How Dealase handles personal information

1.The short version

• Dealase is a partnering and deal CRM for life-science business development. It holds business records: organizations, people in their business roles, assets, deals and the documents you upload.
• Patient and other health information are not allowed in Dealase, we do not scrape LinkedIn or any social network, and we do not buy or look up people's contact details.
• Your workspace's content is yours. We use it only to run the service for you. We do not sell it, share it with other customers or use it to train AI models.
• Everything is hosted in the United States. Our subprocessors are listed with their status, and the trust center covers security in detail.
• You can ask us to show, correct, export or delete your information at any time by writing to support@dealase.com.

2.Who we are

Dealase is built and operated by Techowiat LLC, a company based in Houston, Texas, USA, run by its founder, Taiwo Ogebule. In this policy "Dealase", "we" and "us" mean Techowiat LLC.

For your account, the public website and our public company pages, we decide how personal information is used. For the content a customer puts into its workspace (its contacts, deals, notes and documents), the customer decides what goes in and why, and we process it on the customer's behalf to provide the service.

Contact: support@dealase.com. Postal address for notices: to be published here before the first paid plan. Until then, send notices by email.

3.What we collect

• Account information: your name, job title and work email address, the workspaces you belong to and your role in each (owner, admin, member or viewer), the date you joined, and, if you turn on two-step sign-in, the fact that you did. The authenticator secret and codes are handled by our sign-in provider (Supabase Auth) and are not stored by Dealase.
• Customer content: what you and your colleagues create, import or upload in a workspace, such as organizations, people in their business roles (name, title, business email and phone, and notes you write), assets, deals and their stages, activities, meetings and conference schedules, imported spreadsheets and documents such as confidentiality agreements.
• Settings and preferences: workspace security rules, your time zone, the workspace you last opened and similar choices.
• Logs: the workspace audit log records changes to workspace records and settings (who, what, which record and when), and the access log records views, exports, downloads and each call made with an API token (by tool name only, never what was asked or returned). AI calls are recorded with their type, model, token counts and cost against the workspace budget.
• Technical information: like most websites, our hosting providers keep standard request logs (such as IP address, browser and the page requested) for security and operations. The free partner finder and the public data server keep only a one-way fingerprint of a visitor's IP address in a short-lived counter that limits how often they can be used.
• Messages you send us: if you email support@dealase.com, we keep the email and our reply.

We do not run analytics, advertising or tracking scripts on the website or in the app, and we do not use third-party advertising cookies.

4.What we do not collect

• Health information. Dealase is for organizations, people in business roles and deals. Patient information and other health data are prohibited by our Terms of service, and the AI features are instructed to leave them out. If we learn that a workspace holds health data, we will ask for it to be removed, or remove it.
• Social network data. Dealase makes no requests to LinkedIn or any other social network. A future browser extension would read only the page you are looking at, and only when you click it.
• Bought or looked-up contact details. We do not buy contact data from data brokers or enrichment services, and we do not look up anyone's email address or phone number. The contact details in a workspace are the ones its users enter or import.
• Payment card numbers. When billing is switched on, cards will be handled by Stripe and card numbers will never reach Dealase.

5.Public data and company pages

Dealase keeps a shared database of US life-science organizations built from public sources: ClinicalTrials.gov, SEC EDGAR, NIH RePORTER, PubMed, openFDA, the USPTO, press-release wires and companies' own websites. Every fact keeps a link to its source and the date it was fetched. We follow each source's published terms and rate limits; they are listed in the trust center.

Companies' own websites are read by our Research Agent under fixed rules: only the company's own domain, robots.txt honored, at most one request a second to a site and a small number of pages per company each run, pages that have not changed are not processed again, and the source address and time are stored with every field. Web search is used only within strict caps, for example to find a company's official website. People data taken from websites is limited to the name and title of people listed on the company's own team page.

Public company pages and the company directory show this public business data about organizations: pipelines, trials, filings, grants, patents, publications, regulatory actions and press, each with its source. They may show the names and titles of people as they appear in those public records or on the company's own website. They never show anything from a customer's workspace; the public pages read the database through a separate role that cannot see workspace data.

If something on a company page is wrong, or about you and you want it removed, use the "Ask for a correction or removal" link at the bottom of that page, or write to support@dealase.com with the page's address. We correct errors and remove a person's name on request.

6.How we use information

• To provide the service: sign you in, show your workspace, run imports and matching, keep your pipeline, and produce the briefs, drafts and alerts you ask for.
• To keep it secure: enforce workspace separation and security rules, keep audit and access logs, limit abuse and investigate incidents.
• To operate the business: answer support requests, manage plans and, once billing is live, bill for them.
• To communicate with you about the service: sign-in links, invitations, and notices about your account, security or changes to these policies.
• To meet legal obligations and enforce our Terms of service.

We never sell personal information, never share it for advertising, never share one customer's content with another customer, and never use one customer's records to enrich another's.

