Privacy Policy

The data controller is X23 Capital OÜ, registry code 16927377, Sepapaja 6, 15551 Tallinn, Estonia. X23 Capital OÜ operates FAIR under the X23 Labs product brand.

For privacy questions, requests, or concerns, contact us at fair@x23labs.com.

This Privacy Policy applies to personal data processed in connection with:

• FAIR Accounts and subscriptions
• The FAIR dashboard and related product features
• Company briefings and information submitted to FAIR
• Support requests and service communications
• Billing and payment administration
• FAIR waitlists
• The FAIR website and related communications

This Policy does not govern third-party websites, services, or content that may be linked from FAIR.

We collect personal data that is reasonably necessary to provide, secure, support, and improve FAIR.

Account data. When you create or use a FAIR Account, we may process:

• Name
• Email address
• Account identifier
• Authentication and account-status information
• Hashed password, where password-based authentication is used
• Plan and subscription status
• Account preferences

We do not store passwords in readable form.

Company briefing data. FAIR enables you to provide information about your company so that the Service can generate relevant acquisition-intelligence Outputs. This may include:

• Company name and website
• Industry, sector, business model, and target customers
• Company stage and location
• Revenue range
• Core technology or product information
• Competitors and potential acquirers
• Target exit range and timeline
• Business description and strategic objectives
• Other information you voluntarily include in free-text fields

Some fields are optional. You should not submit special-category personal data, confidential third-party information, or information you are not authorised to share unless necessary for your intended use of FAIR and supported by an appropriate legal basis.

Usage and product data. We may process limited information about how you use FAIR, including:

• Login date and time
• Last sign-in date
• Features used
• Acquirers or companies saved, watched, or reviewed
• Plan status
• Product configuration and preferences
• Technical events necessary to operate, secure, and troubleshoot FAIR

FAIR does not use behavioural-advertising trackers or create advertising profiles based on your use of the Service.

Security and log data. To protect FAIR and investigate security incidents, we may process:

• IP address
• Browser type and device-related technical information
• Requested pages or service endpoints
• Login timestamps
• Failed sign-in attempts
• Security alerts and fraud-prevention events
• Administrative-access records
• System, error, and access logs

Billing data. Payments are processed by Stripe. We do not receive or store full payment-card details. We may process or receive from Stripe:

• Stripe customer identifier
• Subscription identifier
• Payment status
• Billing country and currency, where provided
• Invoice and transaction reference information
• Plan and subscription details

Stripe processes payment information under its own privacy and security arrangements.

Waitlist data. If you join a waitlist for a FAIR feature or boutique/adviser offering, we may process:

• Email address
• Name, if provided
• Company, firm, role, or similar professional details, if provided
• Communication preferences
• Records of your consent or request to be contacted

We collect personal data:

• Directly from you when you register, submit a briefing, contact us, join a waitlist, or use FAIR
• Automatically from your device or browser where necessary to operate and secure FAIR
• From payment providers in connection with billing and subscription administration
• From publicly available sources where FAIR identifies companies, transactions, acquirers, market activity, or related business information
• From authorised Users acting on behalf of a Customer organisation

Where we rely on legitimate interests, those interests include operating a secure and reliable service, preventing fraud and misuse, protecting our rights, improving product performance, and maintaining business records. You may object to such processing as described below.

FAIR may use artificial-intelligence systems to analyse the company briefing you provide and generate or support acquisition-intelligence Outputs, including acquirer-fit analysis, rankings, rationales, market signals, and summaries.

For this purpose, portions of your briefing and relevant market-context data may be included in prompts sent to Anthropic as our service provider. We instruct Anthropic to process this information only to provide services to us and not to use FAIR Customer Data to train general-purpose models.

AI-generated Outputs may be inaccurate, incomplete, outdated, or unsuitable for your circumstances. You should independently verify Outputs before acting on them.

We do not use solely automated processing to make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

X23 Capital OÜ operates FAIR and may also provide M&A advisory services through its business.

We recognise that information submitted to FAIR may reveal sensitive commercial information, including potential future sale intentions, strategic priorities, revenue ranges, potential buyers, and transaction timing.

Your identifiable FAIR data is used only to provide, maintain, secure, support, and operate FAIR for you.

