This Privacy Policy explains how NXT Global Technologies LLC, operator of Exit Spring (“Exit Spring,” “we,” “us” or “our”), handles personal information when you visit exitspring.com, create an account, buy or sell a business, or subscribe to our newsletter. For personal information we collect through the Services, we are the data controller.
1. Information we collect
Information you give us
- Account details: your name, email address and password. Passwords are stored in hashed form by our authentication provider, and we never see them in plain text.
- Seller submissions: business name, website, niche, business model, revenue and profit figures, asking price, a description of the business, and any documents you send us.
- Buyer activity: Listings you unlock or save, offers you make and the messages you include with them, and saved search filters.
- Payments: when you pay a deposit, Stripe collects your card details directly. We receive only the payment status, amount, your email address and a transaction reference, never your full card number.
- Communications: emails, calls and other messages you exchange with our team.
- Newsletter: your email address and where you signed up.
Information collected automatically
- Usage and device data: pages visited, referring site, approximate location derived from your IP address, browser, device type and the time of your visit. We collect this through Vercel Web Analytics, which does not use cookies and reports visits in aggregate.
- Cookies and local storage: used to keep you signed in and remember a few preferences. See our Cookie Policy.
- Security logs: IP addresses and request records our hosting and authentication providers keep to protect the Services.
2. How we use your information
- To create and secure your account and provide the Services.
- To show you Listings, give you access to unlocked information, pass your offers to Sellers and coordinate diligence and closing.
- To assess, value, prepare and market businesses submitted for sale.
- To process deposits and refunds.
- To send account and transaction emails, and, if you are subscribed, our newsletter and new-listing alerts.
- To answer your questions and provide support.
- To understand how the site is used and improve it.
- To prevent fraud and misuse, enforce our Terms of Service and meet legal obligations.
When you create an account, we also add your email address to our newsletter. Every newsletter includes an unsubscribe link, and unsubscribing does not affect your account or transaction emails.
3. How we share information
We do not sell your personal information or share it for cross-context behavioral advertising. We share it only as follows:
- Between buyers and sellers: when you make an offer or pursue a deal, we share your name, contact details and offer with the Seller. When a Seller's business is under offer, we share the business information needed for diligence with that Buyer.
- Service providers who process data for us under contract and only on our instructions (listed below).
- Transaction partners, such as escrow agents or transfer specialists, when you are part of a deal that uses them.
- Legal and safety reasons: to comply with the law, respond to valid requests from authorities, protect our rights and users, or investigate fraud.
- Business transfers: if we are involved in a merger, acquisition or sale of assets, personal information may be transferred to the new owner, who must honor this policy. We will tell you before your information becomes subject to a different privacy policy.
Service providers we use
| Provider | Purpose |
|---|---|
| Supabase | Account login, database and file storage |
| Stripe | Card payments and refunds for deposits |
| Resend | Account emails, deal notifications and the newsletter |
| Vercel | Website hosting and privacy-friendly, cookie-free visit analytics |
4. Legal bases (EEA and UK users)
If you are in the European Economic Area or the United Kingdom, we rely on:
- Contract: to provide the account and Services you asked for;
- Legitimate interests: to run, secure and improve the marketplace and prevent fraud, where your rights do not override those interests;
- Consent: for the newsletter and any optional communications, which you can withdraw at any time; and
- Legal obligation: where the law requires us to keep or disclose information.
5. How long we keep information
We keep personal information only as long as we need it for the purposes above. Account information is kept while your account is open and deleted or anonymized within 90 days after you ask us to close it. We keep transaction and payment records for up to seven years to meet tax, accounting and legal obligations, and we may keep information longer where needed to resolve disputes or enforce agreements. Aggregated analytics contain no personal identifiers.
6. International transfers
We are based in the United States, and our providers may process data in the United States and other countries. Where we transfer personal information from the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
7. Security
We protect personal information with measures including encrypted (TLS) connections, hashed passwords, access controls on our database and limiting staff access to those who need it. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as the law requires.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and receive a copy in a portable format;
- correct information that is inaccurate or incomplete;
- delete your information;
- object to or restrict certain processing;
- withdraw consent where we rely on it; and
- not be discriminated against for exercising these rights.
To make a request, email inquiries@exitspring.com. We will verify your identity before acting and respond within the time the law requires, normally 30 days (45 days for California requests). You may use an authorized agent. If you are in the EEA or UK, you can also complain to your local data protection authority.
California residents: in the past 12 months we have collected identifiers, commercial information (such as offers and deposits), internet activity, approximate location and professional information about businesses you own, for the purposes described above. We have not sold or “shared” personal information as those terms are defined under California law.
Do Not Track: there is no common standard for Do Not Track signals, so we do not respond to them. We do not track you across other websites.
9. Children
The Services are for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
10. Links to other sites
Listings and articles may link to websites we do not operate. Their privacy practices are their own, so please review their policies.
11. Changes to this policy
We may update this policy as our Services or legal requirements change. We will post the new version here and update the date above, and we will notify you by email or on the site before material changes take effect.
12. Contact us
For privacy questions or requests, email inquiries@exitspring.com or call +1 (626) 619-1054.