Privacy Policy
What we collect, why, and how your firm’s deal documents are protected.
Last updated October 11, 2026
1. Who we are
DealBasis ("we") provides the DealBasis website and platform. This policy explains what personal information we collect, why, and the choices you have. For deal documents your firm uploads, your firm decides what is uploaded and who can see it, and we process it on your firm's behalf.
2. What we collect
- Account information: name, email address, password (stored only as a secure hash by our authentication provider) and, if you turn it on, an authenticator-app factor for two-factor sign-in.
- Workspace information: your firm's workspace name, members and their roles, invites and security settings.
- Deal documents and outputs: the files your firm uploads, what DealBasis reads from them, and the analysis, notes, decisions and exports created from them.
- Activity log: sign-ins and sign-outs, uploads, file openings, changes, exports and settings changes, with who and when. It records what happened, not document contents.
- Messages you send us: demo requests, contact-form messages and help requests, with the name, email, firm and message you give.
- Basic technical information: the browser stores a session token to keep you signed in and a timestamp to sign you out after inactivity. We don't use advertising cookies or third-party trackers.
3. How we use it
To provide and secure the Service; to sign you in and enforce your firm's access settings; to keep the audit log your firm's admins rely on; to answer your messages and support requests; to bill paid plans; and to meet legal obligations. We don't sell personal information, use it for advertising, or use your documents to train AI models.
4. Where it's processed and who helps us
Documents are read in your browser. Stored data is held in your firm's private workspace, separated from every other firm by database rules. We use a small number of service providers, each bound by contract to protect the data:
- Supabase: database, file storage and sign-in (United States).
- Vercel: website and platform hosting.
- Email delivery provider: account confirmation and password-reset emails.
- Payment processor: billing for paid plans. We don't store card numbers.
We may disclose information if required by law, to protect the rights and safety of users or DealBasis, or as part of a merger or sale of the business, in which case this policy continues to apply.
5. Security
Encryption in transit (HTTPS) and at rest, separate workspaces enforced by the database, roles, optional or required two-factor sign-in, sign-out after inactivity and an append-only activity log. More detail is on our security page.
6. How long we keep it
Account and workspace information is kept while the account is active. An admin can permanently delete a workspace at any time, which removes its documents, deals, invites and members. After an account ends we delete data from active systems within 30 days; backups expire on their normal schedule. The activity log is kept so firms can show who accessed what, and contains no document contents. Demo, contact and help messages are kept as long as needed to respond and follow up.
7. Your choices and rights
You can update your name and security settings in Account security, and your firm's admins can export or delete the workspace. Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, or to object to some uses. To make a request, use the contact form; for deal documents, we'll work with your firm's admins, who control that data. We won't treat you differently for using these rights.
8. Children
DealBasis is a business service and isn't directed to anyone under 18.
9. Changes
We'll post updates here with a new date and tell account admins about material changes before they take effect.
10. Contact
Questions or requests: use our contact form, or Help, then Get help, inside the platform.