer needed, or that you have withdrawn consent for, unless the law requires us to keep it;
- Withdraw consent at any time;
- Grievance redressal — to raise a complaint with our Grievance Officer and receive a response;
- Nominate another person to exercise your rights in the event of your death or incapacity.
If you are in the European Economic Area, the United Kingdom or another region with similar laws, you also have the right to object to or restrict certain processing, to data portability and to complain to your local data protection authority.
How to exercise your rights
Use our Data Deletion & Privacy Requests page or email contact@acquireman.com. We may ask you to confirm your identity (usually by replying from the email address on your account). We aim to respond within 30 days, and in any case within the 90 days allowed by the DPDP Rules.
You also have duties under Section 15 of the DPDP Act: for example, not to impersonate anyone, not to provide false information and not to file frivolous complaints.
11. Children
The Platform is for adults only. You must be at least 18 years old (or the age of majority where you live, if higher) to use it. We do not knowingly process the personal data of children or carry out tracking, behavioural monitoring or targeted advertising directed at children. If we learn that we have collected a child’s personal data, we will delete it promptly.
12. Marketing communications
We send marketing emails (insights and relevant opportunities) only if you opt in. Every marketing email includes an unsubscribe link, and you can also opt out by emailing contact@acquireman.com. We will still send service messages that relate to your account, requests or agreements.
14. Grievance Officer and contact
For any question, complaint or request about your personal data, please contact our Grievance Officer, who is also the person responsible for answering questions about the processing of personal data on our behalf:
We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days, and in any case within the period allowed by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used our grievance process.
15. Changes to this policy and languages
We may update this policy from time to time. We will show the new effective date at the top of this page and, for significant changes, notify you by email or on the Platform. Where a change requires your fresh consent, we will ask for it.
This policy is available in English and Hindi. You may ask us for it in any other language listed in the Eighth Schedule to the Constitution of India by emailing contact@acquireman.com. If the versions differ, the English version prevails.
16. Our social media channels, YouTube API Services and Google
Acquireman runs official accounts on Instagram, YouTube, X and LinkedIn. To publish our own content, and to read and reply to comments and messages sent to our accounts, we use these platforms’ official programming interfaces, including YouTube API Services. By interacting with our YouTube channel, you also agree to the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy.
What we access: comments and direct messages that you send to our accounts (your public username, account ID, message text and time), and anonymous, aggregated statistics about our own channel’s performance. We never access your Google, YouTube or Instagram account and we never see your passwords.
Why: to reply to you, to recognise genuine business enquiries (for example interest in buying, selling or investing in a company) and, when you ask, to arrange a call with our team. We may use AI tools to sort and draft replies; a person reviews anything that is not a simple reply.
How long: comments and messages are kept for up to 24 months and then deleted, unless they become part of an active business discussion. Data obtained through YouTube API Services is refreshed or deleted in line with YouTube’s Developer Policies.
Your choices: you can ask us to delete your data at any time by emailing contact@acquireman.com. If you have connected any service to Google, you can remove that access at any time at Google’s security settings.