The Boring Desk runs sale processes for limited-partnership interests. Doing that means handling two sensitive things: who you are, and what you own. This page says plainly what we collect, why, who else touches it, and how to get it back or get rid of it.
Who this covers
This policy applies to theboringdesk.com and to the seller, buyer, and advisor dashboards behind it. It covers three groups of people: visitors who fill in one of our inquiry forms, sellers who list a fund interest, and buyers who apply to join the buyer network. It does not cover what a fund manager, a fund administrator, or a counterparty does with information after we pass it to them in the ordinary course of a transaction — their own privacy terms govern that.
What we collect
If you fill in an inquiry form
The contact, advisory, NAV-lending, and indicative-range forms on the marketing site all post to the same endpoint and create a lead record. Between them they collect your name, work email, phone number, firm or entity name, title, the role you selected (seller, buyer, adviser), the fund name and commitment size if you choose to give them, your stated advisory focus, and whatever you write in the free-text box. An email or a phone number is required so we can reply; everything else is optional. The lead is stored in our database and also emailed to the desk so a banker sees it.
If you sign up as a seller
- About you: first and last name, title, organization, phone number, and work email. Your account itself (email, password or Google sign-in, email verification) is created and held by Clerk, our authentication provider — we never see or store your password.
- About the position: transaction type, fund name, GP or fund manager, vintage year, strategy, and, where you provide them, NAV, commitment, unfunded amount, and per-fund detail for a multi-fund portfolio listing.
- Documents you upload: typically the limited partnership agreement, the most recent capital account statement or NAV report, and the most recent GP quarterly letter, plus anything else you add later from your dashboard. These contain your name, your commitment and capital account history, and confidential fund information.
- Attestations: your confirmation of accredited-investor status and your agreement to the exclusivity period, recorded with the deal.
If you apply as a buyer
- About you: first and last name, title, phone number, and work email, with the account itself again held by Clerk.
- About your firm: firm name, firm type, assets under management, and, where you provide them, firm website and LinkedIn.
- Your mandate: target asset classes, target deal sizes, geographies, strategy families, check-size bands, and vintage range — used to match you to deals.
- Compliance documents: proof of accredited-investor or qualified-purchaser status, government-issued ID, and entity formation documents. These are optional at signup and can be supplied later, but verification is a precondition of bidding.
Everyone with an account
- Deal activity: we keep an audit record of material steps in a deal — documents uploaded, NDAs signed, bids submitted, counters, consents, signatures, settlement events — with who did it, when, and, for some events, the originating IP address. This record exists so that every party to a transaction can see what happened and in what order; it is a core part of running a defensible process, and it is not deleted piecemeal.
- Data-room activity: when a buyer with a signed NDA opens a deal data room or views a document, we record that access and show the seller and the desk an engagement summary (which buyers looked, how many documents, how recently). We do not watermark documents and we do not track what happens to a file after it leaves the platform.
- Messages and questions exchanged through the platform, including deal Q&A and conversations with the in-product AI assistant.
- Ordinary server logs generated by our hosting provider.
Information from public sources
We research institutions that may have a reason to sell a fund interest, using public regulatory data — SEC EDGAR filings, IRS Form 990 and 990-PF, DOL Form 5500, banking and insurance regulator filings, and similar sources — together with AI-assisted web search. That research produces records about organizations, and it may include business contact details for named people at those organizations, such as a title and a work email published on a cited page. If we email you on that basis, the message carries an unsubscribe link, and unsubscribing suppresses further outreach to that address.
How we use it
- To create and operate your account and to verify who you are.
- To underwrite a fund interest: read the documents you upload, extract the fund and capital-account facts, and produce a NAV view, a financial model, and a confidential information memorandum for the deal.
- To match a deal to buyers whose stated mandate fits, and to run the process from first contact through NDA, bids, purchase agreement, GP consent, transfer, and settlement.
- To verify counterparties — checking that a firm and the person representing it appear to be real and are not the subject of adverse public findings. This is research that informs a human decision; it never approves anyone on its own.
- To send transactional email about your account and your deal, and to respond when you contact us.
- To keep the audit record described above, and to meet legal obligations.
- To improve the platform, using aggregate and de-identified information about how it is used.
We do not use your personal information or your deal documents for advertising, and we do not build profiles of you for anyone other than the counterparties to your own transaction.
AI processing
This is worth stating plainly, because it is how the product works. The documents you upload — your LPA, your capital account statement, your GP letters — are sent to Anthropic’s API so that a Claude model can read them and extract the terms and figures the underwriting depends on. The same applies to the deal information used to draft the CIM, to score buyer matches, to answer questions in the in-product assistant, and to run counterparty verification searches. Anthropic processes this material on our behalf as a service provider.
