Who we are
Discoperi M&A Intelligence is a professional data service providing verified mergers and acquisitions deal intelligence to corporate development professionals, private equity associates, investment bankers, and M&A lawyers.
The data controller responsible for your personal data is:
Registration: [Estonian Business Registry number — insert upon registration]
Registered address: [Estonian registered address — insert upon registration]
VAT number: [EU VAT number — insert upon VAT registration]
Privacy contact: [email protected]
Website: discoperi.com
Because our service is accessible worldwide and we collect data from users in the EU, UK, and California, this policy is designed to meet the requirements of all four frameworks simultaneously. Where these frameworks conflict, we apply the stricter standard.
What data we collect
We collect only what we need. Below is a complete list of every category of personal data we collect, how we collect it, and why.
| Category | Data points | When collected |
|---|---|---|
| Account registration | First name, last name, email address, password (hashed), company name (optional) | When you create an account or start a free trial |
| Payment information | Billing name, billing address, VAT number (optional), payment method token (we never store card numbers — these are held by Stripe or your payment processor) | When you subscribe to a paid plan |
| Contact enquiries | Name, email, message content, company name, enquiry type | When you submit a contact form or email us |
| Deal alert preferences | Sector preferences, deal size filters, geography filters, delivery method | When you configure deal alerts in your account |
| Advertising submissions | Company name, contact name, email, ad creative, destination URL | When you enquire about or book advertising |
| Corrections & feedback | Email (optional), message content, URL of content concerned | When you submit a correction or feedback form |
| Category | Data points | How collected |
|---|---|---|
| Usage data | Pages visited, deal articles read, search queries, time on page, scroll depth, clicks | Analytics cookies and server logs |
| Technical data | IP address, browser type and version, operating system, screen resolution, referring URL, device type | Server logs, analytics |
| Session data | Login timestamps, session duration, features used, exports downloaded | Application server |
| Email engagement | Email opens, link clicks, unsubscribes (digest emails only) | Email service provider tracking pixels |
| Advertising data | Ad impressions served, ad interactions (via Google AdSense). We do not receive individual user identity from Google for these interactions. | Google AdSense (third-party) |
How we use your data
We use your personal data for the following purposes only. We never sell your personal data to third parties.
- Providing the service: Creating and managing your account, delivering deal alerts, processing your subscription, enabling data exports, and providing customer support.
- Billing and payments: Processing subscription payments, issuing invoices and tax receipts, handling refunds, and maintaining financial records as required by law.
- Communications: Sending your weekly deal digest (if subscribed), transaction emails (receipts, password resets, subscription confirmations), and service updates. We do not send unsolicited marketing emails.
- Service improvement: Understanding how users interact with our deal database, which sectors are most read, and how to improve the product. This uses aggregated and anonymised data wherever possible.
- Security and fraud prevention: Detecting and preventing fraud, unauthorised access, and abuse of the platform.
- Legal compliance: Meeting our obligations under tax law, data protection law, and other applicable regulations.
- Advertising (free tier only): Displaying contextual and interest-based advertising via Google AdSense on our free public content pages. Paid subscribers never see advertising. See Section 6 for full details.
Lawful basis for processing (GDPR)
Under the GDPR, we must identify a lawful basis for every processing activity. The following table sets out our lawful bases.
| Processing activity | Lawful basis | Notes |
|---|---|---|
| Account creation and management | Contract | Necessary to perform the service you signed up for (Article 6(1)(b)) |
| Subscription billing and invoicing | Contract | Necessary to fulfil the subscription contract (Article 6(1)(b)) |
| Transaction emails (receipts, alerts) | Contract | Necessary to perform the service (Article 6(1)(b)) |
| Weekly deal digest email | You opt in to the digest at sign-up. You may unsubscribe at any time (Article 6(1)(a)) | |
| Analytics and product improvement | Legitimate interest | Improving the service — balanced against your rights (Article 6(1)(f)). Anonymised where possible. |
| Security monitoring and fraud prevention | Legitimate interest | Protecting the platform and users (Article 6(1)(f)) |
| Advertising cookies (free visitors) | Non-essential cookies require explicit consent via cookie banner (Article 6(1)(a)) | |
| Tax and accounting records | Legal obligation | Required under Estonian/EU tax law (Article 6(1)(c)) |
| Responding to legal requests | Legal obligation | Compliance with applicable law (Article 6(1)(c)) |
Cookies and tracking technologies
We use cookies and similar technologies to make our service work and to understand how it is used. You can control non-essential cookies at any time.
