Privacy Policy

TriStar Business Brokerage, LLC ("TriStar," "we," "us," or "our") is a mergers-and-acquisitions advisory firm that helps owners of privately held businesses plan and execute the sale or succession of their company. This Privacy Policy explains how we collect, use, share, store, and delete information across our websites (including tristarvb.com and tristaradvisory.com), our vertical brands (including our veterinary, contractor, and business brokerage practices), and the tools and services we provide — including our online valuation tools. It applies to website visitors, prospective and current clients, and the business owners we research and contact in the course of our advisory work.

Some features described below — including our online valuation tool and certain accounting and banking integrations — are offered or are being introduced. Where a practice is forward-looking, we describe it here so you understand how your information will be handled if and when you use those features.

Information We Collect

From website visitors. Information you submit through forms — such as your name, email address, phone number, company, and any message you send us — and technical and usage data such as your IP address, device and browser type, pages viewed, and referring URLs, collected through cookies, analytics, and advertising tags (see "Cookies, Analytics, and the LinkedIn Insight Tag").

From prospective clients and business owners we research. To identify owners who may be considering a sale or succession, we compile business and contact information from public and commercial sources. This may include name, title, business name, business address, phone, email, and website; professional license and provider identifiers (such as state-licensing-board numbers and National Provider Identifiers); ownership and firmographic details (such as estimated revenue, employee or staff counts, and years in operation); publicly available reviews; and publicly observable signals relevant to a potential transition.

From clients who use our valuation tools. When you request or use a valuation, we collect owner and ownership information (legal name, contact details, ownership percentages, and entity structure) and the business financial information you provide or upload — such as profit-and-loss statements, balance sheets, tax returns, payroll summaries, bank and credit-card statements, leases, and related diligence documents. Where you choose to connect them, we also receive financial data through accounting and banking integrations (for example, QuickBooks Online and bank-feed providers).

From communications. When you call us or we call you, we may record and transcribe the call (see "Call Recording and Monitoring"). We keep records of emails and text messages, including their delivery status and your opt-in and opt-out preferences.

From LinkedIn and advertising tools. See "Advertising and LinkedIn Data."

How We Collect Information

• Directly from you — through forms, document uploads, calls, and emails.
• From public sources and records — including business websites, public directories, government and professional-licensing records, and publicly available professional profiles.
• From commercial data and enrichment providers.
• From our customer-relationship-management (CRM), advertising, and analytics platforms.

How We Use Your Information

• To provide advisory services and prepare valuations and transaction materials.
• To identify, evaluate, and contact business owners who may be candidates for a sale or succession (our lead-generation and outreach).
• To operate, secure, and improve our sites and tools.
• For marketing and advertising, including measuring, attributing, and targeting our campaigns (see "Advertising and LinkedIn Data").
• To communicate with you and respond to your inquiries.
• To assist our work with AI tools (see "Automated Processing and AI").
• To comply with legal obligations and protect our rights and yours.

Cookies, Analytics, and the LinkedIn Insight Tag

We use cookies and similar technologies for essential site functionality, analytics, and advertising. This includes the LinkedIn Insight Tag and similar advertising pixels, which set first- and third-party cookies and send information such as your IP address, device and browser data, and page activity to providers like LinkedIn and Google to measure ad performance and show relevant ads. You can manage cookies through your browser settings and control ad personalization through your account settings on those platforms and through the choices described in "Your Privacy Rights."

Advertising and LinkedIn Data

We publish content and advertise on LinkedIn and use LinkedIn's marketing tools in compliance with the LinkedIn Marketing API Terms and LinkedIn's Member and Advertising policies. Specifically:

• Insight Tag and conversion tracking. We use the LinkedIn Insight Tag and LinkedIn's Conversions API to measure ad performance and conversions. Where we send conversion data to LinkedIn, we hash identifiers such as email addresses (using SHA-256) before transmission.
• Matched audiences. We may create advertising audiences by uploading hashed (SHA-256) email addresses or business and company information from our CRM so that LinkedIn can match them to its members. We do not receive members' personal data back from these matches.
• Lead Gen Forms. When you submit a LinkedIn Lead Gen Form, LinkedIn shares the information you provide (such as your name, email, company, title, and phone) with us, subject to your consent and this Policy.
• Posting and engagement. We publish posts on our own LinkedIn Company Pages and, with the account owner's authorization, on the personal profile of our principal. We monitor and may respond to public comments on our own posts.

