Effective October 26, 2026
Data Processing Terms.
The short version
- You decide what goes into your workspace and why. We process it only to run your workspace, on your instructions, as your service provider.
- We do not sell or share personal information in your workspace, and we never use it to write or send for another customer.
- Information we compile from public sources and the results of checks we run while providing the service are our own records, not your workspace data, and they serve every customer.
- We use outside providers in the categories listed in Schedule 2. Your workspace owner gets thirty days' notice before a new provider outside the AI category first handles your data, and fourteen days to object; AI providers can change without that notice, and we tell you afterwards. The current named list is in your workspace and available on request.
- We tell your workspace owner within seventy-two hours of confirming a security incident that affects your data.
- Within ninety days after closure we delete the personal information in your workspace. Opt-out records, billing records and security logs stay.
- You can ask us for a written description of our safeguards once a year, for a record of our staff's access to your workspace, and reasonable questions at any time.
This summary is a reading aid and is not part of the Agreement. If it differs from the full text, the full text governs.
1. Roles and Scope
1.1 Part of the Agreement. These Data Processing Terms (the "DPT") are part of the Terms of Service (the "Terms") and apply whenever DealStake Processes Personal Information in Customer Data on the Customer's behalf. Capitalized terms not defined here have the meaning given in the Terms. "Process" and "Processing" mean any operation performed on Personal Information, including collection, storage, use, disclosure and deletion.
1.2 Customer Data. For Personal Information in Customer Data, the Customer is the business that determines the purposes and means of Processing, and DealStake is the Customer's service provider. Under the California Consumer Privacy Act, DealStake acts as a "service provider" and this DPT is the written contract that status requires.
1.3 Other Information. For the Customer's account information (Users' names and email addresses, billing details, sign-in records and support requests), for Platform Records and for Aggregated Data, DealStake is the business responsible, as described in the Privacy Policy.
2. Purposes and Instructions
2.1 Purposes. DealStake will Process Customer Data only to: (a) store, organize and display Merchant Records and conversations; (b) validate, enrich and organize Merchant Records; (c) prepare, send, receive and respond to communications on the Customer's behalf; (d) receive, review and organize documents submitted by Merchants; (e) apply suppressions, opt-outs and consent rules; (f) bill, meter, secure and support the Services, prevent fraud and operate the Services; and (g) comply with Applicable Law. The Customer discloses Customer Data to DealStake only for those purposes, which are described in more detail in Schedule 1.
2.2 Instructions. The Customer's instructions are the Agreement, the settings the Customer applies in the Workspace and written instructions the Customer gives at support@dealstake.io. DealStake will inform the Customer if, in its opinion, an instruction would breach Applicable Law or the Agreement.
3. Service Provider Obligations
For Personal Information in Customer Data, DealStake will:
- (a) not sell it or share it, and not make it available to any third party for monetary or other valuable consideration;
- (b) not retain, use or disclose it for any purpose other than the purposes in Section 2, or as Applicable Law permits;
- (c) not retain, use or disclose it outside the direct business relationship with the Customer, not use it to prepare or send communications for another customer, and not combine it with Personal Information received from another customer or from DealStake's own interaction with a Merchant;
- (d) provide the same level of privacy protection that Data Protection Laws require of a business, including reasonable security and assistance with requests from individuals;
- (e) notify the Customer promptly if DealStake determines that it can no longer meet its obligations under Data Protection Laws;
- (f) permit the Customer to take reasonable and appropriate steps to ensure that DealStake uses Customer Data in a manner consistent with the Customer's obligations, and to stop and remediate unauthorized use, including by providing documentation of how a deletion or a stop was carried out;
- (g) bind each Sub-processor by written contract to obligations no less protective than this DPT; and
- (h) assist the Customer in responding to requests from individuals as Section 8 provides.
4. Sub-processors
4.1 General Authorization. The Customer authorizes DealStake to engage Sub-processors to Process Customer Data for the purposes in Section 2, subject to this Section 4.
4.2 Categories and List. The categories of Sub-processors that DealStake engages, and the Processing that each category performs, are set out in Schedule 2. DealStake makes available to the Customer, within the Workspace and on request, a current list of its Sub-processors showing the legal entity, category and processing location of each (the "Sub-processor List").
4.3 Notice of Changes. DealStake will give the owner of the Workspace at least thirty days' notice, by email or within the Services, before a new Sub-processor in a category other than artificial intelligence services first Processes Customer Data. Where a Sub-processor in the artificial intelligence services category is added or replaced to maintain the quality, availability or cost of the Services, DealStake will instead update the Sub-processor List and notify the owner of the Workspace, by email or within the Services, promptly after the change.
4.4 Objection. The Customer may object to a new Sub-processor by written notice to DealStake within fourteen days after notice under Section 4.3, stating reasonable grounds relating to the protection of Customer Data. The parties will discuss the objection in good faith. If DealStake does not offer a reasonable alternative that resolves the objection, the Customer may close its Workspace under the Terms, which is the Customer's sole remedy for the objection.
4.5 Responsibility. DealStake remains responsible to the Customer for each Sub-processor's performance of the obligations that DealStake flows down to it, subject to the limitations of liability in the Terms.
