Privacy Policy

• We never connect to your inbox. There is no Gmail login, no OAuth scope, no mailbox sync. We only see the emails you forward to your private address or paste into the form.
• The offer text you give us is sent to Anthropic's Claude API to produce the analysis. That is how the product works, and it means your offer leaves our systems.
• Nothing is emailed to a brand until you approve the exact wording. The send is blocked if the text does not match what you approved.
• For anonymous analyses we store a one-way hash of your IP address and browser user-agent to stop abuse. The raw IP address is never stored.
• We do not sell your data, and we do not run ad trackers.
• We do measure how the product is used, but only from our own servers: no tracking script runs in your browser, no analytics cookie is set, and the events we record are identifiers, counts and timings — never the offer text, your email address, a brand name, or your IP address.
• Brand offers are often confidential. You decide what to submit — we cannot tell whether a given email is covered by an NDA.

Your account

Your email address, and a password if you sign up with one. Sign-in is handled by Supabase Auth: your password is passed straight to Supabase, which stores it hashed — we never store it ourselves. You can also sign in with an emailed magic link instead.

Your profile and preferences

Whatever you enter during onboarding and in Settings: display name, creator handle, primary platform, follower count, average views, niche, country, and preferred currency. Plus your negotiation preferences — tone, a minimum deal amount, and any free-text notes you write for your negotiator.

The offers you send us

When you forward or paste a brand email we store it: the subject, the full body (plain text and HTML), the sender and recipient addresses, and the message headers. That includes any personal details inside the email — most importantly the brand contact's name and email address, which we extract so a counteroffer can be addressed to them. If a brand replies to a negotiation we started, we store that reply the same way.

Attachments

Attachments on forwarded emails are stored in a private file bucket — up to 10 files per email, 10 MB each, and only these types: PDF, plain text, CSV, Word (.docx), PNG, and JPEG. Anything else is dropped. For types we can read, we extract the text so it can be analyzed alongside the email. The anonymous paste form on /analyze does not accept attachments at all — it takes pasted text only.

Anonymous analyses (no account)

If you analyze an offer without signing up, we store the text you pasted, the subject line if you gave one, and the analysis we produced. We do not ask for your email or name.

To keep the free endpoint from being abused, we also store a fingerprint: we take the IP address from the request, combine it with your browser's user-agent string, run the result through SHA-256, and store the first 32 characters of that hash. It is used for one thing — counting how many analyses came from the same client in the last hour and the last day.

The raw IP address is never written to our database and never written to our logs. Only the hash is stored, and a hash cannot be turned back into an IP address.

Operational records

We keep an audit log of actions (deal created, draft approved, message sent, webhook rejected) and records of incoming webhook deliveries. These hold identifiers, timestamps, and error codes — by design they do not contain email bodies or contract text.

Product analytics

We measure how far people get through the product — paste an offer, get a report, open it, create an account — so we can see where it is failing them. Those measurements are sent to PostHog from our servers, not from your browser. There is no analytics script on any page, so there is nothing for an ad blocker to block and no analytics cookie to consent to.

There are six events, and this is all of them:

• Offer submitted — the analysis's internal ID, how many characters you pasted, and whether you filled in the optional subject field. Not the characters themselves.
• Analysis finished— the internal ID, whether it ended as a report, a “this isn't an offer” skip, or an error, how long it took, how many terms were itemized, the total unpaid-rights estimate as a number plus its currency code, and whether it was flagged for human review.
• Report opened — the internal ID and its status.
• Analysis claimed — the internal ID, your account ID, and the ID of the deal it became.
• Draft approved — the deal ID and your account ID.
• Approval blocked — the deal ID and a short reason code, e.g. that the deal had no brand contact address to reply to.

No event carries offer text, a subject line, an excerpt, a brand or contact name, an email address, or an IP address. Location lookup is switched off and the IP field is explicitly sent as empty, so PostHog does not receive or infer where you are.

