Privacy Policy

1. Introduction

Nathan & Florez LLC ("DealHub," "we," "us," "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and share information when you use our platform at www.dealhubhq.com or any successor URL (the "Service").

This Privacy Policy describes our data practices. By creating an account or using the Service, you acknowledge that we will collect, use, and share information as described in this Privacy Policy. Where applicable law requires consent, we will request it.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Password (stored as a secure hash; we never have access to your plaintext password)
• Full name (optional)

2.2 User Content

When you use the Service, you may upload or input the following types of content:

• Listing descriptions and broker emails (pasted text)
• Documents (PDFs, spreadsheets, Word documents)
• Notes and text entries
• Photos and images
• Audio recordings

This User Content may contain sensitive business information, including financial data, confidential deal materials, and information covered by non-disclosure agreements. Please do not upload Social Security numbers, driver's license numbers, financial account passwords, or other highly sensitive personal information unless strictly necessary and lawfully disclosed. You are responsible for the content you upload. See our Terms of Service for your obligations regarding confidential materials.

2.3 AI-Generated Data

When you use the Service, our AI systems generate the following data from your User Content:

• Extracted facts (financial figures, operational details, deal terms)
• Condensed transcripts and summaries of uploaded documents
• Business assessments and analysis
• Buyer fit evaluations
• Confidence levels and source evidence links
• Suggested deal names and timeline events

This AI-generated data is stored in our database as part of the Service.

2.4 Usage Data

We may collect standard usage data, including:

• Device type and browser information
• IP address
• Pages visited and features used
• Timestamps of activity

If we add analytics tools or other non-essential tracking technologies in the future, we will update this Privacy Policy and, where required by law, provide notice and obtain consent before activating them.

2.5 Payment Information

Payment processing is handled by our third-party payment processor. We do not store credit card numbers or full payment details on our servers. Our payment processor may collect billing information as described in their own privacy policy.

We may receive limited billing and subscription information from our payment processor, such as billing address, payment status, card brand, last four digits, expiration date, transaction identifiers, and subscription status, as needed to manage subscriptions, prevent fraud, and comply with law.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Process your documents, extract facts, generate AI analysis, store your deal data, sync with your cloud storage.
• AI Processing: Send uploaded content to AI processing providers for fact extraction, summarization, and analysis.
• Account Management: Authenticate your identity, manage your subscription, communicate with you about the Service.
• Cloud Storage Sync: Push your files and transcripts to your connected Google Drive account at your direction.
• Improve the Service: Analyze service performance, improve user-facing features, troubleshoot issues, and protect the Service. We do not use User Content to train our own models or for advertising.
• Legal Compliance: Respond to legal requests, enforce our Terms of Service, protect our rights and the rights of others.

We do not sell your personal information. We do not use your User Content to train AI models. We do not use your data for advertising.

4. How We Share Your Information

We share your information only with the following categories of third parties, and only as reasonably necessary to provide, secure, support, and improve the Service, comply with law, prevent fraud or abuse, or enforce our agreements.

We may also permit limited access to information by our employees, contractors, and service providers who need that access for customer support, maintenance, security, fraud prevention, billing operations, or legal compliance, subject to confidentiality and access-control obligations.

4.1 Sub-Processors

We use the following third-party services to operate the platform:

• Supabase — Database, authentication, and temporary file storage. Receives account info, deal data, facts, analysis, and temp files.
• Anthropic (Claude API) — AI processing for fact extraction, summarization, and analysis. Receives document text and content submitted for analysis.
• Deepgram — Audio transcription with speaker identification. Receives audio recordings for conversion to text. Transcripts are then processed by Anthropic for fact extraction.
• Vercel — Application hosting, deployment, and performance analytics. Receives application logs, request metadata, and aggregated page-view metrics. Vercel Analytics does not track individual users or use cookies.
• PostHog — Product analytics. Receives anonymized usage events (page views, feature interactions) to help us understand how the product is used and improve it. No User Content is shared with PostHog.
• Stripe — Payment processing and subscription management. Receives billing information necessary to process payments and manage subscriptions. We do not store full card numbers on our servers.
• Google (Drive API) — Cloud file storage at user's direction. Receives files and transcripts pushed to user's own Drive via OAuth.

