Privacy policy

Controller: [Dealglint legal entity name, registered address and company number]. Contact: [email protected].

What we collect

• Account data: name, email, password hash (handled by our authentication provider), organization and role.
• Agency profile data: the website, services, markets and preferences you enter.
• Usage data: actions in the product (e.g. saved opportunities, pipeline changes) needed to provide the service, and — only with your consent — product analytics.
• Billing data: handled by Paddle as merchant of record. We receive subscription status and transaction totals, not full card details.
• Attribution data: the first marketing source that brought you to our site (UTM parameters, referring domain), stored with your account to understand which channels work.

Opportunity data

Opportunities come from public procurement notices, public job board APIs, approved feeds and submissions from your team. We store organization names, titles, public descriptions and source links. We do not harvest personal profiles, scrape LinkedIn or buy contact lists. Where a public record contains a person's name in a business capacity (for example a contracting officer in a tender notice), we process it on the basis of legitimate interests and retain it only as long as the opportunity is relevant.

Legal bases

• Contract: to provide your account and the service.
• Legitimate interests: security, fraud prevention, service improvement, processing public business information.
• Consent: optional analytics cookies and marketing emails. You can withdraw at any time.
• Legal obligation: tax and accounting records.

Sub-processors

• Supabase (database, authentication, serverless functions)
• Vercel (web hosting)
• OpenAI (AI summarization, translation and drafting; inputs are opportunity text and your agency profile)
• Resend (transactional email)
• Paddle (payments, merchant of record)
• PostHog (product analytics, only with consent)

Some providers may process data outside the EEA/UK under appropriate safeguards such as Standard Contractual Clauses.

Cookies and local storage

Essential cookies keep you signed in and remember your selected workspace. Analytics (PostHog) is loaded only if you accept it in the consent banner. We store first-touch attribution in your browser's local storage until you sign up. We use no advertising cookies.

Retention

Account data is kept while your account is active. Raw source records are deleted after 180 days; derived opportunities may be kept longer for your history. When you delete your account, your personal data and any organization where you are the only member are deleted, except records we must keep by law.

Your rights

You can access, export, correct or delete your data. Export and deletion are available in Settings → Privacy. You can also contact us, object to processing, or complain to your data protection authority (e.g. Datatilsynet in Denmark or the ICO in the UK).

Emails

Digest and alert emails are sent only when you configure them. Every email includes an unsubscribe link.

Security

Data is encrypted in transit, access is restricted by organization-level row security, and secrets are never exposed to the browser.