This policy explains what information Dealflow collects, why, who we share it with, and the control you have over it. We've written it in plain language rather than legalese, because a policy you can't understand isn't much use to you.
On this page
1. Who we are
Dealflow ("Dealflow", "we", "us") is a web application that helps user-generated content creators track brand deals, pitches, retainers, and related business information. It is operated by Sam Mazzuca, based in California, United States.
This policy applies to the Dealflow website at dealflowugc.com and the Dealflow web application. It does not apply to third-party services you might reach through links we provide.
For any privacy question, or to exercise any right described below, email us at sammazzuca15@gmail.com.
2. What we collect
We collect three kinds of information, and we've tried to keep each to the minimum needed to run the service.
Account information
When you create an account we collect your email address and a password. Your password is never stored in readable form — our authentication provider stores only a cryptographic hash of it, which means neither we nor anyone at Dealflow can see or recover your actual password.
Information you put into the app
Dealflow is a tool you fill in, so most of what we hold is content you chose to enter. Depending on how you use it, that can include:
- Brand names, contact details you record, and niches
- Deal details — type of deal, rates and values, stages, dates, platforms
- Retainer information — monthly amounts, deliverables, deadlines, renewal dates, contract links
- Notes, checklists, and folder names you create
- Screenshots you paste or upload, and reference links you save to a deal
Some of this is commercially sensitive — your rates, for example. We treat it accordingly and never use it for anything beyond providing the service to you.
Technical information
- Local browser storage. Dealflow saves a copy of your workspace and your display preferences in your own browser so the app loads quickly and keeps working during brief connection problems. This stays on your device. We do not use advertising or tracking cookies.
- Session tokens. A login token is stored in your browser so you stay signed in between visits.
- Server and hosting logs. Our hosting and database providers automatically record standard technical information such as IP address, browser type, and timestamps of requests. This is used for security and diagnosing faults.
- Feedback you send. If you use the in-app feedback button, we receive whatever you write, plus a star rating, a general device type (phone, tablet, or desktop), and counts of how many items are in your workspace. It does not include the contents of your deals.
3. What we don't do
Being explicit about the absences matters as much as the disclosures:
- We do not sell or rent your personal information to anyone, and never have.
- We do not share your information for cross-context behavioral advertising.
- We do not run advertising networks, tracking pixels, or third-party analytics on the app.
- We do not read your deal data to build profiles or train anything on it.
- Other Dealflow users cannot see your workspace. See the security section for how that's enforced.
4. How we use your information
| What | Why |
|---|---|
| Email address | To identify your account, let you log in, send password resets and account confirmation, and contact you about important service changes |
| Password hash | To verify your login without storing your password |
| Content you enter | To provide the service — store, display, calculate, and sync your workspace across your devices |
| Technical and log data | To keep the service secure, diagnose faults, and prevent abuse |
| Feedback you send | To fix problems and decide what to build next |
If you are in the EEA or UK, our legal bases are: performance of a contract (providing the service you signed up for), legitimate interests (security, fault diagnosis, preventing abuse, and improving the product), and consent where you volunteer something such as feedback. You can withdraw consent at any time.
5. Who we share it with
We use a small number of third-party providers to run Dealflow. They process data on our behalf, under their own security and privacy commitments, and only for the purposes we specify. We do not share your information with anyone else for their own purposes.
| Provider | What it does | What it handles |
|---|---|---|
| Supabase | Database and authentication | Your account and all workspace content |
| Netlify | Website and app hosting | Technical request logs |
| Resend | Sending account emails | Your email address and the message content |
We may also disclose information if we are legally required to — for example in response to a valid legal request — or where necessary to protect our rights, safety, or the security of the service. If Dealflow is ever acquired or merged, information may transfer as part of that transaction, and we would tell you before it took effect.
6. Where your data is stored
Your data is stored on servers in the United States. If you access Dealflow from outside the US, you are sending your information to be processed there, where privacy laws may differ from those in your country. Where required for transfers out of the EEA or UK, we rely on our providers' standard contractual clauses.
7. How long we keep it
- While your account is open: we keep your account and workspace so the service works.
- If you delete your account: we delete your account and workspace content from our live database. Ask us and we will confirm when it's done.
- Backups and logs: residual copies may persist in provider backups and technical logs for a short period before being overwritten in the normal course of operations.
- Feedback: we may keep feedback messages indefinitely, since they inform product decisions. Tell us if you'd prefer yours removed.
8. Your rights and choices
Whatever country you're in, you can do all of the following:
- Get a copy of your data. Use the export button inside the app at any time. It produces a complete backup file and a spreadsheet of your deals. No request needed and no waiting.
- Correct your data. Everything you entered is editable directly in the app.
- Delete your data. Use "Clear all data" in the app to wipe your workspace, or email us to delete your whole account.
- Object or restrict. Email us if you want us to stop a particular use of your information.
- Complain. If you think we've handled your data badly, tell us first — but you also have the right to complain to your data protection authority.
We'll respond to requests within 30 days. We may need to verify you control the account email before acting on a request, to make sure we're not handing your data to someone else.
9. How we protect it
Concrete measures rather than vague reassurance:
- Account isolation is enforced at the database level. Every row of your workspace is tied to your account, and a database security rule prevents any account from reading another's rows. This is not just a check inside the app — the database itself refuses the request, so an application bug alone cannot expose your data to another user.
- Passwords are hashed by our authentication provider and are not visible to us.
- Traffic is encrypted in transit using HTTPS/TLS.
- Access is limited to the operator of the service, for support and maintenance only.
An honest limitation
No online service can promise perfect security, and we won't pretend otherwise. Dealflow is an early-access product operated by a very small team. Please use a strong, unique password, and keep your own exported backup of anything you would be upset to lose.
10. Children's privacy
Dealflow is intended for people aged 18 or over, and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, email us and we will delete it and the associated data.
11. Regional rights
EEA and UK (GDPR)
If you are in the European Economic Area or United Kingdom you have the rights of access, rectification, erasure, restriction, objection, and data portability, plus the right not to be subject to decisions based solely on automated processing. Dealflow does not carry out automated decision-making or profiling. Our legal bases are set out in section 4.
California
California residents have rights to know what personal information is collected, to request deletion or correction, and not to be discriminated against for exercising those rights. Sections 2, 4, 7, and 8 cover the required disclosures. To be explicit for the avoidance of doubt: we do not sell or share personal information as those terms are defined under California law, so there is nothing to opt out of. We also do not use or disclose sensitive personal information beyond what is necessary to provide the service.
Elsewhere
If your local law grants you rights beyond those described here, email us and we'll honor them.
12. Changes to this policy
We'll update this page if our practices change, and we'll change the "last updated" date at the top. If a change materially affects how we handle your information, we'll email account holders before it takes effect rather than quietly editing the page.
13. Contact us
Questions, requests, or concerns about privacy: sammazzuca15@gmail.com. We read every message.