Privacy Policy

1. Introduction

Debtigo ("we", "our", or "the Platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our debt and lending marketplace platform. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Platform.

2. Information We Collect

We collect information in the following categories:

Account and Profile Information

• Name, email address, and job title
• Organization name, type, and contact details
• Account credentials (passwords are never stored in plaintext)

Deal and Transaction Data

• Deal terms, financial details, and use-of-proceeds descriptions
• Documents uploaded to data rooms
• Messages and Q&A thread content between deal participants
• Meeting notes, call logs, and calendar invitations

Usage Information

• Pages visited, features used, and actions taken on the Platform
• IP address, browser type, and device information
• Log data and access timestamps

3. How We Use Your Information

We use the information we collect to:

• Operate and provide the Platform and its features
• Enforce need-to-know access controls — deal data is visible only to explicitly invited participants
• Send transactional notifications related to deals you participate in
• Respond to your support requests and inquiries
• Detect and prevent fraud, abuse, and security incidents
• Improve and develop Platform features based on aggregate, anonymised usage patterns
• Comply with applicable legal obligations

We do not sell your personal information or deal data to third parties, and we do not use deal content for advertising purposes.

4. Data Sharing

We share your information only in the following circumstances:

• With deal participants: Information you share within a deal (documents, messages, profile details) is accessible to other participants explicitly added to that deal.
• With service providers: We engage trusted third-party vendors (cloud infrastructure, authentication, storage) under strict data processing agreements.
• For legal compliance: We may disclose information when required by law, court order, or to protect the rights and safety of Debtigo or its users.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction with prior notice.

5. Data Security

We implement technical and organisational measures designed to protect your information against unauthorised access, disclosure, alteration, and destruction:

• All files are encrypted at rest using AES-256-GCM before being written to storage — no plaintext data is ever persisted
• All data in transit is protected by TLS 1.2 or higher
• Access to deal data is enforced at the database level through row-level security policies on a need-to-know basis
• Authentication is handled via industry-standard JWT tokens with short expiry windows

No security system is impenetrable. If you believe your account or data has been compromised, please contact us immediately at security@debtigo.com.

6. Data Retention

We retain your account and deal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Deal documents retained in data rooms are subject to the access controls in place at the time of retention. You may request deletion of your personal data by contacting us at legal@debtigo.com, subject to any legal or contractual retention requirements.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data (subject to legal retention obligations)
• Object to or restrict certain processing activities
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at legal@debtigo.com. We will respond within the timeframe required by applicable law.

8. Cookies

The Platform uses session cookies strictly necessary for authentication and maintaining your logged-in state. We do not use third-party advertising cookies or tracking pixels.

9. International Transfers

Your information may be processed in countries other than your own. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Platform. Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: