Privacy Policy

1. Introduction

Scrybed LLC ("CastBack", "we", "us", or "our") provides a platform that helps business brokers and M&A intermediaries turn financial documents into traceable financial summaries and share them with prospective buyers through secure deal rooms. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

This policy applies to the CastBack website, application, and related services (the "Service"). It does not cover the practices of third parties we do not control. By using the Service, you acknowledge the practices described here.

2. Information We Collect

We collect the following categories of information, depending on how you use the Service:

• Account and identity information — for brokers, your name, email address, company, and role, obtained when you sign up or sign in (including via single sign-on). For buyers and other guests, the email address you use to request access to a deal room.
• Deal and financial content — the financial documents you upload (such as tax returns and profit-and-loss statements), the data extracted from them, and related deal and company details that brokers add to a deal room.
• Usage and device data — log information such as IP address, browser type, pages and features used, and timestamps, collected automatically when you interact with the Service.
• Cookies and session data — essential cookies that keep you signed in (broker sessions and deal-scoped guest sessions) and analytics cookies that help us understand product usage.
• Access records — logs of which deal rooms were accessed, by whom, and when, used to enforce permissions and provide brokers an access trail.
• Communications — messages you send us, such as support or privacy requests.

3. How We Use Information

We use personal information to:

• Provide, operate, and maintain the Service, including deal rooms and the recasting engine.
• Process uploaded financial documents through automated extraction and artificial-intelligence systems to produce financial summaries, suggested adjustments, and commentary.
• Authenticate users, maintain sessions, and deliver one-time magic-link sign-in emails.
• Secure the Service, prevent fraud and abuse, enforce access permissions, and maintain access logs.
• Analyze and improve product performance, reliability, and usability.
• Communicate with you about the Service, including service and security notices.
• Comply with legal obligations and enforce our agreements.

4. Legal Bases for Processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process personal information under one or more of the following legal bases: performance of a contract with you or your organization; our legitimate interests in operating, securing, and improving the Service (balanced against your rights); your consent where required (such as for certain analytics cookies); and compliance with legal obligations.

5. Automated Processing and AI

The Service uses automated systems and third-party artificial-intelligence model providers to read uploaded financial documents and generate extracted figures, recast values, and narrative commentary. These outputs are estimates produced by software and may contain errors. We instruct our providers to process this content only to deliver the Service and not to train their own models on your data where such controls are offered. The financial outputs are not professional financial, accounting, tax, or valuation advice.

6. How We Share Information

We do not sell your personal information. We share information only as described below:

• Service providers and sub-processors that host and power the Service, including: our application data platform (Bubble), our managed database provider (Neon), our file storage provider (Google Cloud Platform), our product analytics provider (PostHog), our AI model hosting provider (Microsoft Azure), and our email delivery provider for magic links and transactional messages.
• Within a deal room — content a broker adds is shared with the buyers and guests that broker authorizes to access that deal room.
• Legal and safety — when required by law, regulation, legal process, or to protect the rights, property, or safety of our users, the public, or us.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

7. File Handling and Security

We use technical and organizational measures to protect personal information. Data is encrypted in transit. Uploaded files are never served directly to browsers; every file request is proxied through our backend and subject to permission checks before the content is returned. We enforce role- and deal-scoped access controls and maintain access logs. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Data Retention

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Deal-scoped guest sessions expire automatically (by default within seven days). Brokers may request deletion of their account data, and we will honor such requests subject to legal retention requirements.

9. International Transfers

We are based in the United States and process information there. If you access the Service from outside the United States, your information may be transferred to and processed in the United States and other countries that may have different data-protection laws. Where required, we rely on appropriate safeguards for such transfers.

10. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• EEA/UK (GDPR): the rights to access, correct, delete, restrict, and port your data; to object to certain processing; to withdraw consent; and to lodge a complaint with your local supervisory authority.
• California (CCPA/CPRA): the rights to know what we collect, to access and delete your information, to correct inaccuracies, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.
• To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request, and you may use an authorized agent where permitted by law.

11. Children's Privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after an update means you accept the revised policy.

13. Contact Us

If you have questions about this policy or wish to exercise your privacy rights, contact Scrybed LLC at privacy@castback.co.