Privacy Policy

Teasr Technologies Limited (“teasr”, “we”) is a company registered in England and Wales with company number 17430351. Our registered office is Foxglove Barn, Wellhouse Farm, Eling Hermitage, Thatcham, RG18 9UH. We are registered with the Information Commissioner’s Office, registration number ZC273867.

For anything about your personal data, email hello@teasr.co.uk or write to us at the registered office. We have not appointed a data protection officer; the founders deal with data protection directly. To make a complaint, see section 14.

Data protection law treats us in two different ways on this platform.

• We are the controller for the personal data we decide how to use: accounts and sign-in, billing, keeping the service secure, the record of our own staff's access, buyers' own investment criteria, owner profiles shown to advisers, Companies House data, the free readiness check, Ask teasr, the emails we send and your preferences about them, and analytics on this website. Every section of this notice except section 5 is about these.
• We act for someone else for the documents and deal information an advisory firm or a seller puts on the platform. The firm or seller is the controller and decides how that information is used; we are their processor and follow their instructions under our Data Processing Addendum. Section 5 covers this, including what to do if you are named in one of those documents.

The readiness check asks for nine figures you already know. There is no account and nothing to upload, and it does not use AI. Your answers stay in your browser. They are not sent to us and no record of them is written. Close the tab and they are gone, so there is nothing for us to show you or to erase.

There are three exceptions, all of them your choice:

• If you ask us to email you the result, the nine figures and the address you typed are sent to us, the result is rebuilt on our server, and one message goes out. Neither the figures nor your address is stored (beyond the email record in section 12), and you are not added to any list.
• If you choose to save the check to an account, your answers are held in your browser while you sign up and then saved to your account, where they are kept with your account records.
• A counter stops the email field being used to send mail to strangers. It records that something was sent against a one-way hash of your IP address, not the address itself, and is deleted after seven days.

If you start the check from the homepage, the turnover figure you typed is carried in the web address (/check?turnover=…). The check removes it from the address bar as soon as it has read it, but the request that loaded the page can reach our hosting provider's logs. It is one figure with no name attached, and going to /check directly avoids it. Analytics never receives it (section 13).

The lawful bases below are those in Article 6 of the UK GDPR. “Contract” means the processing is needed for a contract with you, or for steps you asked for before one. “Legitimate interests” means it is needed for an interest of ours or of someone else that is not outweighed by your rights; the interest is named in each case.

Where we rely on legitimate interests you can object at any time (section 14). Where we rely on consent you can withdraw it at any time, without affecting what was done before.

Do you have to give us this? No law requires you to. Account and billing details are needed to provide the service, so without them we cannot open an account or take an order. Everything else is optional, and leaving it out only means the feature that uses it does not work for you.

Where it comes from. Mostly from you. Some comes from elsewhere: your firm, if it set up your account or invited you; whoever invited you; Stripe, which tells us whether a payment succeeded; Cloudflare, which tells us whether the security check was passed; and Companies House, whose register is public. We use no third-party error monitoring and buy no data about anybody.

Companies House data. When we look up a company we do not write to its directors or others named in its filings to tell them: it is information they have already published on a public register, it is used only for the comparison above, and contacting them would be disproportionate and could reveal a confidential sale. This notice is published so they can read what we do with it, and they have the rights in section 14.

When an advisory firm or a seller (including a business owner selling without a firm) puts information on the platform to prepare or run a sale, they decide how it is used, and we act on their instructions under our Data Processing Addendum. That covers:

• the business profile and intake: financial history, adjustments to profit, shareholdings and owners' pay, customers, risks, and the reason for sale;
• documents uploaded to the workspace or the data room, and anything in them about employees, directors, customers, suppliers or anyone else;
• the teasr, the Investment Memorandum and the Exit Readiness Report prepared from that information, and our team's review of them;
• the firm's own buyer lists, the bidders and stages in a data room, questions and answers exchanged with bidders, and confidentiality acceptances given to the seller;
• the record kept for the seller of who opened which document, when, and from what IP address, and the watermarks printed on copies released to buyers (section 8).