4.6 Artificial Intelligence. DealStake will not use Customer Data to train artificial intelligence models.
5. Security
5.1 Safeguards. DealStake will maintain administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data and designed to protect it against unauthorized access, disclosure, alteration and loss, including: encryption of Customer Data in transit and at rest; logical separation of each Workspace from every other; access to Customer Data restricted to personnel who need it to provide the Services, with each access by DealStake personnel recorded; management of credentials and secrets in a dedicated secrets store; regular backups; and monitoring for errors and security events.
5.2 No Weakening. DealStake will not materially reduce the safeguards in Section 5.1 during the Term without notice to the owner of the Workspace.
6. Platform Records
6.1 Definition. Platform Records, as defined in the Terms, are records and information that DealStake compiles in operating the Services from public sources, such as information about businesses and industries, together with templates and defaults, and the results of checks that DealStake performs on contact details while providing the Services.
6.2 Status. Platform Records are DealStake's own records and are not Customer Data. Platform Records do not contain the Customer's lists, communications, settings, examples or documents, and do not identify the Customer as their source after the Term. DealStake may use Platform Records to provide the Services to all of its customers, and DealStake is the business responsible for them as described in the Privacy Policy. Section 3 restricts Customer Data and does not restrict the compilation or use of Platform Records.
7. Security Incidents
7.1 Notice. If DealStake confirms a security incident that results in unauthorized access to, or disclosure, alteration or loss of, Personal Information in Customer Data, DealStake will notify the owner of the Workspace by email within seventy-two hours of confirming it, describing what happened, the data involved, the steps DealStake has taken and the steps it recommends, and will provide updates as its investigation proceeds.
7.2 Cooperation. DealStake will cooperate reasonably with the Customer's own notification obligations. Where Applicable Law sets a shorter period for notice, that period applies.
8. Requests from Individuals
8.1 Routing. If a Merchant or another individual contacts DealStake about Personal Information in a Workspace, DealStake will inform the individual that the Customer controls that information and will forward the request to the owner of the Workspace within five business days.
8.2 Opt-outs. A request from a Merchant to stop receiving communications is applied by DealStake at once under the AUP.
8.3 Assistance. DealStake will assist the Customer in responding to requests for access, correction and deletion through the tools in the Workspace and, where those are insufficient, by other reasonable means.
9. Retention, Deletion and Export
9.1 During the Term. Customer Data remains in the Workspace until the Customer deletes it. The Customer may delete Merchant Records and their conversations individually; deleting a record also deletes the documents attached to it.
9.2 After Closure. Within ninety days after the Workspace is closed, DealStake will delete the Personal Information in the Workspace. DealStake retains opt-out and suppression records; billing and tax records; sign-in, access and acceptance records; Platform Records; and Aggregated Data. Copies of Customer Data in backups made before deletion are held under restricted access for disaster recovery and are not restored into service except to recover from a failure. Copies of communications held by DealStake's email delivery Sub-processor are retained under that Sub-processor's retention schedule.
9.3 Export. Before closure, the Customer may request an export of its Merchant Records and conversations at support@dealstake.io, and DealStake will provide it within thirty days.
10. Audit and Documentation
10.1 Attestation. Once a year on request, DealStake will provide a written attestation of the safeguards in Section 5 and of the Sub-processor List.
10.2 Access Records. On request, DealStake will provide a record of access by DealStake personnel to the Workspace. The Customer's own team's sign-ins are shown in the Workspace.
10.3 Questions. The Customer may ask reasonable questions about DealStake's Processing at any time, and DealStake will respond within thirty days. Where a regulator or Applicable Law requires more, DealStake will cooperate reasonably.
11. Processing Location
DealStake Processes Customer Data in the United States. Some Sub-processors may Process Customer Data in other countries, as the Sub-processor List states. If the Customer uploads Personal Information about individuals located outside the United States, the Customer is responsible for the transfer rules that apply to it.
12. Precedence
Liability under this DPT is governed by the Terms. If this DPT conflicts with the Terms on a data-protection matter, this DPT governs.
Schedule 1: Details of Processing
| Item | Description |
|---|---|
| Subject matter | The provision of the Services to the Customer under the Agreement |
| Duration | The Term, plus the deletion period in Section 9.2 |
| Nature and purpose | The purposes in Section 2.1 |
| Categories of individuals | Users; Merchants and the individuals acting on their behalf; individuals who submit documents to the Customer through the Services |
| Categories of Personal Information | Business contact details (name, title, email address, phone number, postal address); communications and their contents; notes and status the Customer records; documents submitted by Merchants, which may include financial statements and identity documents; information the Customer chooses to upload about a Merchant |
| Sensitive Personal Information | Only where a Merchant submits it in a document, such as an account number in a bank statement or an identifier in an identity document |
Schedule 2: Sub-processor Categories
| Category | Processing performed | Location |
|---|---|---|
| Cloud hosting and infrastructure | Hosting, storage, queuing, logging, secrets and related infrastructure services | United States |
| Artificial intelligence services | Generating, classifying and reviewing text and documents | United States and other countries |
| Email delivery | Sending and receiving email on the Customer's behalf and hosting the sending accounts | United States |
| Contact validation and business information | Validating contact details and gathering public information about businesses | United States and other countries |
| Payment processing | Billing, subscriptions, invoicing and tax | United States |
| Authentication and identity | Sign-in and team invitations | United States |
| Account communications | Sending account notices, alerts and support replies | United States |
| Monitoring and security | Error and performance monitoring | United States |
Version 83b8ab5b4b46 · Questions: support@dealstake.io