How is this different from a traditional data room?

Every data room today — from a Dropbox folder to a purpose-built VDR like Datasite or Ansarada — is a store of static documents that go stale the moment you upload them. dealflow.fyi reads live from your Stripe, MongoDB, PostHog and ClickHouse — the same systems a buyer would verify against — and refreshes every document from that source on a single command.

Where do the numbers actually come from?

Directly from your production systems via read-only connections. Each sync writes a dated, immutable snapshot, and every figure in every document traces back to the exact file that produced it.

We use restricted, read-only keys and never write to your systems. Snapshots are immutable, access is confidential, and the full history is auditable — you can always see exactly what was pulled and when.

What is the Agent-Readiness report?

It scores how discoverable and usable your product is to AI agents — the fastest-growing class of buyer. As agents begin selecting and purchasing software autonomously, agent-readiness becomes a real driver of value, and the report makes it legible to an acquirer.

What kinds of businesses do you work with?

Software, API, and autonomously-run internet businesses, generally between $1M and $50M in enterprise value. If your revenue and usage live in systems we can read, we can build the room.

Do you replace my banker and lawyer?

No — we make them faster. We own the data and the documents so diligence moves quickly; your counsel handles the paper and your banker handles the relationship. Everyone works from one source of truth.

How does pricing work?

The Data Room product is a flat monthly fee you run yourself. Managed Sale is a success fee — from 2% of transaction value — where we run the process end to end on top of the same product. Studio is bespoke for funds and serial acquirers.

Privacy Policy

Last updated: August 22, 2026

dealflow.fyi is a living M&A data room and deal service, operated by Startups Studio ("dealflow.fyi", "we", "us"). This policy explains what we collect, how we use and share it, and the choices you have — across our marketing website, the data room product, and the deal service we run on top of it. It is written to be accurate to what the product actually does, not to be exhaustive boilerplate. Questions: team@do.industries.

In plain terms

We connect to your business systems with read-only credentials and never write to them.
We use your data to build and run your data room and to move your deal forward — nothing else.
During a sale, diligence materials are shared only with the buyers you choose, under confidentiality.
We do not sell your data, and we do not use your confidential data to train publicly available AI models.
You can export or delete your data, and disconnect our access, at any time.

Who this policy covers

It applies to three audiences: visitors to our website; sellers (and their teams) who engage us to build a data room; and buyers / acquirers who register interest or receive diligence materials. Where we process data on a seller's behalf, the seller is the data controller and we act as their processor — see "Our role" below.

Information we collect

Information you give us. When you join the waitlist, request access, or contact us, we collect what you provide — typically your name, work email, and company. Buyers who register a thesis provide contact details and investment criteria (strategy, sectors, revenue range, check size). Customers provide account and billing information and the content of their communications with us.

Data from your connected systems. To build a living data room, we connect to the production systems you authorize — such as your payment processor, databases, product analytics, and data warehouse — using restricted, read-only credentials. The data we read may include revenue and transaction records, subscription and usage data, and customer or user records. Some of this is personal data about your customers or users; we process it only to produce your data room and its documents, on your behalf.

Meeting information. With participants' knowledge, we may capture structured summaries or transcripts of deal meetings and attach them to the deal timeline.

Information collected automatically. Like most websites and applications, we collect basic technical data — IP address, device and browser type, and log and usage information — to operate, secure, and improve the service. Our marketing website uses only essential cookies and no third-party advertising trackers.

How we use information

We use information to create and operate your data room; generate buyer-specific diligence documents and the AI Traction & Agent-Readiness report; run the deal process (research and contact acquirers, prepare materials, support diligence and negotiation); communicate with you; bill for the service; keep the service secure; and comply with legal obligations.

Our role: controller and processor

For our website and our own business records, we are the data controller. For the data we read from a customer's connected systems and place in their data room, the customer is the controller and we are their processor — we process that data only to provide the service and on the customer's instructions, never for our own purposes and never to build a separate profile of anyone. Business customers can contact us for our data processing terms.

How we share information

With buyers you choose. The purpose of a data room is to share diligence materials with prospective acquirers. During a sale, the seller controls which buyers receive access, and materials are shared under confidentiality. We do not disclose a seller's data room to anyone the seller has not approved.

With service providers (subprocessors). We rely on a small set of vetted providers to run the service — for cloud hosting and infrastructure, databases and analytics, communications, payment processing, and the AI models used to generate documents and reports. They may process data only to provide services to us, under contract. A current list of subprocessors is available on request.

For legal and safety reasons. We may disclose information if required by law, to enforce our agreements, or to protect the rights, safety, and security of our users or the public.

In a business transfer. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will honor the commitments in this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

Artificial intelligence

We use AI to generate diligence documents and to score agent-readiness. AI is used with human oversight; we do not make decisions producing legal or similarly significant effects about an individual solely by automated means. We do not permit your confidential business data to be used to train publicly available AI models.

Data retention

We keep information for as long as needed to provide the service and for legitimate business and legal purposes. Within the data room, each sync writes a dated, immutable snapshot, so history is preserved and auditable for the life of the engagement. When an engagement ends, you can ask us to delete your data; disconnecting an integration revokes our read-only access immediately.

Security

We design for verification without exposure. We request read-only, least-privilege credentials and never write to your systems. Data is encrypted in transit and at rest, access is restricted and confidential, snapshots are immutable, and the full history is auditable. Please do not send credentials by email — we will share a secure method.

International transfers

We may process information in countries other than where you are located. Where we do, we take steps to keep it protected consistent with this policy and applicable law.

Your rights and choices

Subject to applicable law, you may request to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Sellers can export or delete their data room contents and disconnect integrations at any time. California residents have the right to know, delete, and opt out of any "sale" of personal information — and as noted above, we do not sell it. To exercise a right, email team@do.industries; we will respond as required by law. Where we process data on a customer's behalf, we will refer requests to that customer.

Children

The service is intended for businesses and is not directed to children, and we do not knowingly collect personal information from children.

Changes to this policy

We will update this page if our practices change and revise the "last updated" date above. We will communicate material changes to customers.

Contact

Questions, requests, or privacy and security concerns: team@do.industries. dealflow.fyi is operated by Startups Studio.