No AI system makes a decision that binds you. Pricing, buyer approval, bid acceptance, and every outward action — sending an email, sharing a document, booking a meeting — require a human at the desk to approve them.
Confidentiality on a live deal
A deal is confidential by default and opens up in stages. Before a buyer has been invited by the desk, they see a blind profile only: strategy, broad size band, and process status, with no fund name, no GP, no vintage, and no raw NAV. The named position, the underwriting, the CIM, and the data room become visible only after the desk invites that buyer and they sign the deal NDA. Access is enforced on the server on every request, not hidden in the interface.
Sellers see the buyers who have been invited to their deal and those buyers’ activity on it. Buyers do not see each other, and they do not see each other’s bids.
Who we share it with
We share your information with the parties below, and otherwise only when you ask us to or when the law requires it.
Counterparties to your transaction
Buyers under NDA receive the deal materials for your position. Fund managers, general partners, LPAC members, and fund administrators receive the transfer and consent paperwork that a transfer requires, which names the seller, the buyer, and the interest. Your own counsel, accountants, or advisers receive whatever you direct.
Service providers
- Clerk — user accounts, sign-in, and email verification.
- Supabase — the Postgres database and the private storage buckets that hold uploaded documents.
- Vercel — application hosting, plus aggregate site measurement.
- Anthropic — AI processing of deal documents and deal data, as described above.
- Resend — transactional and notification email.
- DocuSign — electronic signature for NDAs, letters of intent, purchase agreements, and transfer documents.
- Microsoft (Graph, SharePoint, OneDrive) — deal document workspace and the live Excel model, where the desk has that integration enabled.
- Stripe — hosted checkout used for settlement charges. Card details go to Stripe directly; we never see or store them.
These providers act on our instructions and are not permitted to use your information for their own purposes.
Legal and corporate
We may disclose information if we are legally required to, if we need to protect our rights or someone’s safety, or in connection with a merger, financing, or sale of the business — in which case this policy continues to apply to the information transferred.
We do not sell your data
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not rent or trade seller or buyer lists.
Security
Traffic to and from the site is encrypted in transit. Uploaded documents live in private storage buckets that are not publicly readable; when someone with the right to see a document opens it, the platform mints a short-lived signed link rather than exposing a permanent URL. The database denies access by default and is reachable only by the application. Access is enforced per role and per deal on the server for every request — a seller can reach only their own deals, a buyer only deals they have been invited to and signed an NDA on. Material actions are written to an audit record, and the money-path entries are hash-chained so that a later alteration is detectable. No system is perfectly secure, and we do not claim otherwise.
How long we keep it
We keep your account information and your deal records while your account is active and your deal is live, and afterwards for as long as we need them for the legitimate reasons a closed transaction creates — tax, audit, anti-money-laundering and know-your-customer obligations, and the possibility of a dispute about a transaction we ran.
You can ask us to delete your account and your information at any time and we will do so, except where we are required to retain something. In practice that exception mostly means the transaction record and audit trail for a deal that actually closed; we will tell you specifically what we are keeping and why.
Your choices and requests
You can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. You can also ask us to stop sending you outreach email — every outreach message carries an unsubscribe link, and you can tell us directly instead. Email team@theboringdesk.com with “Privacy request” in the subject line. We will not treat you differently for making a request.
Some of your information sits with a counterparty rather than with us — a buyer who received deal materials under NDA, or a fund manager who received transfer paperwork. We will tell you where that is the case, and the NDA’s own return and destruction obligations apply to it.
Cookies and site measurement
We use cookies that are necessary to run the service: Clerk sets a session cookie so you stay signed in, and the signup flow briefly stores what you have typed in your browser’s local storage so a Google sign-in round trip does not lose your progress. We also set one first-party cookie when you reach a signup page, recording only which of our own signup pages you arrived at, which page of our own site you were reading immediately before, an optional short campaign tag from the link you followed, and the time — so we can count how people reach us and which of our pages are useful. The page we record is always one of our own published pages: if you arrive from a search engine, a social network or any other site, we record nothing in its place rather than storing that address. It holds nothing that identifies you, is not readable by scripts, is not sent to anyone else, and expires after 30 days. We use Vercel’s built-in analytics for aggregate traffic measurement — page views and referrers, not individual profiles. We do not run advertising or cross-site tracking tags.
Children
The platform is for institutional and accredited investors and is not directed to anyone under 18. We do not knowingly collect information from children.
Changes
If we change this policy we will update the date at the top of the page, and for material changes we will tell account holders by email before the change takes effect.
Contact
The Boring Desk, Inc. — privacy questions and requests: team@theboringdesk.com. For anything else, use the contact form. See also our Terms of Use and the structural protections built into the process.