If you are named in a document on teasr, for example as an employee of a business being sold, the firm or seller that uploaded it is responsible for telling you about it and for answering your requests. Ask them first. If you contact us instead, we will pass your request to them promptly and help them answer it, and we will tell you that we have done so. We do not tell people named in uploaded documents ourselves, because we receive their details from the firm or seller, not from them.

We do not use deal documents for anything else. We do not use one customer's deal information for another customer, to build benchmarks or market data, to train or test AI models, or to develop our prompts. We use it only to provide the service the firm or seller asked for. The exceptions are records we keep for our own security and accountability (section 4), which we control ourselves.

The sub-processors who handle this information for us are the suppliers in section 10 (Anthropic, Supabase, Vercel and Resend). How long it is kept is for the firm or seller to decide (section 12).

Some features use AI models made by Anthropic, which processes what we send as our processor. Anthropic does not use customer content from its API to train its models. It deletes what we send, and what its models return, within 30 days, unless content is flagged under its usage policy, in which case it may keep it for up to two years. It publishes its own sub-processors at anthropic.com/subprocessors.

Information is sent to Anthropic in these ways, and no others:

• To write a teasr. The business information from the intake goes to the model. The company's legal name, trading names, website and contact names are held back: only our own automated checks see them, and they reject any version in which one appears.
• To write an Investment Memorandum. The facts held about the business and the project codename.
• To file a document in the data room. The company's name, the file's name, the folder it was uploaded from, and up to the first 12,000 characters of its text, masked as described below, so the model can suggest where it belongs.
• To read figures from financial statements. The file's name and the masked text of the pages holding the statements (or, where none is recognised, the opening pages), so figures can be offered for the seller to confirm.
• To suggest an answer to a buyer's question. The question, and the masked text and file names of documents that buyer's group can already open. The seller or their firm reads and edits the suggestion before anything is sent to the buyer.
• To write an Exit Readiness Report. The analysis behind the report, including the name of the business, its figures and any Companies House figures, so the model can write the summary and the 90-day plan. No documents are sent for this.
• To answer a question typed into Ask teasr. The question.

The free readiness check sends nothing to a model.

What is masked, and what is not. Before document text is sent, email addresses, National Insurance numbers, IBANs, sort codes, UK phone numbers and any run of seven or more digits are replaced with a label. A document our scan finds to hold health or other special-category records is not sent to a model at all. The masking does not remove names, job titles, salaries, dates of birth or home addresses, so a document that names people, such as a staff list, can reach Anthropic with those details in it.

Every teasr and Investment Memorandum is reviewed and certified by a person before anyone else sees it. Nothing a model writes is published automatically. Where the transfer to Anthropic goes is in section 11.

We make no decision about anyone that has a legal or similarly significant effect on them based solely on automated processing. The AI writes, and a person decides.

One thing is automatic and worth knowing about. If a firm chooses to release a deal to verified buyers whose criteria fit, the platform shows the anonymised teasr to each verified buyer whose own stated sectors, regions and deal sizes include it. That is a yes-or-no test of criteria you set yourself, never a score or a ranking, and a blank criterion never excludes you. If you think you are missing deals, or seeing the wrong ones, change your criteria or contact us and a person will look at it.

Copies released to buyers are marked so that a leaked copy can be traced:

• a teasr carries the name of the receiving organisation and the date it was released;
• an Investment Memorandum and its data book carry the reader's name (or email address, where no name is held), their organisation, and the date of release;
• a data room document opened by a buyer carries the reader's name, email address, IP address and the time of download.

A watermarked copy then exists outside our systems, and we cannot recall it. The data room also records who opened which document, when and from what IP address. That record is kept for the seller, as their evidence of what was disclosed to whom (section 5).

Our own staff are recorded too. When an administrator at teasr opens a seller's submission or documents, that is logged with who it was and when. The seller can read their own rows and nobody can edit them, so the answer to “has anyone at teasr seen my accounts?” does not depend on our say-so.

When you have finished the Exit Readiness Report you may choose to be visible to advisory firms that subscribe to the platform. It is off until you switch it on, finishing the report does not switch it on, and switching it off removes you.

