Privacy Notice

About this notice

MergeVista LLC ("MergeVista," "we," "us," or "our") provides an AI-powered IT M&A execution platform and is responsible for the personal information described in this notice. This notice applies to our public website at mergevista.com and to personal information we handle to provide and secure the platform. A customer’s use of the platform may also be governed by its agreement with MergeVista LLC, including any applicable data-processing terms.

For information a customer uploads to or manages in its workspace, the customer generally determines why and how that information is processed and MergeVista processes it to provide the service on the customer’s behalf. Users should direct workspace-data requests to their organization in the first instance.

Information we collect

Information you provide

When you request a demo or contact us, we may collect your first and last name, work email address, company, job title or role, transaction interest and any optional message you provide. We also collect information you send to us by email.

Website and device information

We use Google Analytics to understand how our website is used. It may collect information such as pages viewed, interactions, session information, browser and device type, approximate location and an online identifier stored in a cookie. Google states that IP addresses are used to derive approximate location and are discarded before the data is logged in Google Analytics.

Platform and sign-in data

Account invitations and Microsoft sign-in

When an authorized workspace administrator invites you, we process your name, business email address, organization and assigned workspace roles. MergeVista uses Microsoft Entra ID and Microsoft’s business-to-business invitation service for platform sign-in. Microsoft may provide identifiers such as your name, email or username, Microsoft tenant identifier and Microsoft user object identifier. MergeVista does not receive your Microsoft password.

Platform activity

We process workspace membership, role and permission assignments, invitation and account status, authentication method, sign-in and security events, audit history, and technical information needed to operate, diagnose and protect the service. We also process content and records that authorized users enter, import or upload to their organization’s workspace.

Sessions and local credentials

The platform uses essential authentication cookies to maintain signed-in sessions. Where a customer environment permits a MergeVista-managed local account, passwords are stored using a one-way salted hash rather than in readable form.

How we use information

We use personal information to:

• Respond to inquiries and arrange product demonstrations.
• Create invited accounts and provide authorized access to customer workspaces.
• Authenticate users and administer roles, permissions and account lifecycles.
• Operate, secure, troubleshoot and improve our website and platform.
• Maintain audit history and investigate security or support events.
• Measure website performance and understand aggregate usage patterns.
• Comply with applicable law and protect our rights, users and services.

Where applicable, we rely on consent, legitimate interests, steps taken at your request before entering a contract, compliance with legal obligations, or a customer’s instructions under our contract. We do not sell personal information covered by this notice or use it to make solely automated decisions that produce legal or similarly significant effects.

Cookies and analytics

Google Analytics uses cookies and similar technologies to distinguish browsers and provide usage statistics. Depending on applicable law and the choices available in your browser, you may be able to block or delete these cookies. Doing so may affect measurement but should not prevent you from viewing the website.

Google processes analytics information under its own terms and privacy practices. Learn more in Google’s Privacy Policy.

How information is shared

We may share information with service providers that help us host, authenticate, secure, analyze and operate our services or communicate with you, including Microsoft Azure and Entra ID, Google Analytics and our business email providers. These providers may process information only to deliver their services to us and under their applicable contractual obligations.

Workspace information may be available to the customer organization that manages the workspace and to users whom that organization authorizes, according to their assigned access. If optional AI capabilities are enabled, relevant workspace content may be sent to the configured AI service to perform the customer-requested operation.

We may also disclose information when required by law, to protect rights or safety, or in connection with a merger, financing, acquisition, reorganization or sale of assets. Our providers may process information in countries other than your own; where required, we use appropriate safeguards for these transfers.

Retention and security

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, the applicable customer relationship, and legal, accounting, contractual and security requirements. Account, audit and security records may be retained after access ends when needed for accountability, dispute resolution or security. When information is no longer required, we delete or anonymize it where reasonably practicable.

We use administrative, technical and organizational safeguards designed to protect personal information. You can learn more on our Security & Trust page. No online service or transmission is completely secure, so we cannot guarantee absolute security.

Your choices and rights

Depending on where you live, you may have rights to request access to, correction of or deletion of your personal information, or to restrict or object to certain processing. You may also withdraw consent where processing is based on consent. These rights can be subject to legal exceptions.

You can manage cookies through your browser settings. You may opt out of non-essential marketing emails using the unsubscribe option in the message or by contacting us. To correct or remove a platform account or customer-workspace record, contact your workspace administrator; you may also contact MergeVista for assistance. Our website and platform are intended for business users and are not directed to children.

Changes to this notice

We may update this notice as our practices, services or legal obligations change. We will publish the updated notice here and revise the effective date above. Material changes may also be communicated through another appropriate channel.