1. Introduction & Scope
This Privacy Policy explains how Deal Nest (“DealNest”, “we”, “us”, or “our”) collects, uses, and safeguards information when you visit our website at dealnest.app, create proposals through our web application, or interact with a digital sales room hosted on our domain.
DealNest acts as a Data Controller with respect to our direct account holders (sellers and creators), and as a Data Processor with respect to the buyer telemetry and proposal data processed on behalf of those sellers.
2. Information We Collect
A. Account Holders & Sellers
When you create an account or subscribe to DealNest, we collect:
- Identity Data: Full name, company name, email address, and professional title.
- Billing Information: Credit card details, VAT/tax IDs, and billing addresses (securely processed and tokenized by Stripe).
- Deal Room Content: Proposal scopes, video intro URLs, pricing tiers, attachments, and brand logos uploaded to your deal rooms.
B. Prospective Buyers & Proposal Viewers
When a prospective buyer opens a proposal link (e.g., deal.dealnest.app/r/{token}), we collect telemetry data essential for B2B sales analytics and legal verification:
- Interaction Telemetry: Session start time, section reading time (such as time spent on pricing tables), file download timestamps, and tier selections.
- Device & Network Telemetry: Anonymized or hashed IP address, user-agent string, operating system, and approximate geographic location (country/city level).
- Proposal Acceptance Data: Full name, job title (optional), work email address, timestamp, IP address, and browser user-agent for the immutable SHA-256 audit digest.
3. How We Process Buyer Telemetry
Telemetry recorded in digital sales rooms serves two explicit business purposes:
- Commercial Intent Detection: Providing the proposal creator with real-time alerts when prospects actively engage with pricing tiers or re-open dormant deals.
- Commercial Assent & Audit Trail: Generating an immutable cryptographic proof that the buyer reviewed and accepted the agreed proposal scope and pricing.
4. Legal Basis for Processing (GDPR)
For individuals in the European Economic Area (EEA) and United Kingdom (UK), our legal bases for processing personal data include:
- Performance of a Contract (Article 6(1)(b)): To deliver our services, process proposal acceptances, and handle customer subscriptions.
- Legitimate Interests (Article 6(1)(f)): To maintain platform security, prevent fraudulent deal room creation, and provide sellers with proposal engagement intelligence.
- Compliance with Legal Obligations (Article 6(1)(c)): To comply with financial accounting laws and anti-fraud regulations.
5. Infrastructure & Data Security
We enforce strict technical and organizational measures to protect personal and deal data against unauthorized access, loss, or alteration:
| Layer | Protection Standard |
|---|---|
| Data in Transit | TLS 1.3 / HTTPS encryption across all application and deal endpoints. |
| Document Storage | Direct presigned PUT uploads to Cloudflare R2 with Zero Egress architecture. |
| Acceptance Integrity | SHA-256 cryptographic hashing locking accepted proposal terms. |
| Database Access | Strict PDO parameterized queries, automated backups, and access control. |
6. Sub-Processors & Third-Party Services
We work with trusted third-party infrastructure providers who adhere to strict data processing agreements:
- Stripe Inc.: Payment gateway, billing processing, and PCI-DSS compliance.
- Cloudflare Inc.: Global CDN distribution, DDoS mitigation, and R2 object storage.
- Transactional Email Providers: Sending instant buyer engagement alerts and accepted proposal audit certificates.
7. Data Retention & Deletion
Account data is retained as long as your account remains active. Accepted proposals and SHA-256 audit trails are preserved while the deal room remains active. Users and clients can download complete PDF acceptance records at any time for their own archival and legal compliance. When an account is terminated, deal rooms can be permanently archived or deleted upon request.
8. Your Rights Under GDPR & CCPA
You have the right to request access to your personal data, rectify inaccurate records, request data portability in structured formats, and request permanent erasure (“right to be forgotten”). To exercise any of these rights, contact our privacy team at [email protected].
9. Contact Information
If you have any questions or concerns regarding this Privacy Policy or DealNest data practices, please reach out to us:
Deal Nest — Data Protection Office
Email: [email protected]