Legal
Privacy Policy
How Dealbeam handles personal data — for people who use Dealbeam to build deal pages, and for people who are sent one. Written to be read, not skimmed.
Effective 2026-09-15
Who we are and what this covers
Dealbeam ("Dealbeam", "we") operates the Dealbeam website and application at https://dealbeam.com. Privacy questions and requests: privacy@dealbeam.com.
This policy covers two groups of people, and our role differs for each:
- Account holders and website visitors — people who sign up for Dealbeam, or browse this website. For this data Dealbeam is the controller (under GDPR and UK GDPR), the "veri sorumlusu" (under Türkiye's KVKK), and the "business" (under US state privacy laws).
- Buyers and other readers — people who open a deal page that a Dealbeam customer (a "seller") shared with them. The seller decides what to collect and why; Dealbeam processes that data on the seller's behalf as a processor ("veri işleyen", "service provider"). The section "If someone sent you a page" is written for you.
We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not run advertising or third-party analytics trackers on any part of the service.
Data we collect from account holders
| What | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored only as a bcrypt hash), company, role, avatar image | You, at sign-up and in Settings |
| Workspace and content | Pages and tabs you write, templates, synced blocks, brand kit (logo, colours, fonts), tags, cover images | You, while using the editor |
| Contacts and deals | Buyer names, email addresses and companies you add to a page or a deal; stakeholders; deal values, stages, close dates; comments | You and your team |
| Documents for AI import | Text extracted from PDF, DOCX or PPTX files you upload, and the instructions you type into AI Write | You |
| Billing | Plan, subscription status, Stripe customer and subscription ids. Card details are entered on Stripe and never reach our servers | You, via Stripe |
| Technical and security data | IP address and browser type in request and rate-limit logs, session token, sign-in attempts | Your browser, automatically |
| Support | Anything you send us by email | You |
We do not ask for, and you should not upload, special-category data (health, political opinions, biometrics and so on) or data about children.
If someone sent you a page
A deal page is a web page a seller built in Dealbeam and shared with you by link. You do not need an account to open it, and you are not asked for anything unless the seller switched on a password or an email gate.
When you open a page, the seller can see:
- That the page was opened, and when.
- Which tabs you viewed, how long each tab was actually visible in your browser (time in a background tab does not count), and how far down each section you scrolled.
- Clicks on buttons and links in the page, file downloads, and anything you submit through a form on the page.
- Whether the page was opened before from the same browser, using a random identifier your browser generates and stores locally. It is combined with the page id and hashed before it is stored, so the same browser looks different on every page and cannot be followed across pages.
- Your name and email address if the seller sent you a personal link, or if you entered them at an email gate. From then on your reads are shown next to your name. Your name may also appear on the page itself if the seller personalised it.
- An engagement score (0–100) and a label — High Intent, Warm or Cold — computed from the activity above. It is a heuristic to help the seller prioritise follow-up; no decision with legal or similarly significant effect on you is made from it.
What is not collected: your IP address and browser identity are read only to block bots and to rate-limit abuse; they are not stored against your visit. There are no advertising cookies, no third-party analytics and no fingerprinting.
Session replay. A seller can switch on session replay for a page. It records the page as it looked on your screen together with scrolling and cursor movement, so the seller can watch how the page was read. Text you type into any form field is always masked, and the personalised greeting is masked too. Replay runs only if you click "Allow recording" in the notice at the bottom of the page. Choosing "No thanks", or having the Global Privacy Control signal switched on in your browser, keeps it off, and your answer is remembered for that page in your browser.
Embedded content. A seller may embed a video, document or calendar from YouTube, Vimeo, Loom, Google, Airtable or Calendly. When such an embed loads, that provider receives your IP address and may set its own cookies under its own privacy policy. We use YouTube's privacy-enhanced domain, which does not set cookies until you play the video.
Your rights over this data. The seller is responsible for it, so the fastest route is to contact the seller: their name and email are in the message that brought you the link. You can also write to privacy@dealbeam.com; we will act on the seller's instructions or, where we must, directly. See "Your rights" below.