If you connect Google Drive, we access Google user data only as needed to provide the Google Drive integration and related user-facing features described in this Privacy Policy, and not for advertising.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

4.3 Business Transfers

If DealHub is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change by email or prominent notice on the Service.

5. Data Retention

We retain your data according to the following schedule:

• Account information: Duration of account + 30 days after deletion. Stored in Supabase database.
• Deal metadata, facts, analysis, transcripts: Duration of account + up to 30 days in active systems after deletion request; backups and legal/security records may persist longer. Stored in Supabase database.
• Uploaded files (raw): Generally no more than 48 hours in temporary storage, subject to limited extensions for troubleshooting, abuse prevention, or legal compliance. Stored in Supabase Storage bucket.
• Files in your Google Drive: Permanent (user-controlled). Stored in your Google Drive account.
• Payment records: As required by law (typically 7 years). Stored by payment processor.

When you delete your account, we use commercially reasonable efforts to delete or de-identify active account data within 30 days. Backup copies may persist for a limited additional period under our backup cycles. We may also retain certain information for security, fraud prevention, billing, dispute resolution, backup recovery, or compliance with legal obligations. Files in your Google Drive are not affected by account deletion.

6. Data Security

We implement the following security measures to protect your data:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Database access controls: Row Level Security (RLS) policies ensure that each user can only access their own data at the database level.
• Authentication: Secure password hashing and session management via Supabase Auth.
• OAuth security: Google Drive integration uses OAuth 2.0 with minimal scope (drive.file only).
• Temporary storage isolation: Each user's uploaded files are stored in isolated paths within the temporary storage bucket.

Access to your data is limited to personnel and service providers with a legitimate need to know for support, maintenance, security, billing, or compliance purposes.

Despite these measures, no system is completely secure. We cannot guarantee the absolute security of your data, and you are responsible for maintaining the security of your account credentials.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

• Access: View all data we hold about you through the Service interface.
• Correction: Edit your profile information and deal facts at any time.
• Deletion: Request deletion of your account and associated personal information, subject to applicable exceptions.
• Data Portability: Files stored in your own Google Drive remain under your control, and DealHub may provide export tools or account data exports where reasonably practicable.
• Withdraw Consent / Disconnect Integrations: Disconnect third-party integrations at any time and, where applicable, withdraw consent for non-essential processing.

7.2 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended ("CCPA"):

• Right to Know: You may request details about the categories and specific pieces of personal information we collect, use, disclose, and share.
• Right to Delete: You may request deletion of personal information we hold about you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined by California law, you may request that we limit certain uses and disclosures, subject to legal exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your California privacy rights.

To exercise your California privacy rights, contact us at support@dealhubhq.com.

8. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will delete such information promptly.

9. International Data Transfers

Our Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States and possibly other jurisdictions where our service providers operate. Data protection laws in those jurisdictions may differ from the laws of your country of residence.

10. Cookies and Tracking

DealHub uses the following cookies and similar technologies:

• Authentication cookies: Essential cookies set by Supabase Auth to maintain your login session. These are strictly necessary for the Service to function.
• OAuth state cookies: Temporary cookies used during the Google Drive connection flow.
• PostHog analytics: PostHog sets a first-party cookie to distinguish unique sessions for product analytics purposes. This does not identify you personally and is not used for advertising.

We do not use advertising cookies or cross-site third-party tracking cookies. Vercel Analytics uses a cookieless approach and does not set cookies in your browser.

If we add additional tracking technologies in the future, we will update this section and provide any legally required disclosures and consent choices.

11. Third-Party Links

The Service may contain links to third-party websites (e.g., Google Drive, listing URLs, broker websites). We are not responsible for the privacy practices of these third-party sites. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the Service at least 30 days before the changes take effect. The "Effective Date" at the top of this policy indicates when it was last updated.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

support@dealhubhq.com

Nathan & Florez LLC