While it is on, a subscribing firm can see:

• your sector and sub-sector, and your region;
• turnover, profit and headcount as bands, never as exact figures;
• the summary you approved, what kind of sale you are considering, and whether management would stay;
• how long your profile has been open.

They do not see your identity: not your company's legal name, a trading name, your website or where you are. A firm that wants to talk to you sends a request; your contact details pass only when you decide, and we record when that happened. We do not rank or score you, and no firm pays for a place on the list.

Our suppliers act on our instructions as processors unless the table says otherwise.

The links: Stripe's privacy notice is at stripe.com/gb/privacy and Cloudflare's at cloudflare.com/turnstile-privacy-policy.

We do not sell personal data or share it for anyone else's marketing. We may disclose it where the law requires, for example to a court or a regulator, or to a buyer of our business, who would be bound by this notice.

Some suppliers process data outside the UK. Each transfer is covered as follows:

You can ask us for more detail about any of these safeguards using the contact details in section 1.

Some periods are enforced by the code, which deletes the data automatically. Others are our policy, carried out by hand, because automatic deletion has not been built for them yet. The table says which is which.

A watermarked copy already downloaded by a buyer is outside our systems and cannot be deleted by us.

We use only cookies that keep you signed in, remember your display settings, and protect the sign-in pages. We use no advertising or cross-site tracking. Our Cookie Policy lists each one.

Analytics. Vercel Web Analytics counts page views on this site without cookies. It receives the page's route (with query strings removed and deal ids, invitation tokens and similar codes replaced), the referring page, your browser, operating system and device type, and your country. Vercel identifies a visit with a hash it discards after 24 hours. We use it only to improve the site, and you can switch it off on the Cookie Policy page, free and without giving a reason. It also counts, with nothing about you attached, when the film on our home page is played, reaches halfway or finishes, and which button is pressed at its end; those counts pass through the same switch.

The security check. The sign-in, sign-up and password-reset pages use Cloudflare Turnstile to keep automated attacks out, as described in section 10. It runs on every visit to those pages but is invisible unless Cloudflare needs you to complete a challenge. It does not read what you type into the form.

You have the right:

• to be told how your data is used (this notice);
• to a copy of your personal data;
• to have inaccurate data corrected;
• to have your data erased, in some circumstances;
• to restrict how we use it, in some circumstances;
• to receive data you gave us in a portable form, where we rely on contract or consent;
• to object to processing we base on legitimate interests;
• to withdraw consent at any time, where we rely on it; and
• not to be subject to a decision based solely on automated processing that significantly affects you (section 7).

How to use them. Signed in, your account page lets you download a copy of your data and ask us to delete your account. For anything else, email hello@teasr.co.uk. We will respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you why within the first month. We may ask you to confirm your identity first. Our searches are reasonable and proportionate, as the law allows.

Limits worth knowing. For deal documents (section 5), the firm or seller decides, and we pass your request to them. A copy already released to a buyer cannot be recalled. And some records, such as a seller's record of what was disclosed to whom, may need to be kept to establish or defend legal claims even when you ask for them to be erased; if so, we stop any further use of your details and tell you what is kept and why.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first. Use the data protection complaint form, or email hello@teasr.co.uk with “Data protection complaint” in the subject. We will acknowledge your complaint within 30 days (the form does so straight away), look into it, and tell you the outcome without undue delay.

You can also complain to the regulator, the Information Commission, which still uses the name ICO: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO usually expects you to have complained to us first.

Documents are held in private storage and reached only through short-lived links issued after your entitlement has been checked. Access is enforced in the database itself, not only in the application, so a fault in one screen cannot expose another user's data. teasr's own administrator accounts must use two-factor sign-in with an authenticator app, and the database refuses administrator access to a session that has not passed it. Anyone else can add an authenticator app for two-factor sign-in from their account page. Every release of a confidential document is recorded.

teasr is a business service and is not meant for anyone under 18. We do not knowingly collect children's data.

When we change this notice we update the date at the top. If a change materially affects how we use data you have already given us, we will tell account holders by email before it takes effect.