Privacy Policy

This Policy explains how DealStratum, LLC, a Florida limited liability company (“DealStratum,” “we,” “us”), collects, uses, discloses, retains, and deletes information for our websites, application, browser extension, and services (the “Service”). It is incorporated into and governed by our Terms of Service, including the arbitration agreement and class-action waiver in Section 18. By using the Service, you acknowledge that you have read and understood this Policy.

1. Scope and Who We Are

DealStratum is a deal-sourcing, owner-sourcing, and broker-outreach platform for acquisition entrepreneurs, independent sponsors, and search funds. The data controller (and, where applicable, the “business” under U.S. state privacy laws) is DealStratum, LLC. We process information about account holders, business owners identified through owner-sourcing (Section 7), brokers and advisers in the Directory (Section 8), and outreach and mail recipients to whom account holders send communications. This Policy describes each, and how and when we delete information.

2. Notice at Collection — Categories of Information

This Section is our notice at collection under the CCPA/CPRA and analogous state laws. We do not sell your personal information for money; we share limited activity for advertising through the Meta pixel described in Section 5, which you can opt out of. We collect:

• Identifiers — account name, email, password (stored only as a salted hash); IP address; account/workspace IDs.
• Customer records / commercial information — subscription plan, billing address, invoice and transaction history, mail/trace credit balances and consumption.
• Internet/network activity — log, device, and usage data (browser type, pages viewed, feature usage).
• Geolocation — approximate (city/region) location derived from IP; business-location coordinates of sourced targets.
• Content you create — contacts, deals, buy boxes, sourcing targets, outreach sequences, message drafts and replies, mail campaigns, and documents you upload (e.g., NDAs, proof-of-funds, teasers).
• Connected-mailbox data — mailbox credentials (encrypted) and the specific messages we send and read replies to on your behalf.
• Business-contact information of third parties — for owner-sourcing: owner name and role, registered-agent name, business principal address, business email and verification status (Section 7); for the Directory: broker/adviser business-contact records (Section 8).

Sensitive personal information. We do not seek to collect “sensitive personal information” to infer characteristics about you. To the extent connected-mailbox credentials or message contents are treated as sensitive, we use them only to provide the messaging and reply features you request. We do not collect government identifiers, financial-account numbers (payment-card data is held by our payment processor), precise individual geolocation, health, or biometric data.

3. Sources of Information

• Directly from you — account, billing, and workspace content.
• Automatically — usage, device, and log data, including via cookies (Section 9).
• From your connected mailbox — only the messages we send on your behalf and the replies to them (Section 4).
• From third-party data sources, for business-contact information about non-account-holders — publicly available and licensed third-party business-contact sources. See Section 7.
• From publicly available sources — for the Broker Directory (Section 8).

4. How We Use Information

We use information to: provide, secure, debug, and improve the Service; create and authenticate your account and record your acceptance of our Terms; process payments and administer trace and mail credits; power sourcing, the Directory, owner-tracing, outreach, and reply features you initiate; send service, transactional, and security communications; detect and respond to fraud, abuse, and security incidents; and comply with legal obligations and enforce our Terms.

Connected mailbox. If you connect a mailbox (using an application-specific password over your email provider’s encrypted send/receive protocols), we access messages solely to send the outreach you direct and to read the replies to those messages for your workspace, under your email provider’s standard terms. We do not sell, mine, or repurpose your mailbox content for any other purpose or for advertising.

No model-training. We do not use your workspace content, uploaded documents, or connected-mailbox messages to train machine-learning models for ourselves or third parties, and our agreements with AI sub-processors prohibit them from doing so (Section 10).

5. How We Disclose Information; “Do Not Sell or Share”

We do not sell your personal information for money. On our public pages weshare limited online activity — page views and device/cookie identifiers, through the Meta (Facebook) advertising pixel — with our advertising partner to measure and target our ads. Under the CCPA/CPRA this is a “share” for cross-context behavioral advertising. You can opt out at any time: use the Do Not Sell or Share My Personal Information control, or send a Global Privacy Controlsignal from your browser, which we honor automatically. The pixel does not run inside the signed-in application. Apart from this advertising share, we disclose information only to service providers / sub-processors under written contract that restricts their use to providing services to us (Section 6); for legal and safety purposes; and in a business transfer (merger, acquisition, financing, or sale of assets), subject to this Policy.