Why we use data and on what legal basis
| Purpose | Data | Legal basis (GDPR / UK GDPR) | KVKK basis (Law 6698, Art. 5) |
|---|---|---|---|
| Providing the service: accounts, editor, sharing, deals, notifications | Account, workspace, contacts, technical | Performance of a contract (Art. 6(1)(b)) | Necessary for the performance of a contract (5/2-c) |
| Billing and tax records | Account, billing | Contract; legal obligation (Art. 6(1)(c)) | Legal obligation (5/2-ç); contract (5/2-c) |
| Reading analytics on a seller's page | Buyer data described above | Processed on the seller's behalf. The seller's basis is normally its legitimate interest (Art. 6(1)(f)) in following up a proposal it sent | Seller's legitimate interest (5/2-f); ${B} acts as veri işleyen |
| Session replay on a seller's page | Replay recording | Consent of the reader (Art. 6(1)(a)), given in the page notice and withdrawable at any time | Explicit consent (5/1) |
| AI Write and document import | Instructions, page content, uploaded document text | Contract — you asked for the feature | Contract (5/2-c) |
| Security, abuse prevention, rate limiting | Technical | Legitimate interest (Art. 6(1)(f)) in keeping the service safe | Legitimate interest (5/2-f) |
| Service emails: password reset, invitations, share emails you send, view notifications you enable | Email addresses | Contract; legitimate interest | Contract (5/2-c) |
| Complying with law and enforcing our terms | Any of the above, as needed | Legal obligation; legitimate interest | Legal obligation (5/2-ç) |
We do not use your content, your buyers' data or your uploaded documents to train machine-learning models, and our AI provider is contractually barred from doing so.
International transfers
Our sub-processors are established in the United States or store data in the region we select at deployment. Where data leaves the European Economic Area, the United Kingdom or Türkiye, we rely on:
- The European Commission's Standard Contractual Clauses (2021/914) and, for UK data, the UK International Data Transfer Addendum, with each provider.
- The EU-US Data Privacy Framework where the provider is certified.
- For data of persons in Türkiye: the mechanisms in KVKK Article 9 as amended in 2024 — an adequacy decision of the Personal Data Protection Board where one exists, otherwise the standard contract published by the Board or, failing those, your explicit consent. Details are in the KVKK Aydınlatma Metni.
How long we keep data
| Data | Kept for |
|---|---|
| Account and workspace | Until you delete your account (Settings → Account → Delete account) or ask us to. Deletion removes your pages and everything collected on them. |
| Pages, contacts, deals and the reading data on a page | Until the seller deletes the page, the contact or the deal, or deletes the account. Sellers are responsible for removing pages once a deal has closed; we recommend doing so within 12 months. |
| Session replay recordings | Deleted with the page or the visitor. Capped at about 40 minutes per session. |
| Form submissions | Until the page is deleted or the seller deletes the submission. |
| Password-reset tokens | 1 hour |
| Team invitations | 7 days |
| Personal-link cookie on a deal page | 30 days |
| Sign-in session | 30 days, or until you sign out |
| Rate-limit counters | Minutes |
| Hosting request logs | As set by our hosting provider, typically days to a few weeks |
| Billing records at Stripe | As long as tax and accounting law requires, typically 7 to 10 years |
Your rights
Wherever you are, you can ask us what data we hold about you, get a copy of it, correct it, have it deleted, restrict or object to how we use it, and withdraw any consent you gave. Depending on where you live you also have the specific rights below.
European Economic Area, United Kingdom, Switzerland (GDPR / UK GDPR / FADP): access, rectification, erasure, restriction, portability, objection, the right not to be subject to solely automated decisions with legal effect, and the right to lodge a complaint with your supervisory authority (in the EU, the authority of your member state; in the UK, the ICO).
Türkiye (KVKK Article 11): the rights listed, in Turkish, in the KVKK Aydınlatma Metni, including learning whether your data is processed, requesting correction or deletion, objecting to results produced by automated analysis, and claiming compensation for unlawful processing. Applications are handled within 30 days.