7.AI processing

Some features use a large language model from Anthropic: extracting fields from meeting notes, schedules and other text you provide into forms you check and edit, and drafting briefs, follow-ups and meeting requests that you review. When an AI feature runs, the text it needs is sent to Anthropic only to produce that output for your workspace. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models, and Dealase does not train or fine-tune any model on customer data.

Every AI call goes through one module that checks the workspace's AI budget first, records the cost and accepts only output that matches a strict format. AI never sends anything on your behalf. Partner-fit scores, including the free partner finder, come from a fixed formula, not a language model.

Today, AI features are switched off on the live site until per-workspace budgets are set for real customers, so Anthropic receives no customer content. Anthropic is listed as a subprocessor that is not yet active, and this page and the subprocessor list will say when that changes.

8.Who we share information with

We use a small number of service providers (subprocessors) to run Dealase. Active today: Vercel, Supabase, Cloudflare and Microsoft (Exchange Online). Listed but not yet active: Anthropic, Postmark, Stripe, Sentry and Fly.io or Railway. A provider is added to the subprocessor list before it receives any customer data.

If you choose to sign in with Google or Microsoft, or connect an AI tool to your workspace with a personal access token, that service receives what is needed for the connection under its own terms. We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganization of the business, in which case this policy continues to apply to it.

9.What the founder can and cannot see

Dealase is run by one person. As owner of the hosting and database accounts, the founder holds the keys that could technically reach the database. The protection is policy plus tooling, not a claim that access is impossible.

• In place: the founder does not browse customer records. Production is touched only to run the product, to respond to an incident or to carry out a customer's request, and only as far as that needs.
• Planned: an operator console with its own sign-in and required two-factor that lists customer companies, their people, roles, plan, seats, billing status and usage, with account actions that are all logged. It will never show business content such as deals, notes, confidentiality agreements, briefs, assets or pipelines.
• Planned: help inside a workspace only through support access the customer grants, limited to 24 hours, logged, visible to the workspace's admins and revocable at any time.
• Planned: a record of every direct database session by the founder, shown to a customer on request.

10.How long we keep information, and deletion

We keep account information and workspace content for as long as the account or workspace exists. Audit and access logs belong to the workspace and are deleted with it. Email you send to support is kept as long as needed to answer it and keep a record of the request.

Self-serve workspace deletion is planned: owners will delete a workspace themselves, its records and files will leave production within 30 days and backups within the backup retention period, with a confirmation when it completes. Until it ships, write to support@dealase.com from an owner's address; the founder carries out the deletion by hand, logs it and confirms when it is done. Before deleting, you can export your lists to CSV.

Production backups (point-in-time recovery and a nightly encrypted backup) are planned before the first paying customer; once in place, deleted data will remain in backups until they expire.

11.Security

Data is encrypted in transit and at rest. Every record belongs to one workspace, and database-level row-level security, covered by automated tests on every change, stops one workspace from reading, changing or counting another's records. Sign-in uses emailed one-time links (or Google or Microsoft accounts once those are switched on), with optional two-step sign-in that owners can require. The trust center lists every control with whether it is in place or planned, and offers a security questionnaire to download.

If a breach affects your data, we will tell affected workspaces within 72 hours what was exposed and to whom.

12.Where data is stored

Dealase is hosted in the United States, and the service is built for US life-science organizations. If you use it from another country, your information is transferred to and processed in the United States. Data residency in other regions is not offered today.

13.Your choices and rights

You can ask us to give you a copy of your personal information, correct it, export it or delete it, or ask a question about how it is used, by writing to support@dealase.com. We will confirm who you are before acting, answer within 30 days, and not treat you differently for asking. Depending on where you live, you may have further rights under local law; we will honor them, and you may also complain to your local data protection authority.

Much of this you can do yourself: edit your name and title under Settings, Profile, and export any list to CSV. If your information is in a customer's workspace (for example, you are a contact in someone's pipeline), that customer controls it; we will pass your request to them and help them respond.

14.Cookies and local storage

Dealase uses only the cookies it needs to work, and none for analytics or advertising:

• Sign-in session cookies set by our sign-in provider (Supabase Auth), which page scripts cannot read.
• An activity cookie that records when your session was last used, so a workspace's idle sign-out rule can work. Page scripts cannot read it.
• A cookie remembering the workspace you last opened.
• A cookie holding your browser's time zone, so dates show on your clock.

The app also keeps a few display preferences, such as a collapsed sidebar and recently opened records, in your browser's local storage. They never leave your device.

15.Children

Dealase is a business tool and is not meant for anyone under 18. We do not knowingly collect information about children; if you believe we have, write to support@dealase.com and we will delete it.

16.Changes to this policy

When the product changes in a way that affects this policy, we update it and the date at the top. For material changes, we will tell workspace owners by email or in the app before the change takes effect.

17.Contact

Questions, requests and complaints: support@dealase.com. Techowiat LLC, Houston, Texas, USA. Postal address for notices: to be published here before the first paid plan. Until then, send notices by email.