1. Scope
This policy covers everything you touch on Your Exit Path: the marketing site, the Exit Calculator, the standalone tools (Sellability Score, Net Proceeds, Who Buys My Business, etc.), the owner and advisor dashboards, the buyer deal room, and the matches share page.
2. What we collect
Assessment & tool inputs
When you use the Exit Calculator or any of the standalone tools, you may share financial and operational data about your business — annual revenue, SDE / EBITDA, industry, state, employee count, customer concentration, growth rate, and similar. Inputs are tied to a first-party session identifier until you provide an email address.
Account data (auto-created on form submit)
When you submit any lead-generating form — Exit Calculator, Get Matched, Sellability Score, Net Proceeds, Who Buys My Business, the consultation booker, or the business-valuation gate — we automatically create an owner account tied to the email you provided and sign you in with a short-lived temporary session. This lets you open your dashboard, retake tools, and see prior submissions without repeating the form.
The account starts as unverified. We email you a magic link at the same time. Clicking it verifies your mailbox and upgrades the session to a normal 30-day cookie. Until then, the temporary session lasts 7 days on the device you submitted from.
Contact & consent data
Contact forms and consultation bookings capture your name, email, optional phone, and any notes you provide. We also record whether you consented to marketing follow-up (the checkbox next to submit). Bookings additionally store the date, time, and time zone of the meeting slot you selected.
Deal-room documents & NDAs
If your advisor invites you to a deal room, we store the uploaded documents, activity log (who viewed what and when), and any NDA you signed. Buyers who request access are recorded with name, email, company, and the timestamp of NDA acceptance. Deal-room contents are visible only to the listing owner, the assigned advisor, admins, and buyers whose access has been granted.
Usage data
Standard server-side logs (page URL, referrer, coarse IP-derived location, user agent, response status). If you opt in to marketing cookies (see below), we may also load a first-party product-analytics script.
3. Cookies & local storage
We use two categories of cookies. The choice is stored in the yep_cookie_consent cookie and can be revisited any time from the Cookie Settings link in the footer.
Essential (always on)
yep_session— the primary sign-in cookie. HttpOnly, SameSite=Lax.yep_admin— legacy shared-password admin gate. Still honored for break-glass access.yxp_matches_unlock_<id>— per-share-link unlock proof for the public /matches page password gate. 30-day TTL.yep_cookie_consent— your consent record itself. Without it we’d prompt you on every visit.- Anti-CSRF and session-hygiene cookies set by Next.js.
Marketing (opt-in, defaults on for US visitors)
- Product-analytics cookies (page views, funnel events).
- Third-party iframes (e.g. embedded video) that set their own cookies. We only load these when you have marketing consent.
We do not use third-party advertising cookies, remarketing pixels, or cross-site trackers.
Local storage (browser only, never sent to us)
yep_a11y_prefs— your accessibility widget preferences (font size, high-contrast, reduced motion, etc.).yep_theme— light / dark theme choice.yep_hero_search_v1— the last hero search you ran, so refreshing the page doesn’t lose it.
4. How we use your data
- Produce the valuation, readiness score, buyer-fit analysis, and personalized recommendations you asked for.
- Match you (with your consent) to advisors, buyers, or capital partners.
- Sign you in automatically after a form submit and keep your submissions grouped under one account.
- Send the specific report or booking confirmation you requested; if you opted in, related product and market updates.
- Aggregate de-identified metrics to improve our valuation methodology — see §5.
- Detect abuse, prevent fraud, and secure the service.
5. Machine-calculated outputs
Valuations, readiness scores, sellability grades, buyer-fit estimates, and every other numeric output on the site are produced by our own models from the inputs you provide. They are directional estimates, not appraisals, and an experienced M&A advisor will validate them manually before any real-world decision. See our Terms of Service for the full disclaimer.
We use aggregated data — for example, median SDE multiples for HVAC businesses in Florida — to improve these models. Aggregated data never identifies any individual business or owner.
6. Sharing
We share your data only in these cases:
- With your explicit consent — e.g. when you request an intro to an advisor, book a consultation, or grant a buyer deal-room access.
- Password-gated public share links. The
/matches/<id>page can be opened by anyone who has both the URL and the password you set from your dashboard’s Share settings. We do not publish share URLs anywhere; you distribute them yourself. - Advisors and admins. The M&A advisor you’re matched with, and platform administrators acting in a support or moderation capacity, can view your submitted information to serve you. Admin actions are logged.
- Service providers operating on our behalf under confidentiality obligations (hosting on Cloudflare, email delivery, database).
- Legal compliance — to comply with law, court order, or to protect the rights, property, or safety of anyone.
We do not sell your personal information. We do not run third-party advertising on the service.
7. Your rights & choices
- Access, correction, deletion. Email privacy@yourexitpath.com from the address associated with your account.
- Cookie preferences. Open Cookie Settings at the bottom of any page to change your marketing-cookie decision.
- Marketing emails. Every marketing email includes an unsubscribe link. Transactional emails (booking confirmations, security alerts) don’t.
- Share-link revocation. Rotating your share password from the Share settings panel immediately invalidates any prior unlock cookies.
- EU/UK residents have the additional rights set out in GDPR. California residents have the additional rights set out in the CCPA/CPRA, including the right to opt out of sale (we don’t sell personal information, so this opt-out is honored by default).
8. Security
Data is transmitted over TLS and stored on infrastructure operated by Cloudflare. Passwords — including the share-link passwords you set — are stored as PBKDF2-SHA256 hashes with per-record salts, never in plaintext. Session cookies are HttpOnly and SameSite=Lax by default. Access to production systems is limited to the smallest reasonable set of staff and is logged.
9. Retention
Accounts, assessments, and match requests are retained while your account is active or as needed to provide the service. Deal-room documents follow the retention terms of the deal you’re part of. If you’d like your data deleted sooner, email privacy@yourexitpath.com from the account address.
10. Accessibility
The site includes a built-in accessibility widget (bottom-left) for font-size, contrast, reduced motion, and other options. See our accessibility statement for our current WCAG conformance target and how to report an issue.
11. Children
The service is intended for adult business owners and their advisors. We do not knowingly collect data from children under 18.
12. Changes
If we change this policy, we’ll update the “last updated” date and, for material changes, notify you by email at the address on your account.
13. Contact
Questions about this policy? Email privacy@yourexitpath.com or reach us at /contact. For cookie-specific questions, see also our cookie policy.