Privacy Policy

1. Introduction

Debtigo ("we", "our", or "the Platform") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our debt and lending marketplace platform. Please read this policy carefully. If you disagree with its terms, please discontinue use of the Platform.

2. Information We Collect

We collect information in the following categories:

Account and Profile Information

• Name, email address, and job title
• Organization name, type, and contact details
• Account credentials (passwords are never stored in plaintext)

Engagement and Transaction Data

• Engagement terms, financial details, and use-of-proceeds descriptions
• Documents uploaded to data rooms
• Messages and Q&A thread content between engagement participants
• Meeting notes, call logs, and calendar invitations

Usage Information

• Pages visited, features used, and actions taken on the Platform
• IP address, browser type, and device information
• Log data and access timestamps

Debtigo as a Processor

If you access the Platform through a customer organization's account, Debtigo processes your personal data — including your Account and Profile Information, Usage Information, and Engagement and Transaction Data — on behalf of, and following the instructions of, that customer organization. That customer organization is responsible for providing any notices and obtaining any consents required under applicable law to collect and share your personal data with Debtigo. Debtigo's processing of this data is governed by a separate data processing agreement with that organization.

3. How We Use Your Information

We use the information we collect to:

• Operate and provide the Platform and its features
• Enforce need-to-know access controls — engagement data is visible only to explicitly invited participants
• Send transactional notifications related to engagements you participate in
• Respond to your support requests and inquiries
• Detect and prevent fraud, abuse, and security incidents
• Improve and develop Platform features based on aggregate, anonymized usage patterns
• Comply with applicable legal obligations

We do not sell your personal information or engagement data to third parties, and we do not use engagement content for advertising purposes.

4. Data Sharing

We share your information only in the following circumstances:

• With engagement participants: Information you share within an engagement (documents, messages, profile details) is accessible to other participants explicitly added to that engagement.
• With service providers: We engage trusted third-party vendors (cloud infrastructure, authentication, storage) under strict data processing agreements.
• For legal compliance: We may disclose information when required by law, court order, or to protect the rights and safety of Debtigo or its users.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction with prior notice.

5. Data Security

We implement technical and organizational measures designed to protect your information against unauthorized access, disclosure, alteration, and destruction:

• All files are encrypted at rest using AES-256-GCM before being written to storage — no plaintext data is ever persisted
• All data in transit is protected by TLS 1.2 or higher
• Access to engagement data is enforced through application-layer authorization checks on a need-to-know basis, with direct database access restricted to Debtigo's backend service layer
• Authentication is handled via industry-standard JWT tokens with short expiry windows

No security system is impenetrable. If you believe your account or data has been compromised, please contact us immediately at security@debtigo.com.

If we determine that a security incident has resulted in unauthorized access to or disclosure of your Personal Data, we will notify affected individuals without unreasonable delay, by email to the address associated with your account or by notice on the Platform. That notice will describe the nature of the incident, the categories of information involved, and the steps we are taking in response. Where required by applicable law, we will also notify the relevant regulatory authorities within the applicable timeframe.

6. Data Retention

We retain your account and engagement data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. Engagement documents retained in data rooms are subject to the access controls in place at the time of retention. You may request deletion of your personal data by contacting us at legal@debtigo.com, subject to any legal or contractual retention requirements.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your personal data (subject to legal retention obligations)
• Object to or restrict certain processing activities
• Receive your data in a portable, machine-readable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, please contact us at legal@debtigo.com. We will respond within the timeframe required by applicable law.

8. Cookies

The Platform uses session cookies strictly necessary for authentication and maintaining your logged-in state. We do not use third-party advertising cookies or tracking pixels.

9. International Transfers

Your information may be processed in countries other than your own. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Platform. Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: