This policy explains what BrokerFolder collects, why, and what happens to it. It covers two different groups of people: the brokers who hold accounts, and the buyers who are given access to a listing.
1. Who is responsible
BrokerFolder is operated by [LEGAL ENTITY NAME], [registered address], which is the controller of the personal data described here. Contact: [email protected].
An important distinction. For data a broker uploads about their own clients and buyers, the broker decides what is collected and who sees it. We hold and process that material on their behalf and under their instruction. For account data about the broker themselves, we are the controller.
2. If you hold an account
What we collect
- Name, email address, and brokerage name
- Authentication data — a hashed password, session records, and login timestamps
- Billing details. Card numbers are handled by our payment processor and are never stored on our systems
- Support correspondence you send us
- Product usage records — active listings, documents stored, buyer records, and NDAs sent — recorded per brokerage per month
Why
To provide the service and keep your account secure, to take payment, to answer support requests, and to understand aggregate usage so we know which parts of the product to build next. Usage figures are counts, not the contents of your deals.
3. If you are a buyer given access to a listing
A broker using BrokerFolder may invite you to view a listing. In that case we hold:
- Your name and email address, as supplied by you or the broker
- The answers and documents you submit in a qualification form — which may include proof of funds, financing plans, and background information
- Your acknowledgment of a non-disclosure agreement, recorded with a timestamp, your IP address, your browser user-agent, and the legal name you typed
- A record of every document you view or download, with the time it happened
Document access is logged and visible to the broker. This is a deliberate feature, not incidental analytics. If you open a set of financials, the broker who granted you access can see that you did, and when. It exists so brokers can tell genuine interest from inactivity — and so that access to confidential seller information is accountable.
The broker controls this data. We collect it on their instruction. If you want your information corrected or removed, contact the broker you are dealing with first. If you cannot reach them, contact us and we will help.
You do not need a BrokerFolder account as a buyer. Access works through a secure link sent to your email address.
4. Confidential deal documents
Seller financials, tax returns, leases, and similar material uploaded by brokers are the most sensitive data we hold. They are:
- Stored on private storage that is not publicly accessible and not indexed by search engines
- Served through short-lived signed links generated only after an access check
- Released only when the broker has granted access — with financials sitting behind a second, separate grant from the overview documents
- Logged on every view and download, attributed to a named buyer
We do not read the contents of your deal documents except where you ask us to in support, or where we are compelled by law. We do not use them to train machine learning models, and we do not sell or share them.
5. Separation between brokerages
Every listing, buyer, and document belongs to exactly one brokerage, and the system is built so that no broker can access — or detect the existence of — another brokerage's data. This is enforced independently at two layers in the application, and is verified by an automated test suite.
6. Who else processes your data
We use a small number of service providers to run BrokerFolder. Each has access only to what their function requires:
- Cloud hosting and database — [PROVIDER], [region]
- Document storage — [PROVIDER], [region]
- Email delivery — [PROVIDER], for notifications and access links
- Payment processing — [PROVIDER]. They handle card data; we do not store it
- Demo scheduling — [PROVIDER], for booking calls from our website
We do not sell personal data, and we do not share it with advertisers.
7. International transfers
Our providers may process data in [REGIONS]. Where data leaves the region it was collected in, transfers are covered by the safeguards those providers offer, such as standard contractual clauses.
8. How long we keep it
- Active accounts — for as long as the account is open
- After cancellation — 90 days, so reactivating restores your deal history. Then deleted from active systems, and from backups in line with our backup rotation
- NDA acknowledgments and document access logs — retained with the related listing, since they are the audit record of who saw confidential information. Deleted with the account under the same 90-day schedule
- Billing records — kept as long as tax and accounting law requires, which is typically longer than the above
9. Security
Data is encrypted in transit. Documents are held on private storage reachable only through expiring signed links issued after an access check. Passwords are hashed, never stored in readable form. Access to production systems is limited to those who need it.
No system is perfectly secure. If a breach affects your data, we will notify you and any relevant regulator as the law requires.
10. Your rights
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to or restrict processing, receive it in a portable format, or complain to a data protection authority.
To exercise any of these, email [email protected]. We will respond within the period the applicable law allows. If your request concerns data a broker uploaded about you, we may need to refer you to that broker, who decides what happens to it.
11. Cookies
We use cookies that are necessary for the service to function — keeping you signed in and protecting forms against cross-site request forgery. We do not use advertising cookies or third-party tracking pixels on the application.
12. Children
BrokerFolder is a business tool and is not directed at anyone under 18. We do not knowingly collect data from children.
13. Changes
We may update this policy. For material changes we will notify account holders by email at least 30 days before they take effect, and update the date at the top of this page.
14. Contact
Questions, requests, or complaints: [email protected]