Analytics disclosure. We use a privacy-configured third-party web-analytics service, with IP anonymization on and advertising / cross-context behavioral-advertising signals disabled, so we do not treat this analytics use as a “sale” or “share.” On public marketing pages only, we additionally use a masked session-replay and heatmap analytics tool to improve the site; it is configured to mask on-screen text and is not loaded inside the signed-in application, so it does not capture confidential information you enter there. See Section 9.

6. Sub-Processors and Service Providers

We engage sub-processors and service providers, each engaged to process personal information only as needed to provide services to us, in the following categories:

• Payment processing — subscription billing (billing + payment-card data, held by the payment processor).
• Mailbox connectivity — sending your outreach and reading its replies (mailbox credentials + message content).
• Application hosting + managed database — running the Service (all categories).
• AI providers — AI drafting, deal screening, and extraction (content you submit to AI features; Section 10).
• Business-data and contact-verification providers — sourcing and verifying business-contact information about non-account-holders for owner-sourcing.
• Direct-mail provider — letter printing and delivery (recipient name + mailing address; letter content).
• Error monitoring — diagnostics (error and diagnostic context; IP address not retained).
• Web analytics — understanding and improving our public marketing site, including aggregated, masked session-replay and heatmap analytics that run on public pages only (usage and device data; not loaded inside the signed-in application).

To be notified of material changes to our service-provider categories, contact hello@dealstratum.com.

7. Owner-Sourcing and Tracing — Source, Limits, and Choices

A core feature (“owner-sourcing” or “tracing”) helps account holders identify the owner of a business and obtain that owner’s business-contact information to send acquisition outreach. When an account holder runs a trace, we assemble a set of business-contact fields about the business and its owner — which may include the business name, address, and category; the owner’s name and role; the registered-agent name; the business principal address and registry status; and a business email and its verification status.

Limits — what we do NOT collect. Our pipeline is deliberately constrained to business-registry and business-contact data. We do not source motor-vehicle / driver’s-license records (DPPA), consumer financial-account data (GLBA), Social Security numbers or dates of birth, consumer credit information or any “consumer report” (FCRA) — the Service is not a consumer reporting agency, owner-trace output is not a consumer report, and it may not be used for any FCRA-regulated eligibility purpose — or skip-traced cell-phone or home telephone numbers. For sole proprietors, a registered “principal address” from a state registry may be a residential address; where it is, that address is part of the public business record we receive, and we do not separately source home addresses.

Provenance and accuracy. We record the verification source for assembled fields. Registry and third-party data may be inaccurate or out of date; owner-contact information is provided as is and we do not warrant its accuracy.

Your choices if you are a sourced owner (no account required). You may opt out of having your information sourced or contacted through the Service, and request deletion of trace information about you and your business, by contacting hello@dealstratum.com or using our owner/recipient opt-out page. On a verified request we will delete the corresponding trace records and record your opt-out so that we stop sourcing and contacting you through the Service. See Sections 12 and 13.

8. The Broker Directory and Publicly Available Information

The Directory consists of factual business-contact information about brokers and advisers aggregated from publicly available sources — such as publicly available professional and business listings. Under the CCPA/CPRA and similar laws, information lawfully made available from government records or that a business has lawfully made available to the public is generally excluded from protected “personal information,” and we rely on that treatment for the Directory; this does not by itself exempt us from any applicable data-broker registration obligations (Section 13).

What it may contain. Business name, firm, role/title, business contact details, service area, professional focus, and — where drawn from public professional listings — a professional photo, biography, or stated license/credential information. We do not include private or sensitive personal information.