Two more specifics, because they are the kind of detail that decides whether the paragraph above is worth anything. First, the ID we identify pre-signup events by is the analysis's internal database ID — not the secret token in your report link, which never leaves our systems. Second, when you create an account from a report, we tell PostHog that the earlier anonymous ID and your account are the same person, so the steps before signup connect to the account afterwards.

If the operator has not configured a PostHog key, none of this runs at all: no client is created and no request is made. OPERATOR: state here whether analytics is switched on in production

• No inbox access. DealLift has no connection to Gmail, Outlook, or any mail account. There is no OAuth scope to grant and no mailbox to sync. Your private forwarding address only ever receives what you (or a brand replying to a negotiation) send to it.
• We never contact a brand without your explicit approval.Every outbound negotiation email is drafted for you to read, edit, and approve. At the moment you approve, we take a SHA-256 fingerprint of the exact subject and body. Before sending, the system re-checks that the draft is still approved, still unsent, and still hashes to the same value. If any of that fails, the send is aborted and the deal is flagged for review. You are CC'd on every message we send.
• We do not sell, rent, or trade your data, and we do not share it with advertisers or data brokers.
• No ad tech, and nothing tracking you in the browser. There are no advertising pixels, no session recording, no cross-site tracking, and no third-party scripts on any page of this site. Our product analytics are sent from our servers instead — what they contain is listed above under Product analytics.

DealLift is built on other companies' infrastructure. Being plain about it: your offer content leaves our systems to reach the first three processors below. Each is bound by its own terms and privacy policy, which we do not control. Where a processor does not receive offer content, it says so.

• Supabase — our database, authentication, and file storage. Everything described above is stored here, including offer bodies and attachments.
• Anthropic— the offer text, and text extracted from attachments, is sent to the Claude API to classify the offer, extract terms, price the gaps, and draft your counteroffer. There is no way to use the analysis features without this. Anthropic's commercial API terms govern that processing; we have no separate arrangement that changes them.
• Resend — email delivery, both directions. Resend receives the messages you forward to your DealLift address and sends the negotiation emails you approve.
• Inngest — runs our background jobs. Job events carry identifiers only (record IDs and a content hash) — email bodies and contract text are not put into job payloads; the job re-reads them from our database.
• PostHog — product analytics. It receives the six events listed above: internal record IDs, an event name, counts, timings, estimate totals with a currency code, and short status and reason codes. It does not receive offer text, subjects, excerpts, brand or contact names, email addresses, or IP addresses, and it runs no code in your browser. This is the one processor on this list that is optional to the product working — turning it off changes nothing you can see.
• Vercel— hosting. Web requests to DealLift are served through Vercel's infrastructure. OPERATOR: confirm this matches your actual deployment

These providers operate in multiple countries, so your data may be processed outside the country you live in.

Some deals are routed to a human on our side: offers that ask for perpetual rights or AI likeness and voice rights, offers where the model's confidence was low, and unusually large deals. Staff on an internal allowlist can open those deals in an admin view that shows the stored messages in full, the extracted terms, and the drafted replies.

Staff can also edit extracted figures and release a draft back to you — but a staff member releasing a draft does not send it. Only your approval sends an email.Admin actions are written to the audit log with the acting person's account ID.

Brand offers frequently contain commercially sensitive terms — rates, campaign plans, unreleased products — and some are explicitly covered by a non-disclosure agreement you signed.

DealLift cannot tell whether a particular email is confidential or NDA-covered. Deciding what to submit is your call and your responsibility.

If you are unsure, redact the sensitive parts before pasting, or do not submit that offer. Submitting an offer means it is stored by us and processed by the providers listed above.

An anonymous analysis has no account attached to it, so the only thing protecting it is the link. Your report lives at a URL containing a 26-character random token that is not guessable and not derived from anything you typed.

Anyone who has that link can read that report. Treat it like a password.

We tell search engines not to index report pages, and we do not list them anywhere. But a link you paste into a group chat is a working key for everyone in that chat. If the offer is confidential, do not share the link.

