Legal
Privacy Policy
What we collect, why, who receives it, and your rights.
Last updated
Who we are
GetDeal Inc., a corporation incorporated under the laws of the State of Delaware, USA, with registered office at 8 The Green, Ste R, Dover, DE 19901, USA, is the controller of the personal information described in this policy. We are established in the United States and have no office in the European Union or the United Kingdom.
Questions about this policy, and requests under it, go to support@getdeal.ai. Legal notices go to contact@getdeal.ai.
When we act with an investor
Where an investor commissions an assessment of a company under terms that make GetDeal and that investor joint controllers of the analysis and its delivery, those terms make GetDeal your single point of contact for the rights described below. Until an investor has agreed such terms, GetDeal alone is the controller of the assessments it produces. How we handle information about the people named in the companies we assess is set out in our transparency notice.
What we collect
When you create an account
- Your name, email address and a password, or the name and email address your Google or LinkedIn account provides if you sign in with one of them
- The role you choose — founder or investor — and the profile details you enter during onboarding, including your company, its website and, for investors, your firm and investment focus
- Your consent to the Terms of Service and this policy, which the sign-up form asks for
When you list a company
- The information you enter about the company: its description, financial figures, funding history, team, and the documents you upload to its data room, such as pitch decks, financial statements and contracts
- Text from your company’s public website, when you ask us to fill your listing from it
- Names, roles and contact details of the people you name as your company’s key people or references
When you use the platform
- Messages you send in a deal’s chat, requests you make, documents you open in a data room and when you opened them, and the agreements you sign
- Your verification submissions, where the platform asks you to verify who you are
- Payment details are entered with our payment provider, not with us; we receive a record of what was purchased and the email address it was purchased under
- How you move through the platform while signed in: the pages you open, in what order and for how long, and the steps you complete when you register and set up your profile. This is recorded by analytics software that runs on our own server and linked to your account by its internal identifier, never by your name or email address. The address of each page is recorded without the part after the question mark, so a link that carries a one-time code, a search term or a filter is recorded as the page alone.
When you visit the public website
- A random identifier in a cookie, which is not derived from anything about you and is used only to limit how much of the public directory one visitor can extract in a day
- Ordinary server logs: the address a request came from, the page requested, the time, and the browser identification your browser sends
- How the site is used: the pages viewed, the page a visit came from, the campaign tags in the link that was followed, your browser, operating system and screen size, and the country and city your connection appears to come from. This is recorded by the same analytics software on our own server. It sets no cookie and stores no network address: visits from the same browser are told apart for one day by a value computed from the network address and the browser identification, which cannot be turned back into either. Search terms typed into the site are not recorded by it.
If you accept analytics cookies
- Microsoft Clarity receives a replay of how you use each page — where you click, scroll and pause — together with the address and title of each page. Anything you type into a form is masked before the replay leaves your browser, and on the platform every word on the page is masked as well. The page address is not masked, so on the search pages that address includes the words you searched for. Clarity is not told which account you are signed in to; on the platform it is told only the kind of account you hold — for example founder or investor.
People we contact on behalf of listed companies
When a listed company asks us to introduce it to investors, we hold the names, work email addresses, firms and professional profile links of investment professionals we contact. That information comes from public professional sources and from the company’s own contacts, and we hold it only to make and follow up the introduction.
Why we use it, and on what legal basis
- To run the marketplace — accounts, listings, deal rooms, chat, signatures and payments — because that is the service you asked for (performance of a contract).
- To produce an analysis of a listed company, or of a company an investor asks about, for the investor and for our own listing review, under our legitimate interest in running a marketplace where listings can be assessed. The analysis is generated from the company’s own public website and other public sources.
- To introduce listed companies to investment professionals, under our legitimate interest in running an introduction marketplace, and theirs in hearing about relevant companies; any of them can ask us to stop at any time.
- To keep the platform secure and to limit abuse, under our legitimate interest in doing so.
- To understand how the website and the platform are used — which pages are read, where people give up during registration, which campaign brought a visit — under our legitimate interest in improving a service that people are asked to trust with a transaction. These analytics run on our own server and send nothing about your use to anyone else; the one service that does receive something, Microsoft Clarity, runs only if you accept analytics cookies and is described next.
- To send you the emails the service needs — verification, notifications about your deals, receipts — because the service does not work without them. We do not send marketing email to account holders.
- To meet legal obligations, including record-keeping for signed agreements and payments.
- To see where a page confuses people — where they hesitate, press something that does nothing, or give up — through Microsoft Clarity’s session replays, only with your consent, which you can withdraw at any time.
- Where we rely on your consent, we ask for it separately and you can withdraw it at any time.
Who receives it
We do not sell personal information. The following receive it in the course of providing the service:
- The other party to a deal: a founder and an investor see each other’s names, profiles, messages and, once a non-disclosure agreement is signed, the documents shared in the deal room.
- Our hosting provider, on whose server in Germany the platform, its database and its uploaded files run.
- Google, when you sign in with Google, and when a call is scheduled through Google Calendar (the attendees’ names, email addresses and the time); LinkedIn, when you sign in with LinkedIn.
- Our transactional email provider, which delivers the emails the service sends and receives the recipient address and message content.