We do not use, disclose, or make available your identifiable FAIR data for:

• Any M&A advisory engagement
• Any advisory client
• Any purpose adverse to you
• Cross-selling advisory services unless you have separately opted in
• Training general-purpose AI models without your express written agreement

We may use aggregated or anonymised information that does not reasonably identify you, any User, or your business to maintain, secure, analyse, and improve FAIR.

If you opt in to hear about advisory support, we may contact you using the contact details you provide. This opt-in is optional. FAIR works in the same way whether or not you opt in. You can turn it on or off at any time in your account settings, and you may also withdraw consent by emailing fair@x23labs.com or using an available unsubscribe mechanism.

We keep a record of when you gave or withdrew this consent, so we can demonstrate the basis on which we contacted you. Withdrawal does not affect the lawfulness of processing carried out before it.

We use selected service providers to operate FAIR. They process personal data only as needed to provide their services to us and subject to applicable contractual confidentiality and security obligations.

As with any browser request to a third-party service, logo.dev may receive limited technical information from your browser, such as IP address, browser or device information, request time, and the requested company domain.

We do not sell personal data.

We do not disclose Customer Data to M&A advisory clients or use it for advisory engagements, except where you separately engage us and a separate lawful basis applies.

We may disclose personal data where necessary to:

• Comply with applicable law, court orders, or lawful requests by public authorities
• Protect the rights, safety, security, and property of X23, FAIR, Customers, Users, or others
• Enforce our Terms of Service or investigate fraud, abuse, or security incidents
• Support a corporate transaction, such as a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality protections and applicable law

Some service providers may process personal data outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, we use an appropriate transfer mechanism under applicable data-protection law. Depending on the provider and transfer, this may include:

• A European Commission adequacy decision
• Participation in the EU–US Data Privacy Framework, where applicable
• European Commission Standard Contractual Clauses
• Supplementary technical, contractual, and organisational safeguards where appropriate

You may request further information about applicable transfer safeguards by contacting fair@x23labs.com.

A limited number of authorised X23 personnel may access Account data where necessary to operate, secure, maintain, troubleshoot, or support FAIR. For example, during a support interaction, an authorised operator may temporarily view your dashboard or Account information to reproduce a problem or provide requested assistance.

We use access controls designed to limit access to personnel with a legitimate operational need. Administrative access is recorded in an audit log retained for a period proportionate to security, accountability, and legal-compliance purposes.

We use reasonable technical and organisational measures designed to protect personal data. No system can be guaranteed completely secure. You should protect your Account credentials and notify us promptly of suspected unauthorised access.

We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

You may delete your FAIR Account through the relevant account settings, including the "Danger zone" function where available.

When you delete your Account, we will delete or anonymise your Account profile, briefing, radar data, saved buyers, signals, and related product data from active systems, subject to:

• Legal, tax, accounting, fraud-prevention, and security-retention requirements
• The need to establish, exercise, or defend legal claims
• The time required for deletion from backups and disaster-recovery systems
• Information retained in non-identifiable, aggregated, or anonymised form

If you have an active paid subscription, deleting your Account may cancel the subscription where the product flow states this. You remain responsible for fees accrued before cancellation, subject to applicable law and the Terms of Service.

Subject to applicable law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete personal data
• Request deletion of your personal data
• Request restriction of processing
• Object to processing based on legitimate interests
• Request data portability where applicable
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with a supervisory authority
• Object to direct marketing at any time

To exercise your rights, email fair@x23labs.com. We may need to verify your identity before responding. We will respond within the period required by applicable law and may explain if a right is limited or does not apply in particular circumstances.

If you are in the European Economic Area, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in your habitual residence, place of work, or place of the alleged infringement.

LGPD applies to our processing of personal data of individuals in Brazil, since FAIR is offered to founders there. If you are located in Brazil, you have applicable rights under LGPD, subject to the conditions and limits of applicable law.

FAIR is intended for business users and is not directed to children.

We do not knowingly collect personal data from anyone under 18. If you believe that a child has provided personal data to us, contact fair@x23labs.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in FAIR, our data practices, legal requirements, or security measures.

If we make a material change, we will provide notice by email, through FAIR, or both, before the change takes effect where reasonably practicable.

The current version will always be available on the FAIR website and will show its "Last updated" date.