Privacy Policy
Last updated: 2026-05-16
DealRecord ("we," "us," or "our") operates an investment process platform for venture capital and private equity firms. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you access or use our services.
By using the Service, you agree to the collection and use of information in accordance with this policy.
1. Data We Collect
We collect information you provide directly and information collected automatically when you use the Service.
Account and profile data: Name, email address, job title, company name, and password when you register for an account.
Investment and deal data: All deal records, diligence notes, IC deliberation documents, pass rationale, and outcome data that you and your team upload or create within the Service. This data belongs entirely to you — see Section 3 (Data Ownership) of our Terms of Service.
Usage and analytics data: Pages visited, features used, click patterns, session duration, browser type, device type, and IP address. Collected via Google Analytics 4.
Demo request data: Name, email, company name, and any details submitted through our demo request form. Collected via HubSpot.
2. How We Use Data
We use the data we collect to:
- Operate, maintain, and improve the Service
- Authenticate your account and maintain security
- Analyse product usage to prioritise features and fix issues
- Communicate with you about your account, the Service, and material updates
- Comply with legal obligations
- Respond to demo requests and sales enquiries
We do not use your investment or deal data for any purpose other than operating the Service on your behalf.
3. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), our lawful basis for processing your personal data is as follows:
| Data Type | Lawful Basis |
|---|---|
| Account and profile data | Performance of a contract (Article 6(1)(b)) |
| Investment and deal data | Performance of a contract (Article 6(1)(b)) |
| Usage analytics | Legitimate interests — improving service quality (Article 6(1)(f)) |
| Marketing communications | Consent (Article 6(1)(a)) |
| Demo request data | Legitimate interests — responding to prospective customers (Article 6(1)(f)) |
4. Data Sharing & Third Parties
We do not sell, rent, or trade your personal data.
We share data with the following sub-processors solely to operate the Service:
| Sub-processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Google Analytics 4 | Usage analytics | Anonymised usage events, anonymised IP address | USA |
| HubSpot | CRM and demo requests | Name, email, company from demo forms | USA |
We may disclose data if required by applicable law, court order, or regulatory authority. Where legally permitted, we will notify you before making such a disclosure.
5. Data Retention
Account and deal data: Retained for the duration of your subscription plus 90 days post-termination to allow data export. After 90 days, data is permanently deleted.
Analytics data: Retained per Google Analytics 4 default settings (14 months). You may opt out of GA4 tracking by installing the Google Analytics Opt-out Browser Add-on.
Demo request data: Retained in HubSpot per HubSpot's data retention policy. Contact us at privacy@dealrecord.com to request deletion of your demo request data.
6. Security & Infrastructure
We implement technical and organisational measures to protect your data:
- All data is encrypted in transit using TLS 1.2 or higher
- All data is encrypted at rest using AES-256
- Access to customer data is role-based and logged
- Our security practices are aligned with SOC 2 Type II requirements
- In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by GDPR Article 33
7. Your Rights — GDPR
If you are located in the EEA, you have the following rights under the General Data Protection Regulation:
| Right | Description | How to Exercise |
|---|---|---|
| Right of access (Art. 15) | Request a copy of your personal data | Email privacy@dealrecord.com |
| Right to rectification (Art. 16) | Correct inaccurate personal data | Email privacy@dealrecord.com or update in-app |
| Right to erasure (Art. 17) | Request deletion of your personal data | Email privacy@dealrecord.com |
| Right to restriction (Art. 18) | Restrict processing in certain circumstances | Email privacy@dealrecord.com |
| Right to data portability (Art. 20) | Receive your data in a structured, machine-readable format | Email privacy@dealrecord.com |
| Right to object (Art. 21) | Object to processing based on legitimate interests | Email privacy@dealrecord.com |
| Right to withdraw consent (Art. 7) | Withdraw consent where processing is consent-based | Email privacy@dealrecord.com |
We will respond to all requests within 30 calendar days. You also have the right to lodge a complaint with your local data protection supervisory authority.
8. Your Rights — CCPA/CPRA
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
Right to know: You may request details about the categories and specific pieces of personal information we have collected about you, the purposes for which we use it, and the third parties with whom we share it.
Right to delete: You may request deletion of personal information we hold about you, subject to certain exceptions (for example, where we are required to retain data to complete a transaction or comply with a legal obligation).
Right to correct: You may request correction of inaccurate personal information we hold about you.
Right to opt out of sale or sharing: We do not sell personal information, nor do we share it for cross-context behavioural advertising. No opt-out action is required.
Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise any of these rights, email privacy@dealrecord.com with your request. We will verify your identity before processing it.
9. International Transfers
DealRecord is based in the United States. If you access the Service from the European Economic Area, your personal data will be transferred to and processed in the US. We rely on the Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021 to provide appropriate safeguards for such transfers.
10. Cookies
We use the following types of cookies:
Strictly necessary: Session cookies required for authentication and basic site functionality. These cannot be disabled.
Analytics: Google Analytics 4 cookies (_ga, _ga_*) that help us understand how visitors interact with the Service. You can opt out at any time using the Google Analytics Opt-out Browser Add-on or by disabling cookies in your browser settings.
We do not use advertising or third-party tracking cookies.
11. Children's Privacy
The Service is not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us at privacy@dealrecord.com and we will delete it promptly.
12. Contact & Data Protection
To exercise your rights, ask questions about this policy, or raise a data protection concern, please contact us:
Email: privacy@dealrecord.com
Mail: DealRecord [MAILING ADDRESS — required before launch]
13. Changes to This Policy
We will provide at least 30 days' written notice of material changes to this policy via email to registered users. The revised policy will take effect on the date stated at the top of this page. Your continued use of the Service after the effective date constitutes your acceptance of the revised policy.
Revision history:
| Version | Date | Summary |
|---|---|---|
| 1.0 | 2026-05-16 | Initial policy |