- Our payment provider, Stripe, when you make a purchase.
- An analysis service operated for us by a third-party developer, which receives a company’s name and website address, and any claims extracted from a founder’s uploaded deck, and which in turn uses AI model providers and public-data sources to produce the analysis.
- An AI model gateway, which receives the public website text of a company when a listing is filled from it, and the text of a pitch deck when a founder uploads one, to extract the listing’s details.
- A messaging service that carries operational alerts to our team; an alert may include a company name and the domain part of an email address, never the full address.
- YouTube, when you play a video embedded on our market pages: the embedded player is loaded from YouTube and sets YouTube’s cookies in your browser.
- Microsoft, through Microsoft Clarity, when you accept analytics cookies: Microsoft receives the masked replay and the address and title of each page. It receives nothing until you accept analytics cookies.
Our list of sub-processors names each provider once a data-processing agreement with it is signed. No such agreement has been signed yet, so that list is empty and the providers are described here instead.
Where and how it is stored
The platform, its database and the files you upload are kept on a single application server operated by our hosting provider in Germany. Uploaded files — decks, financial statements, contracts, avatars — are stored on that server’s local disk, not in a separate cloud storage service. Access to a data-room document is limited to the people its owner has granted access to, each download is watermarked for the person who downloaded it, and every open and download is logged.
International transfers
We are a United States company, so information about people in the European Union and the United Kingdom is accessed from the United States, and some of the providers listed above process it there. We have not yet put in place a specific transfer mechanism for those transfers; until we do, they rest on the necessity of the transfer for the contract you have with us, or, where an investor commissions an assessment, for a contract made in your interest.
If you accept analytics cookies, Microsoft processes the session replays described above in the United States and elsewhere. That happens only on your acceptance, and no more is sent once you decline. We have no specific transfer mechanism in place with it.
How long we keep it
- Your account and profile: for as long as the account exists, and for a short period afterwards to close out anything open.
- Listings, deal rooms, messages and signed agreements: for as long as the listing or deal is active, and afterwards for as long as a record of a completed or attempted transaction is needed, because a signed agreement is a record of what was agreed on a date.
- Uploaded documents: for as long as the listing they belong to exists, or until you delete them.
- Information about people named in a company assessment: as described in the transparency notice.
- Server logs and the website visitor cookie: the cookie for thirty days; server logs for fourteen days.
- Usage analytics, on the website and on the platform: one hundred and eighty days, after which the records are deleted by a job that runs every week.
- Your answer to the cookie question: twelve months in the gd_consent cookie, after which we ask again.
- Recordings and data held by Microsoft: a session replay for thirty days, and the click and page data Clarity derives from it for nine months, under Microsoft’s own retention rules.
These periods are the rules of our internal retention schedule. The automated deletion that enforces them is being built; until it runs, deletion under the schedule is carried out by hand and on request.
Your rights
You can ask to see the information we hold about you, to correct it, to have it erased, to restrict or object to its use, and to receive a copy of what you gave us in a portable form. We verify your identity before disclosing anything. Where the information already appears in a report we delivered to someone, we cannot unsay it, so instead we lock it: it is kept, excluded from any further use and from any future version of the report. To use any of these rights, email support@getdeal.ai.
People in the European Union and the United Kingdom also have the right to complain to a data protection supervisory authority — in the UK, the Information Commissioner’s Office.
What we measure, and what we do not track
Page views and the actions described under “What we collect” are measured by analytics software that we run ourselves, on the same server in Germany as the platform. On the public website the record is not tied to any person. On the platform it is tied to your account’s internal identifier while you are signed in, so that we can see where people stop during registration and which parts of the product are used; it is never tied to your name or email address in that record, and it is deleted after one hundred and eighty days.
If you accept analytics cookies, Microsoft Clarity records a replay of how you use our pages, as described under “What we collect”. It does not run on the pages you reach from a link in an email or a shared link — email verification, password setting, a shared listing, a match invitation or a free-report link. Microsoft’s privacy statement describes what Microsoft does with what Clarity collects. Nothing Clarity collects is copied into our own records.
Separately from that, the platform is built to keep its own record of page views and of which listings were shown to whom, and both are switched off; neither is recorded today, and if either is switched on this policy will say so first. The platform and the website do send us a report when something fails in your browser — the error message and the technical trace of where it happened, the page you were on, your browser identification and, on the platform, your account’s internal identifier — so that we can find and fix the failure. We keep those reports for thirty days on our own server in Germany and then delete them; they are never joined to your name or email address, and we do not use them to build a picture of you.
Children
The platform is for businesses and professional investors. It is not directed at anyone under 18, and we do not knowingly hold information about anyone under 18.
Changes to this policy
The date at the top of this page is the date it was last changed. To close your account, ask us at the support address below. A change that affects what we collect or who receives it is announced to account holders by email before it takes effect.
Contact
GetDeal Inc., 8 The Green, Ste R, Dover, DE 19901, USA. Privacy requests: support@getdeal.ai. Legal notices: contact@getdeal.ai.
Complaints
If you are unhappy with how we have handled your information or a request, tell us first and we will answer within a month. You may also complain to the supervisory authority where you live.
See also our Terms of Service.