Legal, privacy & disclosures

StackTrade is a marketplace that helps people list, discover, and transact SaaS businesses. By using StackTrade you agree to use the platform lawfully and to provide accurate information in your listings, offers, and account.

StackTrade facilitates introductions and provides tooling (listings, messaging, offers, data room, and payment coordination). It is not a broker-dealer, investment adviser, or law firm, and nothing on the platform is legal, financial, tax, or investment advice. Any purchase agreement is solely between the buyer and seller; StackTrade is not a party to that agreement.

Listings, valuations, AI match scores, and analytics are provided for information only, on an “as is” basis, without warranties of any kind. We may modify, suspend, or remove content or accounts that violate these terms or platform policies.

The Channel Partner program lets vetted partners introduce deals. Partners act only as introducers, do not hold client funds, and are compensated from the platform fee per their agreement.

Listing is free. A success fee of 5–8% applies on a closed sale, tiered by deal size. Payments are processed by Stripe; sellers receive funds directly into their own Stripe-connected accounts and StackTrade never takes custody of buyer or seller funds — it only collects its commission as a platform fee. Applicable fees are disclosed before you commit to a transaction.

We collect only what we need to operate the marketplace:

• Account data: your name, email address, and role.
• Authentication: passwords are stored only as a salted scrypt hash — never in plaintext, and never logged.
• Content you create: listings, offers, deals, buyer mandate, and referral relationships.
• A signed, HttpOnly session cookie to keep you signed in. We do not use third-party advertising or cross-site tracking cookies.

We do not sell personal data. Data is processed to provide the service, prevent fraud, and meet legal obligations. You may access, correct, export, or request deletion of your account data by contacting us. Identity verification (KYC) and payment data, where required, are handled by our verification and payment partners under their own terms.

Optional AI features transmit only the listing and marketplace text needed for a given request to our model provider to generate matches and summaries. AI features are disabled unless enabled by the operator.

• Passwords hashed with scrypt; sessions are HMAC-signed, HttpOnly, Secure, SameSite cookies.
• All traffic is served over HTTPS/TLS with HSTS; a strict Content-Security-Policy and standard hardening headers are enforced.
• Rate limiting and same-origin checks protect authentication and state-changing requests.
• Role-based access control on every privileged action; the database is not publicly exposed and the app runs as an unprivileged container user.
• Secrets (session key, database credentials, API keys) are supplied via environment variables and are never committed to source.

To report a security issue, contact our security team (see below). Please do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.

For privacy, security, or legal inquiries, reach us at the contact address configured for your deployment. We aim to respond promptly.