When you first visit discoperi.com, a cookie consent banner asks for your preferences for non-essential cookies. You can change your preferences at any time by clicking "Cookie settings" in the footer of any page.
You can also manage cookies in your browser settings. Note that blocking essential cookies will prevent the site from functioning correctly — specifically, you will not be able to log in to a paid account.
- Google Chrome: Settings → Privacy and security → Cookies and other site data
- Mozilla Firefox: Preferences → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data
Advertising — Google AdSense
We display advertising on our free public content pages. Paid subscribers do not see advertising. This section explains how that advertising works.
We use Google AdSense, an advertising service provided by Google LLC (Google Ireland Limited for EU users), to display advertisements on our free content pages including deal listings, sector pages, and deal articles.
Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to discoperi.com or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to users based on their visits to our site and/or other sites on the internet.
Google AdSense may use the information gathered by its cookies to show you advertisements that are relevant to your interests. This is known as interest-based advertising or personalised advertising. This means that if you visit a website about M&A activity, you may subsequently see advertisements related to financial services, software, or professional services on other websites.
Users may opt out of personalised advertising by visiting Google Ads Settings.
Additional opt-out options:
- Google Ads Settings — control Google's use of your data for personalised ads
- aboutads.info/choices — opt out of interest-based advertising from participating NAI member companies
- youronlinechoices.eu — opt-out tool for EU residents
- Declining advertising cookies via our cookie consent banner when you first visit the site
- Shown: Public deal listing pages, public deal article pages, sector pages, and the homepage — when viewed by non-subscribers
- Never shown: Any page viewed by a logged-in paid subscriber, checkout and billing pages, the account dashboard, API documentation pages, and any page within the subscription flow
For more information about how Google collects and uses data from sites that use its advertising services, visit: policies.google.com/technologies/partner-sites
Google's privacy policy is available at: policies.google.com/privacy
Third parties and sub-processors
We share your personal data with the following third-party service providers ("sub-processors") who help us operate the service. We have Data Processing Agreements in place with each sub-processor.
| Sub-processor | Purpose | Data shared | Location | Policy |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management | Billing name, billing address, payment token | US / EU | stripe.com/privacy |
| Google LLC (Google Ireland Ltd for EU) | AdSense advertising, Analytics, Search Console, Site Kit | Cookies, IP address, browsing behaviour on our site (anonymised for Analytics) | US / EU | policies.google.com/privacy |
| Anthropic, PBC | AI content generation for deal articles (Claude API) | Deal data and article text — no personal user data is shared | US | anthropic.com/privacy |
| Amazon Web Services | Cloud hosting, database, file storage | All application data, encrypted at rest | EU (Ireland) | aws.amazon.com/privacy |
| Mailchimp / Mandrill (Intuit Inc.) | Transactional email delivery, weekly digest | Email address, name, digest preferences, email engagement data | US / EU | mailchimp.com/legal/privacy |
| Wise Payments Limited | Business banking and payment receipt (our bank account provider) | Payment details for wire/bank transfer customers | UK / EU | wise.com/legal/privacy |
| Google Search Console | SEO monitoring — no personal user data processed | Site performance data only, no individual user data | US / EU | policies.google.com/privacy |
We do not sell, rent, or trade your personal data with any third party for their own marketing purposes. Sub-processors are contractually bound to use your data only for the specific purpose for which we engage them.
Data retention
We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law.
| Data category | Retention period | Reason |
|---|---|---|
| Account data (active subscribers) | Duration of subscription + 12 months | Service operation; 12-month window for reactivation |
| Account data (cancelled accounts) | 12 months after cancellation | Dispute resolution, reactivation |
| Payment records and invoices | 7 years | Estonian / EU tax law requirements (7-year financial record retention) |
| Email communications (support, corrections) | 3 years | Dispute resolution; quality assurance |
| Server logs (IP addresses, access logs) | 90 days | Security monitoring; fraud detection |
| Analytics data (anonymised) | 26 months | Google Analytics default; anonymised — no individual identification |
| Cookie consent records | 3 years | Evidence of consent for regulatory compliance |
| Deal alert preferences | Duration of subscription + 30 days | Deleted with account data |
When retention periods expire, data is securely deleted or anonymised. If you request deletion of your account before the retention period expires, we will delete all data not subject to a legal retention requirement (such as tax records).
International data transfers
Some of our sub-processors are based outside the European Economic Area (EEA). When we transfer your data outside the EEA, we ensure appropriate safeguards are in place.