When you create an account from a report, that analysis is claimed by your account — once, permanently — and becomes a normal deal in your dashboard.

We set session cookies through Supabase Auth so you stay signed in, and nothing else. No advertising cookies, no analytics cookies, no cross-site tracking. Anonymous analyses do not require a cookie at all.

That stays true even though we measure product usage. Because the measuring happens on our servers, there is no analytics script to set a cookie or read one — which is also why this site has no cookie consent banner.

Anonymous analyses

Each one is stamped with an expiry date 30 days after it is created, and unclaimed analyses are meant to be deleted at that point.

Straight answer: the scheduled job that deletes expired analyses is not running yet. Today the expiry date is recorded but nothing acts on it, so an expired analysis still exists and its link still works.

We would rather say that than promise a deletion we do not yet perform automatically. Until that job ships, email privacy@deallift.com with the link and we will delete the analysis.

Account data

Your profile, deals, stored emails, attachments, and drafts are kept for as long as your account exists, because that history is what the product is for — you can go back to a deal from a year ago. We delete them when you ask us to.

Operational records

Audit events and webhook records (identifiers and error codes, never message content) are kept for security, debugging, and abuse investigation. We have not yet set a fixed retention window for them. OPERATOR: set a retention period

Analytics events

The product-analytics events described above are held by PostHog under its own retention settings, not ours. We have not shortened that default. OPERATOR: set the PostHog retention period and state it here

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete your account and its contents. Email privacy@deallift.com from the address on your account.

The “Export my data” and “Delete my data” buttons in Settings are visible but not enabled yet — email is the working route today. OPERATOR: ship the self-serve buttons or state a response time

Two honest limits. First, an email we already sent to a brand cannot be unsent, and the brand keeps their copy. Second, deleting your account does not reach back into our processors' own operational logs — Supabase, Resend, Anthropic, Inngest, PostHog, and Vercel each keep their own records under their own policies. The analytics events tied to your account IDs are the one part of that we can ask PostHog to delete; email us and we will.

What we actually do:

• Every table has row-level security. A signed-in creator can only read and write their own rows.
• Attachments live in a private bucket under your account ID. There are no public file URLs.
• The key that can bypass row-level security is server-side only, and admin pages verify the viewer is an admin on the server before loading anything.
• Our error logs and audit records carry identifiers and error classes, not email bodies or contract text.
• An anonymous analysis is only reachable through its unguessable token; a malformed token is rejected before it ever reaches the database.

What we do not claim: DealLift has not been audited against SOC 2, ISO 27001, or any comparable standard, and this document is not a certification of compliance with the GDPR, the CCPA, or any other specific law. No system is unbreachable, and we do not promise one.

These blanks belong to whoever operates DealLift and must be filled in before a public launch:

• The legal entity that runs DealLift and is the data controller: [LEGAL ENTITY NAME], of [BUSINESS ADDRESS].
• Which privacy laws apply, and what your statutory rights are under them (for example GDPR access and objection rights, or CCPA do-not-sell rights): [JURISDICTION-SPECIFIC RIGHTS].
• The legal basis for processing, and an EU/UK representative or data protection officer if one is required: [TO BE CONFIRMED BY COUNSEL].
• A working contact address that a real person monitors: privacy@deallift.com is a placeholder and must be replaced with an address that receives mail.

DealLift provides negotiation support and heuristic estimates. It does not provide legal advice, no lawyer-client relationship is created by using it, and nothing on this site should be treated as a legal opinion about your contract. For advice on a specific agreement, talk to a lawyer. See our Terms of Service for the rest.

When the product changes, this page changes with it — that is the whole point of writing it from the implementation. We will update the “last updated” date at the top, and for changes that meaningfully affect what we collect or who receives it, we will tell account holders by email before the change takes effect.

Questions, data requests, or anything on this page that does not match your experience: privacy@deallift.com.