Privacy Policy

Dealdraft makes a suite of 16 apps for running a small business, covering work such as accounting, payroll, sales, point of sale, inventory, and field service. One Dealdraft account, managed by our identity and account service, signs you in to all of them. Our company website is dealdraft.io.

In this policy, “Dealdraft,” “we,” and “us” mean the company that operates these services. “You” means anyone who visits our website, creates a Dealdraft account, or uses an app as a member of an organization.

Businesses also use Dealdraft to keep records about their own customers, employees, and suppliers. For that workspace business data, the business decides what to collect and why, and we process it on the business's behalf as its service provider. Questions about those records should go to that business first.

We collect what we need to run Dealdraft for you, in these categories:

Account identity

Your name, the email addresses on your account and which one is primary, phone numbers, postal address, birthday, gender, and profile photo. An email address is required to create an account; the rest is optional, and you can change it at any time.

Sign-in and security data

Your password, which we store only as a one-way hash and never in readable form, plus your authenticator app and passkey registrations, recovery codes, and a record of sign-ins and security changes.

Workspace business data

The records you and your teammates put into the apps, such as customers, invoices, products, employees, schedules, and uploaded files. This data belongs to your organization.

Billing data

Your organization's subscriptions, tier, invoices, and payment history. Card payments are handled by Stripe: your full card number goes directly to Stripe and is never stored by Dealdraft. We keep only the details Stripe returns to identify a card, such as its brand, last four digits, and expiration date.

Device and session data

When you sign in, we record your IP address, your browser's user agent, and when the session was created and last used. This lets you review signed-in devices and helps us spot suspicious activity.

Support messages

What you tell us when you contact support, and our replies.

Cookies

We use cookies that keep you signed in and protect sign-in from abuse. We do not use cookies for advertising.

We use personal information to:

• provide the apps and your account, including signing you in, opening the workspaces you belong to, and keeping your profile in sync across apps;
• protect accounts by verifying email addresses, running two-step sign-in, detecting and blocking suspicious sign-ins, and showing you the devices signed in to your account;
• bill your organization for its subscriptions and send receipts and payment notices;
• send service messages, such as sign-in codes, security alerts, invitations, and notices about changes to our terms;
• answer support requests and fix problems;
• measure and improve reliability and performance, using aggregated or de-identified information where we can;
• meet legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use workspace business data to advertise to you or to anyone else.

Service messages are part of having an account, so you cannot opt out of them while your account is open. Any product news we send includes a link to unsubscribe.

We share personal information only in the situations below.

People in your organizations

Members of an organization you belong to can see your name, primary email address, profile photo, and role so they can recognize and work with you. Organization admins also manage your role and access.

Stripe (payments)

Stripe processes subscription payments and stores card details for us, under its own privacy policy and the payment card industry security standard (PCI DSS).

Mailgun (email)

Mailgun delivers the email we send, such as sign-in codes, security alerts, invitations, and billing notices.

Cloud hosting and object storage

Hosting providers run the servers and databases behind Dealdraft, and object storage providers hold uploaded files and backups.

Legal requirements

We disclose information when we believe in good faith that the law requires it, such as a valid subpoena or court order, or when it is needed to protect the safety, rights, or property of our users, the public, or Dealdraft. Where the law allows, we tell the affected customer first.

Business transfers

If Dealdraft is part of a merger, acquisition, or sale of assets, information may transfer as part of that transaction, and this policy keeps applying to it until you are told otherwise.

With your permission

When you connect a sign-in provider or linked app, or ask us to share something, we share what you authorized.

Our service providers may use personal information only to perform services for us, under contracts that require them to protect it.

Account identity and sign-in data

Kept for as long as your account exists. When you delete your account, we delete this data, except records the law requires us to keep.

Workspace business data

Kept for as long as the organization has a subscription. After an organization's subscriptions end, we delete its workspaces and their data within 90 days, which leaves an admin time to export it.

Billing records

Kept for as long as tax and accounting laws require, generally seven years.

Device and session data

Kept while the session is active and for up to 90 days after it ends, for security investigations.

Backups

Deleted data can remain in backups until those backups expire, up to 35 days later.

We may keep information longer when the law requires it, or to resolve disputes and enforce our agreements.

You can manage most of your information yourself from your Dealdraft account:

• Edit your name, photo, phone numbers, address, birthday, and gender, and add, verify, or remove email addresses and choose your primary one, in Account > Personal info.
• Download a copy of your account data in Account > Data & privacy.
• Delete your account in Account > Data & privacy. If you are the only admin of an organization with an active subscription, add another admin or cancel the subscription first.
• Review signed-in devices and sign out the ones you no longer use in Account > Security & sign-in.

Go straight to your privacy settings: Account > Data & privacy

Depending on where you live, you may have the right to access, correct, or delete your personal information, to receive a portable copy of it, to object to or restrict certain processing, and to withdraw consent you have given. This includes residents of California and other U.S. states with privacy laws, the European Economic Area, the United Kingdom, and Switzerland. To use a right your account settings do not cover, contact us: we will verify your identity, respond within the time the law allows, and never treat you differently for asking.

If your information is part of an organization's workspace business data, send your request to that organization. We will help it respond.

We protect your information with encryption in transit on every connection, encryption at rest for sensitive fields, separation of each organization's workspace data, and role-based access controls inside the apps.

Two-step sign-in (MFA) makes your account much harder to break into. Add an authenticator app, a passkey, or both, and choose which one you are asked for first. A code sent by email works as a fallback, and single-use recovery codes cover a lost device. Passkeys also resist phishing, because they only work on the site they were created for.

No system is perfectly secure. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

Dealdraft is a service for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Records an organization keeps about its own workers or customers, including minors, are workspace business data governed by that organization.

Dealdraft is based in the United States. We and our service providers may process information in the United States and in other countries whose data protection laws differ from those where you live.

When we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we use recognized safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

We update this policy when our services or the law change. The “Last updated” date at the top shows the current version. If a change materially affects how we handle your personal information, we will tell you by email or in your account before it takes effect.

For questions, requests, or complaints about this policy or your personal information, contact our support team.

Email: support@dealdraft.io

If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.