All of our advertising runs on TriStar's own LinkedIn ad account. We handle LinkedIn data only as permitted by LinkedIn's terms, and we do not sell or resell access to LinkedIn data or APIs.

How We Share Information

We do not sell your personal information. We share information only as described below, and only with parties bound by confidentiality and data-protection obligations:

• Service providers and sub-processors who help us operate — for example, our hosting and database provider; telephony and call-transcription providers; email-delivery and CRM providers; advertising and analytics providers (including LinkedIn and Google); data-enrichment providers; payment processors; accounting and banking-integration providers (such as QuickBooks/Intuit and bank-feed providers); and AI-processing providers.
• Professional advisors and transaction parties — in the course of an engagement and at your direction.
• Legal and safety — when required by law, to enforce our agreements, or to protect rights and safety.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

What We Do Not Do

• We do not sell, rent, or share your personal information or contact details with third parties for their own marketing.
• We do not share SMS or phone opt-in consent with third parties or affiliates for marketing purposes.
• We do not use your confidential business or financial information for any purpose other than providing our services to you.
• We do not use your information to train shared or third-party AI models.

Automated Processing and AI

We use AI tools to assist with tasks such as drafting communications, summarizing calls, scoring leads, and preparing draft valuation analyses. AI outputs that affect you are reviewed by our team before we act on them, and any valuation is reviewed by a TriStar professional before it is shared with you. We do not use your information to train shared or third-party AI models, and our AI providers are contractually prohibited from training their models on our inputs. A valuation produced by our tools is an indicative opinion of value for discussion purposes and is not a certified or USPAP appraisal.

Call Recording and Monitoring

We may record and transcribe phone calls for quality, training, accuracy, and record-keeping. Where required by law — including in states that require the consent of all parties — we will notify you and obtain your consent at the start of the call. You may decline to be recorded or ask us not to record at any time.

Data Security

We protect information in transit with TLS encryption and at rest with AES-256 encryption, and we apply application-layer (field-level) encryption to the most sensitive information, such as financial documents and access credentials. Access is restricted to authorized personnel through single sign-on with multi-factor authentication, client data is logically isolated, and access to sensitive records is logged. No method of transmission or storage is completely secure, but we work to protect your information using safeguards appropriate to its sensitivity.

Data Retention

We keep information only as long as needed for the purposes described in this Policy, to comply with legal, tax, and accounting obligations, and to resolve disputes. Financial and engagement records are generally retained for up to seven (7) years. We honor opt-out and do-not-contact requests and maintain suppression records to do so. When we delete field-encrypted data, we may do so by securely destroying the relevant encryption keys.

Your Privacy Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to opt out of targeted advertising; and to withdraw consent. California residents have rights under the CCPA/CPRA (including "Your California Privacy Choices"), and residents of the EU, UK, and similar jurisdictions have rights under the GDPR and comparable laws. We do not sell personal information for money; to the extent cookie-based advertising is considered "sharing" for targeted advertising, you can opt out through your browser controls and the platform settings described above.

This includes information we collect about business owners from public or third-party sources: you may ask us what we hold about you and request that we correct or delete it, subject to our legal retention obligations. To exercise any of these rights, email privacy@tristaradvisory.com or call (877) 313-5263. We will verify your request and respond within the time required by applicable law, and we will not discriminate against you for exercising your rights.

Communications and Opt-Out

You can opt out of our communications at any time: use the unsubscribe link in our emails, reply STOP to a text message, ask to be placed on our do-not-contact list during any call, or email privacy@tristaradvisory.com. We honor opt-out requests and keep a record of them so we do not contact you again.

Children's Privacy

Our sites and services are intended for businesses and adults. We do not knowingly collect personal information from children, and our services are not directed to anyone under 18.

International Users

We operate in the United States, and we store and process information in the United States. If you access our sites or services from outside the United States, you understand that your information will be processed in the United States, where data-protection laws may differ from those in your location.

Third-Party Links

Our sites may link to third-party websites and services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice.

Governing Law

This Policy is governed by the laws of the State of Maryland, without regard to its conflict-of-laws principles.

Contact Us

TriStar Business Brokerage, LLC
5026 Dorsey Hall Dr, Suite 204
Ellicott City, MD 21042
privacy@tristaradvisory.com
(877) 313-5263