Legal
Data Processing Addendum
The processor terms that apply automatically when a customer uses Dealbeam to process personal data of people in the EU, UK, Switzerland or Türkiye. Includes the sub-processor list.
Effective 2026-09-15
Scope and roles
This Addendum forms part of the Terms of Service between the customer ("Customer") and Dealbeam ("Dealbeam"). It applies wherever Dealbeam processes personal data on Customer's behalf — above all the reading data of people who open Customer's deal pages, and the contacts and stakeholders Customer records. For that data Customer is the controller and Dealbeam the processor within the meaning of Article 28 GDPR, the equivalent UK GDPR provisions, and KVKK Articles 3 and 12 (veri sorumlusu / veri işleyen). It does not apply to Customer's own account data, for which Dealbeam is an independent controller under the Privacy Policy.
Details of the processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Dealbeam service: hosting deal pages, collecting reading analytics, storing contacts, deals and action plans. |
| Duration | For as long as Customer has a workspace, plus the deletion period below. |
| Nature and purpose | Storage, display, analysis of reading behaviour and notification, so that Customer can follow up on proposals it sent. |
| Data subjects | Customer's prospective and existing customers, their employees and other people Customer shares a page with; Customer's own team members. |
| Categories of data | Name, email, company and title; page opens, tab dwell time, scroll depth, clicks, downloads, form submissions; engagement score and intent label; optional session replay (with inputs masked); the random per-browser identifier. |
| Special categories | None intended. Customer must not collect them through the service. |
Instructions
Dealbeam processes personal data only on Customer's documented instructions, which are: the Terms, this Addendum, and Customer's use of the service's features (sharing a page, enabling replay, adding a contact). Dealbeam will inform Customer if it believes an instruction infringes data protection law. Dealbeam does not process this data for its own purposes and does not sell it.
Confidentiality and personnel
People authorised by Dealbeam to access personal data are bound by confidentiality and receive appropriate training. Access is limited to what operating and supporting the service requires.
Security measures
- Encryption in transit (TLS 1.2+, HSTS); encryption at rest by our database and storage providers.
- Password hashing (bcrypt, cost 12); signed, time-limited, single-use tokens for sensitive links; HMAC-signed access cookies.
- Server-side authorisation on every request: page, analytics and recording access is checked against workspace membership and role. Administrative privileges are re-verified from the database on each privileged action.
- Session recordings stored in the database with the same access control as analytics; never in public storage. All text inputs masked at capture.
- Rate limiting on authentication, uploads, AI, forms and analytics endpoints; bot filtering on analytics writes.
- Content sanitisation (DOMPurify) for all published HTML; strict Content Security Policy; upload type/size validation and decompression-bomb guards.
- Plan-limit and resource-creation checks executed atomically to prevent race conditions.
- Logical separation of workspaces (multi-tenant authorisation); backups managed by the database provider.
Sub-processors
Customer authorises the sub-processors below. We will give at least 30 days' notice by email or in-app before adding or replacing one; Customer may object on reasonable data-protection grounds, and if we cannot resolve the objection Customer may terminate the affected service and receive a pro-rata refund.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Neon (PostgreSQL) | Primary database | All account, page, contact, deal and buyer-analytics data, including session recordings. | Region selected at deployment (EU or US) | EU Standard Contractual Clauses / EU-US Data Privacy Framework where applicable |
| Vercel | Hosting, serverless functions, image optimisation, file storage (Vercel Blob) | Request logs (IP address, user agent), uploaded logos, cover images and avatars. | United States (edge network worldwide) | EU Standard Contractual Clauses / EU-US Data Privacy Framework |
| Stripe | Subscription billing | Account holder name and email, workspace id, payment details (entered directly on Stripe, never stored by Dealbeam). | United States / Ireland | EU Standard Contractual Clauses / EU-US Data Privacy Framework |
| Resend | Transactional email | Recipient email and name for password resets, team invitations, page-share emails sent on a seller's behalf, and view notifications to sellers. | United States | EU Standard Contractual Clauses / EU-US Data Privacy Framework |
| Upstash (Redis) | Rate limiting and throttling | Short-lived counters keyed by IP address or email address; expire within minutes. | Region selected at deployment | EU Standard Contractual Clauses |
| Anthropic | AI Write and document import | The seller's instructions, the page content being edited and the text of documents the seller uploads. Buyer analytics are never sent. | United States | EU Standard Contractual Clauses; inputs are not used to train models under Anthropic's commercial terms |
| Google Fonts | Web fonts on published buyer pages | The browser's IP address and user agent when a published page loads a font the seller chose. The website and app self-host their fonts. | United States (global CDN) | Google's Standard Contractual Clauses |
| Embedded content providers (YouTube, Vimeo, Loom, Google Docs, Airtable, Calendly) | Embeds a seller places on a page | Whatever the provider collects when its frame loads in your browser, under that provider's own policy. Only loaded on pages that contain such an embed. | Provider-dependent | Provider-dependent |
Assistance to Customer
- Dealbeam will help Customer respond to data-subject requests (access, deletion, objection) relating to data in the service; most can be handled by Customer directly by deleting a contact, a page or a recording.
- Dealbeam will provide the information reasonably needed for Customer's data protection impact assessments and prior consultations.
- Dealbeam will forward to Customer, without undue delay, any request it receives directly from a data subject about Customer's pages, unless the law requires Dealbeam to act itself.
Personal data breach
Dealbeam will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer's data, with the information available at the time and updates as the investigation progresses, so that Customer can meet its own notification duties.
Deletion and return
Customer can export its data at any time (Settings → Account → Download my data) and delete pages, contacts, recordings and its account. On account deletion all Customer data is erased from the production database immediately; backups held by the database provider expire on their own schedule (currently within 30 days). Data required to be kept by law (billing) is retained only for that purpose.
Audits
Dealbeam will make available the information necessary to demonstrate compliance with this Addendum, and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, at most once a year (or after a breach), on 30 days' notice, during business hours, under confidentiality and at Customer's cost, in a manner that does not compromise the security of other customers. Third-party reports of our sub-processors are provided in place of on-site inspections of them.
International transfers
Where the processing involves a transfer from the EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree to the EU Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable, with the UK Addendum for UK data and the Swiss amendments for Swiss data, which are incorporated by reference; Annex I is completed by the details above and Annex II by the security measures above. For transfers from Türkiye the parties rely on the mechanisms in KVKK Article 9 (Board adequacy decision, the Board's standard contract, or explicit consent obtained by Customer).
Liability and precedence
Each party's liability under this Addendum is subject to the limitations in the Terms, except where the law does not allow that. In case of conflict, this Addendum prevails over the Terms for the processing it covers, and the Standard Contractual Clauses prevail over this Addendum.
Execution
This Addendum applies automatically by using the service. Customers who need a countersigned copy, or their own signed SCCs, can request one at privacy@dealbeam.com.