Several of our sub-processors, including Stripe, Google, Anthropic, and Mailchimp, are based in the United States. We rely on the following safeguards for these transfers:
- EU–US Data Privacy Framework (DPF): Where sub-processors are certified under the DPF (currently Stripe and Google), this adequacy decision provides the legal basis for transfer.
- Standard Contractual Clauses (SCCs): For all other US-based sub-processors, we have executed the European Commission's Standard Contractual Clauses (2021 version, Module 2: Controller to Processor). SCCs are also maintained as a fallback for DPF-certified processors in the event the DPF framework is invalidated.
Our AWS hosting uses the EU (Ireland) region. Our Google Analytics data is processed via Google Ireland Limited. These transfers remain within the EEA and do not require additional safeguards.
Your rights under the GDPR
If you are located in the European Economic Area or the United Kingdom, you have the following eight rights over your personal data. You can exercise any of these rights by emailing [email protected]. We will respond within 30 days.
Email [email protected] with the subject line "Data rights request — [type of request]". We will verify your identity and respond within 30 days. For complex requests, we may extend this by a further two months — we will notify you if this is necessary.
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with your local data protection supervisory authority. As an Estonian entity, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee. EU residents may also contact their national supervisory authority (see: edpb.europa.eu). UK residents may contact the Information Commissioner's Office (ICO): ico.org.uk.
California residents — CCPA / CPRA
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
In the past 12 months, we have collected the following categories of personal information as defined by the CCPA:
- Identifiers: Name, email address, IP address, account ID
- Commercial information: Subscription plan, payment history, products purchased
- Internet or network activity: Browsing history on our site, deal pages viewed, search queries
- Professional or employment-related information: Company name (if provided)
- Inferences: Inferences drawn from the above to understand preferences (e.g. sector interests for deal alerts)
- Right to know: You may request disclosure of the specific personal information we have collected about you and how it has been used and shared.
- Right to delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
- Right to opt out of sale / sharing: We do not sell personal information. We do not share personal information for cross-context behavioural advertising for monetary consideration. Google AdSense may use cookies for interest-based advertising — you may opt out as described in Section 6.3.
- Right to correct: You may request correction of inaccurate personal information.
- Right to limit use of sensitive personal information: We do not collect sensitive personal information as defined by the CPRA.
- Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights. Exercising your rights will not affect your access to our services or the prices you pay.
To exercise any of these rights, email [email protected] or use our contact form. We respond to verifiable requests within 45 days.
Children's privacy
Discoperi is a professional B2B service intended for use by individuals aged 18 and over. We do not knowingly collect personal data from children under the age of 18. If you believe a child under 18 has provided us with personal data, please contact us at [email protected] immediately. We will delete such data promptly upon verification.
Security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration.
- Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS). This is enforced on all pages — there is no unencrypted HTTP access to discoperi.com.
- Encryption at rest: All data stored in our database is encrypted at rest using AES-256 encryption via AWS RDS encryption.
- Password security: User passwords are hashed using bcrypt with appropriate cost factors. We never store passwords in plaintext.
- Payment security: We are PCI DSS compliant. Card payment details are never transmitted to our servers — they are processed directly by Stripe's PCI DSS Level 1 certified infrastructure.
- Access controls: Access to personal data is restricted to staff who need it for their work, using role-based access controls. All internal access is logged.
- Security monitoring: We monitor for unusual access patterns and security incidents continuously.
Data breaches
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Where the breach is likely to result in a high risk to individuals, we will also notify affected individuals directly without undue delay.
Breach notifications to individuals will be sent to the email address associated with your account. Please ensure your email address is kept up to date in your account settings.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Send an email notification to all registered users at least 14 days before the changes take effect
- Display a notice on our homepage and deal pages for the 14-day notice period
- For material changes that affect the legal basis or purpose of processing, seek fresh consent where required by the GDPR
Previous versions of this Privacy Policy are available on request by emailing [email protected].
Contact us
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
For data subject requests, GDPR questions, and privacy concerns. We respond within 30 days (GDPR) or 45 days (CCPA).
For general questions about the service, advertising, or corrections to published content.
[Registered address in Estonia — insert upon company registration] · discoperi.com/privacy-policy
Legal disclaimer: This Privacy Policy was last reviewed on 22 March 2026. It is provided for informational purposes. While we have endeavoured to make it accurate and compliant with applicable law, this document does not constitute legal advice. Discoperi OÜ is registered in Estonia, European Union. For Estonian supervisory authority: aki.ee. For UK residents: