Privacy Policy

Canira, Inc., which operates Exit Ready, is the controller of the personal information described here. Contact us at privacy@exitready.com.

Where you upload information about other people — an employee named in an org chart, a customer named in a contract — you are the controller of that information and we process it for you. Section 9 covers what that means in practice.

Almost all of it is information you type in or upload.

We do not ask for and do not want special-category information — health, biometrics, political or religious views. Please do not upload it.

• To run your account and provide the features you signed up for.
• To calculate your readiness score and generate the tasks, checklists and documents that follow from it.
• To show a listing you chose to publish, and to operate the request → approve → sign → access flow of the data room.
• To send you transactional email: a buyer requested access, a seller approved you, an NDA is waiting for signature, a payment failed.
• To take payment and manage your subscription.
• To keep the platform secure, and to investigate abuse.
• To comply with the law.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not run advertising on the platform. We do not use your confidential business information to train AI models.

Only the service providers below, each processing on our instructions and only for the purpose listed. This is the complete list.

We will also disclose information:

• When the law requires it, or in response to valid legal process. Where we are permitted to tell you, we will.
• To protect the rights or safety of users or the public, or to investigate fraud or a security incident.
• In a merger, acquisition or sale of our assets — in which case we will tell you before your information becomes subject to a different policy.

This is the part most people actually want to know, so it is stated exactly.

Before you list anything, no other user sees any part of your business data. Assessments and documents are private to your organisation from the moment you create them.

If you publish a listing, buyers on the platform see your industry, a revenue band, employee count, years in business, region, your readiness score and grade, and any summary you wrote. If you listed anonymously, your company name is replaced with a generic label and is not sent to the buyer’s browser at all.

Your diligence gaps are never published. The weaknesses your assessment identified are yours. They are not shown in the marketplace, and not shown to a buyer who bookmarks your listing.

Data room documents are released only to a buyer who asked, whom you approved, and who then signed the NDA — and only those at or below the access level you granted, and only those you marked active. Files are delivered through links that expire in about a minute.

A buyer’s private notes on your business — their contacts, notes, tasks and deal stage — are visible only to that buyer. They are not shown to you, and not to other buyers.

• While your account is open: as long as you keep it, because it is your working record.
• After you close your account: deleted within 30 days.
• Backups: age out on their own cycle, up to 90 days after deletion.
• Signed NDAs and their signature evidence: kept for 7 years. These are legal records that you or the counterparty may need to rely on, and deleting them would destroy the proof that a signature happened.
• Billing records: kept as long as tax and accounting law requires.
• Server logs: typically 30 days.

Depending on where you live, you may have the right to access a copy of your information, correct it, delete it, object to or restrict certain processing, receive it in a portable format, and withdraw consent you gave.

Much of this you can do yourself in the product: edit your business details, delete a document, unlist a listing, revoke a buyer’s access, close your account. For anything else, email privacy@exitready.com and we will respond within 30 days.

We will not discriminate against you for exercising these rights. If you are in the EEA or UK you may also complain to your local data protection authority; if you are in California you may authorise an agent to act for you.

One limit worth stating honestly: we cannot retrieve information a buyer has already seen or downloaded. Deleting a document removes it from the platform, not from the memory or the hard drive of someone you shared it with.

Data is encrypted in transit and at rest. Access to your organisation’s records is enforced in the database itself rather than only in the application, so a bug in one screen cannot expose another organisation’s data. Data room files are stored privately and served only through short-lived links generated per download. Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach affects your personal information we will notify you and any regulator as the law requires, without undue delay.

To report a vulnerability, email security@exitready.com.

Your documents will often contain other people’s information — employees, customers, suppliers. For that information you are the controller and we are your processor: we hold it, we do not use it for our own purposes, and we act on your instructions.

Before you upload, make sure you are entitled to share it. Customer and supplier contracts frequently restrict disclosure, and putting a document in a data room is a disclosure. Redacting names you do not need to share is usually the simplest answer, and buyers rarely need them at an early stage.

We use cookies only to keep you signed in and to remember display preferences such as light or dark mode. We do not use advertising or cross-site tracking cookies, so there is no consent banner to click through.

Our providers are based primarily in the United States, so your information may be processed there. Where we transfer personal information out of the EEA or UK we rely on Standard Contractual Clauses or another lawful transfer mechanism.

Exit Ready is for business use and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

If we change this policy materially — particularly if we add a provider to section 4 or send a new category of data somewhere — we will tell you by email or in the product before the change takes effect. The effective date at the top tells you which version you are reading.

See also our Terms of Service.