Home/Privacy

Privacy, in plain English.

No 8,000-word lawyer screed. We collect what we need to run the product, we don't sell it, we don't train AI on it, and you can export or delete everything in two clicks.

// the 30-second version

We collect contact, deal, and call data because that's what a CRM is. We don't sell it, we don't share it with ad networks, and we don't train AI models on it. Export or delete everything in ~12 seconds from Settings.

// 01What we collect

Account data you give us: name, email, password hash, billing address, role, team size.

CRM data you put in: contacts, companies, deals, notes, call recordings, email threads (when you connect Gmail/Outlook OAuth), and anything else you type or import.

Telemetry we measure: feature usage events, error reports, performance metrics. PII is stripped at the SDK layer before it leaves your browser.

We do not collect: precise location, browsing history outside our app, third-party tracker IDs, social-graph data, advertising IDs.

// 02Why we collect it

  • To run the product. Your CRM data is the product.
  • To bill you. Email and Stripe customer ID, that's it.
  • To fix bugs. Error reports + telemetry. Stripped of PII before transmission.
  • To talk to you. Account emails (receipts, password reset). Marketing email is opt-in only.

// 03Who we share with

The full subprocessor list lives on the Security page. Short version:

  • Neon, managed Postgres (us-east-1, AWS underneath). Encrypted at rest, point-in-time recovery enabled. SOC 2 + ISO 27001 certified.
  • Render, application hosting (us-east-1). SOC 2 + ISO 27001 certified.
  • Anthropic, Pro AI calls. Zero retention contract.
  • Stripe, billing.
  • Twilio, when you use the dialer.
  • Postmark, account emails only.
  • Cloudflare, CDN.

We don't share with ad networks. We don't share with data brokers. We don't sell anything to anyone. If we add or remove a subprocessor, the Security page updates within 5 business days and Pro customers get an email.

// 04AI & your data

Your prompts and your contact data are not used to train any model. Not ours, not Anthropic's, not anyone's. Anthropic API calls run with data_retention: 0 under a signed zero-retention agreement.

If you bring your own API key (BYOK), inference goes to your provider under your terms, we still don't see or store the prompts beyond what's needed for the response to render.

You can turn AI completely off in Settings → AI. The button is large.

// 05Your rights

You can do all of this yourself in Settings, no email-Tyler-and-wait-7-days nonsense:

  • Export. Settings → Export → CSV / JSON / full Postgres dump. ~12 seconds for 50k contacts.
  • Delete. Settings → Delete account. Confirmation, then data is purged from primary within 24h, from backups within 30 days.
  • Correct. Edit any record directly. Deleted fields are gone.
  • Restrict. Pause AI, pause integrations, pause email sync, toggles in Settings.
  • Object / withdraw consent. Email privacy@dealarena.io. Tyler answers personally inside 72h.

If you're in a jurisdiction that gives you these rights by law (CA / EU / UK / Brazil), they're yours regardless of plan.

// 06Retention

  • Active accounts: as long as the account exists.
  • Deleted accounts: primary data purged in 24h. Encrypted backups expire on rolling 30-day window.
  • Call recordings: 90-day default. Configurable to 0 days in Settings → Dialer.
  • Telemetry: 14 days, then aggregated.
  • Billing records: 7 years (US tax requirement).

// 07Cookies and tracking

Two product cookies always run: a session cookie (da_session) and a preference cookie (da_prefs). They're necessary for the site to work and aren't governed by the consent banner.

We use Google Analytics 4 to understand site usage when you opt in. Microsoft Clarity for heatmaps and session recordings, opt-in only. No advertising pixels run by default — only if you accept marketing cookies via the consent banner. You can change your choice at any time by clicking Cookie preferences in the footer.

All analytics tags are loaded through Google Tag Manager and gated by Google Consent Mode v2 default-denied; nothing fires until you grant consent.

// 08Changes to this policy

We update this when something material changes. The full version history lives on the public repo at github.com/dealarena/legal/privacy.md, every change is a Git commit with a timestamp and a reason.

Material changes get an email to every account 30 days before they take effect.

// 09Contact

Privacy questions, DSARs, deletion requests: privacy@dealarena.io

Security issues: security@dealarena.io

Anything else: tyler@dealarena.io

Mail: DealArena, LLC · Alexandria, VA 22314 · United States

// policy version 2026-03-04 · effective 04 march 2026
// last material change: added Bedrock to the AI subprocessor list (15 feb 2026)
// full diff history at github.com/dealarena/legal