Privacy Policy

1. Who we are

DealDraft is operated by DEALDRAFT AI SOLUTIONS, a sole proprietorship registered with the Companies Commission of Malaysia (SSM) under registration number 202603202271, at Selangor, Malaysia("DealDraft", "we", "us", or "our"). You can reach us at support@dealdraft.site.

2. What we collect

• Account details: your email address, your password (stored in hashed form by our authentication provider) or, if you choose Continue with Google, the basic profile details Google shares with us. You also give us your name, company name, industry, role and what you plan to use decks for during setup.
• Settings: your default currency and payment terms, and your brand settings, including colours and a logo if you upload one. An uploaded logo is stored in file storage and can be opened by anyone who has its web address, because it is shown on your decks.
• Your decks: everything you type, paste or generate, including text extracted from documents you upload to build a deck. This often includes information about your clients, such as names, company names, email addresses, deal terms and prices.
• Proposal activity:when you email a proposal, we log that a send happened (your account, the deck and the time), and the email address you send to is passed to our email provider. When a recipient opens your proposal, we record view data (see "Proposal tracking" below). If a recipient accepts a proposal, we store the name they typed and the time.
• Subscription records: your plan, subscription status, renewal or end date, and Lemon Squeezy customer and subscription reference numbers. We also keep a log of the billing events Lemon Squeezy sends us, which includes the customer details Lemon Squeezy attaches to them, such as your name and email. We do not receive or store your card number.
• Technical data: our hosting provider keeps standard server logs (such as IP address and browser type) when you use the Service.

3. Why we use it

• to run your account and provide the Service, including generating decks and emails with AI;
• to export, present and share your decks, and send proposals you ask us to send;
• to show you who has opened your proposals;
• to take payment and manage your subscription;
• to keep the Service secure and fix problems;
• to reply to you and tell you about important changes.

We do not sell your personal data.

4. Who handles your data (processors)

We use the following providers to run the Service. Each handles data under its own terms and privacy policy.

• Supabase (database, sign-in and file storage): holds your account, decks, proposal activity, subscription records and uploaded files. Our Supabase data is hosted in Singapore (ap-southeast-1).
• Vercel (hosting): serves the app, so it handles the traffic between your browser and DealDraft.
• Anthropic (Claude API): generates deck content and follow-up emails. It receives the text needed for each request, such as your brief, text from documents you upload, your name, company, industry and default terms, client names and prices you entered, and for follow-up emails the proposal title, amount, timeline and view counts and times.
• Resend(email delivery): when you send a proposal, it receives the recipient's email address, your sender name, the message, the link and any PDF attachment. It also delivers notifications to you, such as when a proposal is accepted.
• Lemon Squeezy(payments): see "Payments" below.
• Google: only if you choose Continue with Google to sign in.

We do not use third-party advertising or analytics tools in the app.

5. Transfers outside Malaysia

Some of these providers process data outside Malaysia, and our Supabase data is hosted in Singapore (ap-southeast-1). By using the Service you understand that your data may be transferred and processed there. We take reasonable steps to make sure it is protected in line with the PDPA.

6. Proposal tracking

When a recipient opens a proposal link you shared (or opens the email we sent for you), we record a view event: that the deck was viewed, the time, the recipient's IP address and their browser's user agent. We collect this so the deck owner can see whether and when a proposal has been looked at. Within the app, only the deck owner can see the view events for their own decks. Recipients are not asked to create an account.

View events are kept for as long as the deck exists and are deleted when the deck or the owner's account is deleted. If you are a recipient and have questions about a proposal, please contact the person who sent it to you. You can also contact us at support@dealdraft.site.

7. Your clients and recipients

You decide what information about your clients and recipients goes into your decks. We handle it only to provide the Service to you. You are responsible for having a lawful basis to use that information, to share your decks with your recipients and to track their views.

8. Payments

Pro subscriptions are sold by Lemon Squeezy, the merchant of record and payment processor. When you start checkout, we pass it your email address and your DealDraft user ID so it can link the purchase to your account. You enter your payment details directly with Lemon Squeezy. We never see or store your card number. Lemon Squeezy handles sales tax and VAT, invoices and receipts, and keeps its own transaction records under its own privacy policy.

9. How long we keep data

We keep your account, decks and related records for as long as your account is open. Deleting a deck deletes its slides and view events. Deleting your account deletes your decks, profile, subscription record and send log, and your sign-in account.

Some things are not removed automatically: Lemon Squeezy's own transaction records, the log of billing events we received from Lemon Squeezy, and a brand logo file you uploaded. You can ask us at support@dealdraft.site about these. A proposal PDF attached to an email is stored temporarily so it can be sent, then deleted.

10. Your rights under the PDPA

Under the PDPA you may:

• ask for access to the personal data we hold about you;
• ask us to correct personal data that is wrong;
• withdraw your consent to how we use your personal data.

To do any of these, email support@dealdraft.site from the address on your account and say what you need. We will reply within the time the PDPA requires. If you withdraw consent, we may no longer be able to provide the Service to you. If your request is about information a DealDraft user put into one of their decks, we may pass it on to that user.

11. Security

We use encryption in transit (HTTPS), and the database is set up so that each account can only read and change its own data. Payment cards are handled only by Lemon Squeezy. No system is completely secure, so we cannot guarantee absolute security.

12. Cookies and local storage

We use only essential cookies: the sign-in session cookies that keep you logged in. We also keep a few small preferences in your browser's local storage, such as your dashboard layout. We do not use advertising or tracking cookies. Recipients who open a shared proposal do not receive tracking cookies from us. Pages run by others, such as the Lemon Squeezy checkout and customer portal and Google sign-in, may set their own cookies.

13. Children

DealDraft is not for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, email support@dealdraft.site and we will deal with it.

14. Changes to this policy

We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date.

15. Contact

Questions or requests about your personal data? Email support@dealdraft.site.