Deals On. — Find the person who can say yes

1. Information we collect

We collect what the product actually needs to do its job:

Account information. Email address, password (hashed by our authentication provider, never stored in plain text by us), and optionally a Google sign-in identity.
Profile and onboarding facts. What you tell us during onboarding and in Settings — your role (founder, investor, mentor, etc.), sector focus, stage, target or raised amount, location, a one-line description of what you're building, and traction details.
Connected inbox content — only if you explicitly connect Outlook, Slack, or Gmail (see Section 4). Depending on the permissions you grant on the provider's own consent screen, this ranges from contacts alone, through message headers, to full message content and attachments. Nothing is read unless you've granted that specific connection, and you can turn inbox analysis off entirely from a single toggle in Integrations.
Deal and messaging activity. Deals you open, messages sent through the in-app thread or through a connected account, documents you upload, and the delegation level you set for your AI agent.
Purchase information. If you buy a membership or credits in our Android or iOS app, the app store (Samsung Galaxy Store, Google Play or the Apple App Store) processes the payment. We receive the product you bought, its status (active, renewed, cancelled) and a transaction ID. We never receive your card or bank details.
Security and audit data. Login events, two-factor enrollment status, IP address and user agent at sign-in, and account status changes — kept so we (and you) can see if something unexpected happened to your account.
Basic technical data. Standard server logs (timestamps, request paths, error traces) that any web service generates, used only for debugging and abuse prevention.

2. How we use it

To match you with people who are actually relevant to your stated goal, and to explain why a match was made.
To let your AI agent summarize threads and explain matches. You write and send your own messages.
To secure your account — two-factor verification, suspicious-login detection, and the audit log described above.
To send you account-relevant email: security notifications (like a 2FA removal alert), verification links, and — only if you haven't turned it off — product updates.
To improve the product itself, using aggregated or de-identified usage patterns, not the substance of your private conversations.

We do not sell your data. We do not run advertising, and we don't share your data with anyone so they can advertise to you.

3. AI processing

Matching and thread summarization are powered by large language models from third-party AI providers (currently OpenAI and Anthropic). When we send content to them — a thread you've connected or a profile fact — it goes through their business/API terms, not their consumer product terms. Under those terms, your content is not used to train models that serve other customers. It is processed to generate the response our product asked for, then handled per that provider's standard data-retention window for API traffic.

We also generate embeddings (a mathematical representation of your profile and activity, not human-readable text) to power matching. Embeddings are derived from your data and used only within your own account's matching — never pooled into a shared model that serves other users' results.

4. Connected accounts (Outlook, Slack, Gmail)

Connecting an inbox is always opt-in, always revocable, and always split into two separate grants:

Read access — lets us see your contacts and, where you grant it, the contents of your messages and their attachments, to power matching and analysis. Read means read: this connection can never send, delete, or modify anything in your account, by design.
Send access — a second, separate authorization, requested with its own consent screen, that lets you (or your agent, only with your explicit delegation) send a message through that account. Granting Read never grants Send.

Disconnecting either one is instant and permanent from the Integrations page: the token is revoked with the provider, and everything we derived from that connection — cached messages, computed matches — is deleted, not just hidden.

Gmail specifically is currently limited to accounts Google has approved as testers while our app completes Google's required security review for the Gmail scopes involved — this is a Google policy, not a Deals On limitation.

We use a small number of infrastructure providers ("sub-processors") to run the product. Each only sees what it needs to do its job:

Supabase — authentication and our primary database.
Vercel — application hosting.
Resend — transactional email (verification links, security alerts).
OpenAI / Anthropic — AI processing, described in Section 3.
Microsoft, Slack, Google — only for the specific account you connect, and only for the scope (read or send) you granted.
RevenueCat — manages in-app purchases and subscriptions in our mobile apps. It receives your member ID and your purchase history, not your profile or messages.
Samsung, Google and Apple — process payments made through their app stores, under their own privacy policies.
Sentry — crash reports from our apps, sent without your IP address, screenshots or personal identifiers.

We may disclose information if required by law, or to protect the rights, property, or safety of Deals On, our members, or the public. We'll tell you if that ever happens to your account unless we're legally prohibited from doing so.

6. How long we keep it

We keep your data for as long as your account is active. If you delete your account, your profile, connections, derived matches, and uploaded documents are deleted within 30 days. Security audit logs (login/logout events) are retained a short additional period for fraud investigation purposes before being purged on the same schedule.

7. How we protect it

TLS 1.3 for everything in transit, AES-256 for everything at rest.
Optional TOTP two-factor authentication, with a real reauthorization gate before it can be removed from your account.
An account can only reach a full session if it passes every required verification step — this is enforced server-side, not just hidden behind a client-side screen.
A security audit log records login, logout, and authentication-setting changes, so unusual activity is visible, not silent.
An email alert if two-factor authentication is ever removed from your account.

8. Your rights and choices

Regardless of where you're located, you can always:

Access what we hold about you, through your account settings.
Correct inaccurate profile information directly in the app.
Delete your account and everything derived from it (see Section 6).
Disconnect any inbox connection at any time, instantly.
Turn off inbox analysis entirely with one toggle, without disconnecting the account.
Export your data — contact us and we'll provide it in a portable format.

If you're in the EEA, UK, or a jurisdiction with similar data protection law, these map directly onto your rights under that law (access, rectification, erasure, restriction, portability, and objection). Contact us at the address in Section 14 to exercise any of them.

9. Cookies

We use one first-party, httpOnly session cookie to keep you signed in. It is not readable by JavaScript, not shared with any third party, and not used for advertising or cross-site tracking. We do not run analytics or advertising cookies from third parties.

10. Children's privacy

Deals On is a professional platform for founders, investors, and operators. It is not directed at, and we do not knowingly collect information from, anyone under 18.

11. International transfers

Our infrastructure providers operate globally. Where your data is transferred outside your home jurisdiction, we rely on the safeguards those providers offer (such as standard contractual clauses) to keep it protected to the same standard described in this policy.

12. Google user data

If you connect a Google account, Deals On always requests two read-only contact scopes — contacts.readonly and contacts.other.readonly. These return the names and email addresses in your Google contacts, including the “other contacts” Google collects from people you have corresponded with. We use them for one purpose: to work out who you already know, so we can show you which of those people fit what you're trying to make happen.

Deals On may also request gmail.readonly, which lets it open the threads in your mailbox and read their contents, including subjects, message bodies and attachments. The consent screen Google shows you names every scope being asked for before you agree, and what you grant there is exactly what we get — if you decline the mail scope the connection still works for contacts alone. We use mail content to understand what you and a contact are actually working on, so a match can cite a real reason rather than a guess, and to answer questions you ask about a thread. It is never used to train a model, never sold, and never shared with another member: what we show other people is that a connection exists, never anything from inside it. Turning “Inbox analysis” off in Integrations stops all reading immediately, and disconnecting revokes our access at Google.

If you separately allow sending, Deals On uses the gmail.send scope only to deliver a message you wrote or explicitly approved, at the moment you approve it — never automatically, and that connection cannot read anything.

Deals On's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular: Google user data is never sold; never used for advertising; never used to train or improve generalized AI or machine-learning models; never transferred to third parties except as needed to provide this feature to you, for security, or as required by law; and never read by a human except with your explicit consent, for security purposes, or to comply with the law. Disconnecting the account deletes everything derived from it within 30 days.

13. Changes to this policy

If we make a material change to how we handle your data, we'll update the date at the top of this page and, for significant changes, notify you directly by email.

14. Contact us

Questions, access requests, or anything else about this policy: email shaheednesirov@gmail.com.

Privacy Policy.