Deal Desk — Privacy Policy

Version 2026-08-24

Have a lawyer review this before you take a paying customer. It is an

accurate description of what the software actually does, written from the code

rather than from a template, but it is not legal advice and has not been reviewed

by an attorney. Review it alongside the Terms and the DPA in one engagement.

1. Who we are

Deal Desk is operated by Colbil Investments LLC, an Arizona limited liability

company. This policy covers dealdesksoftware.com and the

application behind it.

Two different relationships are described here, and the difference matters:

Whose data	Our role	Governed by
Yours — the account holder	We decide what is collected and why	This policy
Your customers', investors' and vendors' — the records you put into a workspace	We only hold and process it on your instruction	The Data Processing Agreement

2. What we collect about you

Because you gave it to us

Your email address and password, to create and secure your account. Passwords are hashed by Supabase Auth; we never see or store the plaintext.
Your name and workspace name, if you enter them.
Billing name, address and card details, entered directly into Stripe's hosted checkout. Card numbers never touch our servers. We store only Stripe's customer and subscription identifiers.
Anything you write to us at the support address.

Because the software records it

An audit log of security-relevant actions inside your workspace — who invited whom, who opened which document, who changed a role. This exists so that you can answer those questions about your own workspace, and it is visible to your Admins.
Standard server logs kept by our hosting providers, including IP address and browser user-agent, retained on their ordinary schedules.

What we do not do

No advertising or analytics trackers. The site sets no third-party cookies and there is no tracking pixel on any page.
The only browser storage we use is the session token that keeps you signed in, and your saved dashboard preferences.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in US state privacy law.

3. Why we use it

Purpose	Why we are allowed to
Running your account and the software	Performing our contract with you
Taking payment and preventing fraud	Performing our contract; our legitimate interest in being paid
Security, abuse prevention and the audit log	Our legitimate interest, and yours, in a workspace that cannot be quietly tampered with
Answering your support requests	Performing our contract
Meeting tax and accounting obligations	Legal obligation

We do not use your data, or your customers' data, to train machine learning

models — ours or anybody else's.

4. Who else sees it

Only the providers that make the software run. Each is bound by its own terms

and processes data on our instruction:

Provider	What it handles	Where
Supabase	Database, authentication, file storage, and the sign-in and password-reset email that goes with them	United States
Amazon Web Services	Infrastructure underneath Supabase	United States
Netlify	Website hosting, and the server-side call that reaches the document reader	United States
Stripe	Payment processing, billing and card storage	United States
Anthropic	Reading a settlement statement, only when you use that feature	United States

On the document reader. If you use it, the document you choose is sent for

analysis and comes back as extracted figures. It is not retained for model

training. The feature is optional and nothing is sent unless you use it.

We will also disclose information if the law requires it, and we will tell you

unless we are forbidden from doing so. If the business is ever sold, account data

would transfer with it, and you would be told before that happened.

5. How long we keep it

What	How long
Your account and workspace contents	While your account is open
After cancellation	60 days, so you can export, then deleted
Audit log	With the workspace, and deleted with it
Invoices and payment records	7 years, because tax law requires it
Provider server logs	On each provider's own schedule

6. How it is protected

Encrypted in transit, and at rest by the database and storage providers.
Workspaces are separated inside the database itself by row-level security, not by the application choosing what to show. A signed-in user's queries cannot return another workspace's rows even if the application is asked for them directly.
Roles are enforced the same way. An investor's own request returns only the projects they hold a position in, and only their own investor record.
Tax documents such as W-9s live in a restricted store that staff and investor accounts cannot read, and every time one is opened it is written to the audit log.

No system is perfect, and we do not claim otherwise. If a breach affects your

personal information we will notify you, and any regulator we are required to

notify, as promptly as the law requires — under Arizona law, A.R.S. § 18-552.

7. Your choices and rights

You can see, correct or export most of your data from inside the application at

any time. For anything else, write to the address below and we will act within 30

days.

Depending on where you live you may have the right to access your data, correct

it, delete it, receive a portable copy, object to a particular use, or appeal a

refusal. We extend these rights to every user regardless of location, rather

than only to those who can compel them. You will never be charged or given a

worse service for exercising one.

Note that where the data belongs to your customers or investors rather than to

you, we act on your instruction. Send us the request and we will help you answer

it; see the DPA.

8. Children

Deal Desk is business software and is not intended for anyone under 18. We do not

knowingly collect information from children.

9. International users

We operate in the United States and data is processed there. If you use the

service from outside the US, you are sending your data to the US.

10. Changes

If we change this policy in a way that matters, we will tell account holders by

email before it takes effect, and the version date at the top will change.

11. Contact

Colbil Investments LLC

Registered notice address to follow. Until it is published here, write to the support address below and we will confirm receipt.

support@dealdesksoftware.com