Crassus Partners LLC ("Crassus Partners," "we," "us," or "our") respects the confidentiality of everyone we work with. This policy explains what information we collect through our website and client portal, how we use it, and the choices you have.
1. Scope
This policy covers crassuspartners.com and our client portal (the pages under login.html, portal.html, and related addresses). It does not cover information you may separately share with us in the course of an engagement — that is governed by the engagement letter, confidentiality agreement, or other contract between you and Crassus Partners.
2. Information We Collect
Information you provide directly:
- Contact form submissions — name, company, title, email, phone number, inquiry type, and any message you include.
- Deal flow distribution signups — name, firm, title, email, phone number, industries of interest, and minimum EBITDA of interest.
- Client portal accounts — email address, a password (stored only as a one-way cryptographic hash — we never store or can retrieve your actual password), display name, and, if you choose to sign in with Google or Microsoft, the name and email address those providers share with us.
Information collected automatically:
- Standard technical information our hosting infrastructure (Cloudflare) logs for every visitor — IP address, browser type, and pages requested — used only for security and reliability, not for advertising.
- Within the client portal: sign-in activity, and a record of which folders and documents you've viewed, so we can show you what's new and maintain an audit trail over confidential deal materials.
We do not use third-party advertising trackers, ad pixels, or analytics cookies on this site, and we do not sell personal information.
3. How We Use Information
- To respond to inquiries submitted through our contact form.
- To send deal flow opportunities matching the criteria you provide, if you sign up for our distribution list.
- To create and secure your client portal account, notify you when new documents are available, and maintain a record of document access for the deals you're party to.
- To protect against fraud, abuse, and unauthorized access to confidential deal information.
4. How We Share Information
We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We do share information with a small number of service providers who process it on our behalf, strictly to deliver the services above:
- Web3Forms — processes contact form and deal flow signup submissions.
- Google — our deal flow signups are also logged to a private Google Sheet via Google Apps Script for our own recordkeeping; if you choose "Sign in with Google" on the client portal, Google verifies your identity for that sign-in only.
- Microsoft — if you choose "Sign in with Microsoft" on the client portal, Microsoft verifies your identity for that sign-in only.
- Resend — sends transactional emails on our behalf (invitations, password resets, sign-in verification codes, and new-document notifications).
- Cloudflare — hosts our website and client portal, and stores portal account data and uploaded documents on our behalf. Documents are encrypted at rest.
- hCaptcha — helps us tell human visitors from automated bots on our public forms.
We may also disclose information if required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Crassus Partners, our clients, or others.
5. Cookies and Local Storage
Our client portal uses a small number of cookies that are strictly necessary for it to function: a session cookie that keeps you signed in, and — briefly, during sign-in — a cookie that protects the Google/Microsoft sign-in process from forgery. Both are deleted automatically or on sign-out. If you check "remember my email" on the sign-in page, your email address (never your password) is saved in your browser's local storage so it's prefilled next time; this stays on your device and is never sent to us. We do not use cookies for advertising or cross-site tracking.
6. Data Security
Portal passwords are hashed using PBKDF2-SHA256 and are never stored or transmitted in plain text. Every sign-in — by password or by Google/Microsoft — requires a second, one-time verification code sent to your email. Uploaded deal documents are encrypted at rest and are only ever accessible to the specific buyer group or staff member they were shared with; access is enforced on every single request, not just at sign-in. No method of transmission or storage is completely secure, but we design and review this system with confidential deal information specifically in mind.
7. Data Retention
We retain contact and deal flow signup information for as long as it remains useful for the purpose it was collected, or until you ask us to remove it. Client portal accounts and associated activity records are retained for the duration of the relevant engagement and for a reasonable period afterward for our own recordkeeping, unless a longer period is required by law or a signed agreement.
8. Your Choices
You can ask to be removed from our deal flow distribution list, or ask what information we hold about you, corrected, or deleted, at any time by reaching out through our Contact page. We will respond promptly and honor reasonable requests, subject to our own recordkeeping and legal obligations.
9. Children's Privacy
Our website and portal are intended for business use and are not directed to, and we do not knowingly collect information from, anyone under 16 years of age.
10. International Visitors
Crassus Partners is based in the United States, and information we collect is processed and stored in the United States. If you are accessing our site or portal from outside the United States, you understand that your information will be transferred to and processed in the United States.
11. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or for legal or operational reasons. The "Last updated" date at the top will always reflect the most recent revision. Material changes affecting client portal users will be communicated directly.
12. Contact Us
Questions about this policy or how we handle your information can be directed to us through our Contact page.