United States: see the US state privacy notice below.
How to exercise them:
- Account holders: Settings → Account. "Download my data" gives you a JSON export of your profile, pages, contacts and deals; "Delete account" erases your account after you confirm with your password.
- Everyone: email privacy@dealbeam.com. We may ask you to confirm your identity (for example by replying from the address on file). We answer within one month, extendable by two months for complex requests, and we will tell you if that happens. Requests are free unless manifestly unfounded or excessive.
- Readers of a deal page: contact the seller who shared it, or us; we will coordinate with the seller.
We will not treat you differently for exercising a right.
Security
- All traffic is encrypted in transit (HTTPS, HSTS). Passwords are hashed with bcrypt. Page passwords are hashed; access cookies are signed.
- Personal links and impersonation tokens are single-purpose, signed and time-limited. Access to pages, analytics and recordings is checked server-side on every request against your workspace and role.
- Session recordings are stored in our database, not in public file storage, and are viewable only by the seller's workspace.
- Uploads are type- and size-checked; page content is sanitised before it is served; a strict Content Security Policy limits what can load on a page.
- If we learn of a breach affecting your data we will notify the relevant authority and, where required, you, without undue delay and within the deadlines the law sets.
Children
Dealbeam is a business tool. It is not directed at children, and we do not knowingly collect data from anyone under 16 (or under 13 in the United States). If you believe a child has given us data, tell us and we will delete it.
US state privacy notice (California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others)
This section supplements the policy for residents of US states with comprehensive privacy laws, including the California Consumer Privacy Act as amended by the CPRA. Terms used here have the meaning given in those laws.
Categories of personal information we collect, and have collected in the last 12 months:
| Category | Collected | Examples | Purpose | Disclosed to |
|---|---|---|---|---|
| Identifiers | Yes | Name, email, IP address (transient), account id | Provide the service, security | Service providers (hosting, database, email, billing) |
| Customer records | Yes | Company, billing status | Billing, support | Service providers (Stripe) |
| Commercial information | Yes | Plan purchased, pages created | Provide the service | Service providers |
| Internet or network activity | Yes | Pages viewed, time on tabs, scroll depth, clicks — on deal pages, on behalf of the seller | Reading analytics for the seller | The seller who shared the page; service providers |
| Professional information | Yes | Role, company, title (as entered by you or a seller) | Provide the service | Service providers |
| Inferences | Yes | Engagement score and intent label on a deal page | Help the seller prioritise follow-up | The seller; service providers |
| Audio/visual, geolocation, biometric, sensitive PI | No | — | — | — |
Sources: you; your browser; the seller who added your details to a page or deal. We keep each category for the periods in "How long we keep data".
Sale and sharing: we do not sell personal information and we do not share it for cross-context behavioural advertising, and have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
Your rights: to know and access the personal information we hold; to delete it; to correct it; to obtain it in a portable format; to opt out of sale, sharing, targeted advertising and profiling in furtherance of decisions with legal or similarly significant effects (none of which we do); and not to be discriminated against for exercising these rights.
How to exercise them: Settings → Account (export or delete), or email privacy@dealbeam.com. We verify requests by matching the email address on the account or, for readers of a page, through the seller who shared it. You may use an authorised agent; we will ask for proof of the authorisation and may confirm with you directly. We respond within 45 days, extendable once by 45 days with notice.
Global Privacy Control: we honour the GPC browser signal. On deal pages it keeps session replay off without asking. Because we do not sell or share personal information, GPC has no further effect.
California "Shine the Light" (Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing. Nevada residents: we do not sell covered information as defined in NRS 603A.
Türkiye (KVKK)
The Turkish disclosure required by Article 10 of Law No. 6698, including the data subject application procedure, is published at /legal/kvkk. VERBİS registration status is noted there.
Changes and contact
We will post changes here and update the effective date. For material changes we will notify account holders by email or in the app before they take effect.
Contact: privacy@dealbeam.com · Dealbeam.