Removal / opt-out (no account required). If you are a listed broker or adviser, request removal at our Directory removal page or by contacting hello@dealstratum.com. On a verified request we will remove the corresponding entries from the Directory and record your removal so we can keep you out going forward.

9. Cookies, Analytics, and Your Choices

We use essential cookies for authentication and security, and a third-party web-analytics service to understand and improve usage. We anonymize IP addresses and have disabled advertising and cross-context behavioral-advertising signals in that analytics, so we do not treat the analytics use as a “sale” or “share.” Separately, on our public pages we use the Meta (Facebook) advertising pixel, which is a “share” for cross-context behavioral advertising — you can opt out via the Do Not Sell or Share control or Global Privacy Control (see Section 5). You can block or delete cookies — including analytics cookies — through your browser settings (see our Cookie Policy); disabling essential cookies may break sign-in.

10. How We Use AI Providers

Certain features (AI deal screening, outreach drafting, listing/clip extraction) send the content you submit to those features to third-party AI sub-processors to generate output, under agreements that restrict use of your content to performing the requested feature for us and prohibit the provider from using your content to train its models. If you do not wish to use AI features, do not submit content to them. We are not responsible for the accuracy of AI-generated output; see our Terms for the related disclaimers.

11. Your Privacy Rights (California, Other U.S. States)

Depending on your state of residence, you may have the rights to:

• Know / access the categories and specific pieces of personal information we collected, the sources, purposes, and categories of recipients;
• Delete personal information we collected, subject to legal exceptions;
• Correct inaccurate personal information;
• Data portability (a copy in a portable format);
• Opt out of “sale” or “sharing” and certain targeted advertising (we do not sell or share — Section 5);
• Limit use of sensitive personal information (we already limit such use, Section 2);
• Non-discrimination for exercising your rights; and
• Appeal a denial, where your state provides one.

California (CCPA/CPRA), Florida (FDBR), and Virginia/Colorado/Connecticut and other state residents: to the extent these laws apply, you may exercise the rights above. We do not sell or share personal information and have not done so in the preceding twelve months. You may use an authorized agent with proof of authorization. We honor these rights to the extent the applicable law requires.

12. How to Exercise Your Rights (Mechanics and Timelines)

Submit a request by emailing hello@dealstratum.com; using the in-app controls (account holders: Settings → Billing to delete your account and data); or using our public privacy request page or Directory removal page (no account required). Verification: we will take reasonable steps to verify your identity (or an agent’s authority) before acting; we will not require you to create an account. Timelines: we acknowledge within ten (10) business days and respond within forty-five (45) calendar days, extendable by another forty-five (45) days where permitted, with notice. Appeals: if we deny a request and your state provides an appeal right, email hello@dealstratum.com with “Appeal” in the subject line. We will not discriminate against you for exercising these rights.

13. Data Broker Disclosures and the California DELETE Act

Some U.S. states (including California, Texas, Oregon, and Vermont) require businesses that knowingly collect and sell or license the personal information of individuals with whom they do not have a direct relationship to register as “data brokers.” Because our owner-sourcing and Directory features make available business-contact information about non-account-holders, we evaluate our obligations on an ongoing basis and will register as a data broker in any jurisdiction where, and at the time, the applicable statutory thresholds are met.

California DELETE Act. Where and when we are a registered California data broker, we will honor accessible deletion requests submitted through the state’s deletion mechanism. Independently, any individual may request deletion and suppression directly from us at any time (Sections 7, 8, 12). We record deletion and opt-out requests so that we can honor them and stop re-sourcing or re-contacting individuals who have opted out.

14. Data Retention, Account Cancellation, and Deletion

We keep personal information only as long as needed to provide the Service or meet legal obligations, then delete or de-identify it. We retain limited billing and transaction records for accounting, tax, audit, and legal-compliance purposes, in a form no longer linked to your personal profile after account deletion.

Cancellation vs. deletion are different. Subscription cancellation stops future billing; access to paid features continues through the end of your current paid period unless you delete your account. Account deletion is a separate, affirmative step that permanently deletes your workspace data — uploaded documents and files, all contacts, every conversation and reply, connected-mailbox credentials, deals, sourcing lists, buy boxes, mail campaigns, and the workspace logins.

Permanent and irreversible. Account deletion cannot be undone, and we do not retain a recoverable copy. Because deletion is irreversible, the deletion flow lets you download your uploaded documents as a single archive before you confirm — this is a description of how the feature works, not a penalty. Team workspaces: deleting a team workspace removes it and all its data for all members; only the owner can delete it. Backups: residual copies may persist briefly in secured operational backups and are overwritten on our ordinary cycle. Third-party / non-user data is retained per Sections 7 and 8 and deleted and suppressed on verified request.

15. Security

We use reasonable technical and organizational measures — including encryption of stored mailbox credentials and document files, access controls, and tenant isolation between workspaces. No system is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you and the appropriate regulators as required by law.

16. International Users and Data Transfers

The Service is intended for users in the United States and is operated from the United States, where information is processed. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S., which may have data-protection laws different from those of your country. We do not intend to ingest personal data of EEA/UK individuals through our owner-sourcing or Directory features.

17. Children

The Service is not directed to anyone under 18, and we do not knowingly collect the personal information of minors. If you believe a minor has provided us information, contact us and we will delete it.

18. Dispute Resolution — Arbitration, Class-Action Waiver, Jury Waiver

18.1 Binding individual arbitration. Except for the carve-outs below, you and DealStratum, LLC agree that any dispute arising out of or relating to this Policy, the Service, or our collection, use, disclosure, retention, or deletion of information will be resolved by final and binding individual arbitration, and not in court, except that either party may bring an individual claim in small-claims court. The arbitration will be administered by the American Arbitration Association (AAA) under its applicable rules, and the Federal Arbitration Act governs this Section.

18.2 Class-action and jury-trial waiver. You and DealStratum, LLC agree that each may bring claims only in an individual capacity, and not as a plaintiff or class member in any class, collective, consolidated, or representative proceeding. The arbitrator may not consolidate claims or preside over any representative or class proceeding. YOU AND DEALSTRATUM EACH WAIVE ANY RIGHT TO A JURY TRIAL.

18.3 Delegation. The arbitrator has exclusive authority over the interpretation, applicability, enforceability, or formation of this Section, except that a court — not the arbitrator — will decide the enforceability of the class-action waiver in 18.2.

18.4 Carve-outs. This Section does not require arbitration of (i) individual small-claims court claims; or (ii) claims for injunctive or equitable relief to stop unauthorized use, infringement, or misappropriation of intellectual property.

18.5 30-day right to opt out. You may opt out by emailing hello@dealstratum.com with your name, account email, and a clear statement that you opt out of arbitration, within 30 days of first accepting this Policy or the Terms. If you opt out, the parties agree to the exclusive jurisdiction and venue of the state and federal courts in Volusia County, Florida.

18.6 Severability and blow-up. If any part of this Section other than the class-action waiver is unenforceable, it is severed and the remainder enforced. However, if the class-action waiver in 18.2 is unenforceable as to any claim, this entire arbitration Section is null and void as to that claim, which proceeds in the courts in 18.5, and the jury-trial waiver remains in effect to the fullest extent permitted by law.

19. Changes to This Policy

We may update this Policy. Non-material changes are effective when posted and reflected by the “Last updated” date. For material changes — including changes to the categories of information we collect, the purposes of use, our sale/share practices, our retention or deletion practices, or this dispute-resolution Section — we will provide advance notice through the Service or by email and, where required by law or where the change materially expands our processing, will seek your renewed acceptance. Continued use after a non-material update constitutes acceptance.

20. Contact and Privacy Requests

DealStratum, LLC — 124 N Nova Rd #118, Ormond Beach, FL 32174. Privacy questions and requests: hello@dealstratum.com. Owner / mail-recipient opt-out: email hello@dealstratum.com. Broker Directory removal: /directory-opt-out. If you are not satisfied with our response, you may have the right to contact your state attorney general.