How DealSharp handles personal data

Who We Are

DealSharp provides negotiation training, strategy coaching and live negotiation support tools for professional teams. For privacy questions, contact us at ekjosbakken@dealsharp.ai or hsigmond@dealsharp.ai.

Personal Data We Collect

• Account and contact data: name, work email, company, role, authentication identifiers and demo-request information.
• Customer content: deal descriptions, negotiation setup data, chat messages, uploaded documents, transcripts, notes, comments and other material users choose to provide.
• Voice and session data: audio, generated transcripts, feedback, scores, timestamps and session metadata where voice features are used.
• Technical data: device, browser, IP address, log events, security telemetry, cookies or similar identifiers needed to operate and secure the service.
• Communications: emails, support requests, feedback and related correspondence.

Purposes and Legal Bases

• Provide the service: to run simulations, strategy chat, document analysis, live mode, accounts and support. Legal basis: contract or steps requested before entering a contract.
• Security and reliability: to prevent abuse, debug issues, monitor availability and protect the platform. Legal basis: legitimate interests and legal obligations.
• Product improvement: to improve workflows, usability and reliability using aggregated, de-identified or internal operational data where possible. Legal basis: legitimate interests.
• Sales and communications: to respond to demo requests and service inquiries. Legal basis: consent, legitimate interests or pre-contractual steps, depending on the context.
• Compliance: to meet legal, tax, audit and regulatory obligations. Legal basis: legal obligation.

AI Processing and Training

DealSharp may send prompts, customer content, documents, transcripts or related context to AI infrastructure providers solely to generate the requested service output. We do not permit those providers or other subprocessors to use DealSharp customer data to train or improve their general models. We do not sell, rent or trade customer content.

Calendar Integrations (Google Calendar and Microsoft Outlook)

You can choose to connect your own Google Calendar or Microsoft Outlook calendar to DealSharp. Nothing is read until you connect a calendar and approve access in Google's or Microsoft's consent screen.

• Access we request: read-only. For Google Calendar: https://www.googleapis.com/auth/calendar.events.owned.readonly (view the events on calendars you own, including meetings you are invited to; never other people's calendars shared with you) and https://www.googleapis.com/auth/userinfo.email (identify which calendar was connected). For Microsoft Outlook: Calendars.Read, User.Read, openid, email and offline_access (so access continues until you revoke it). DealSharp never creates, edits or deletes calendar events.
• Calendar data we read: for upcoming and recent events on your primary calendar (the calendar that belongs to your own Google or Microsoft account) — the event title, start and end time, location, description or invitation text, attendees' names and email addresses, and whether you declined the event. We also store the connected calendar's email address and the OAuth access and refresh tokens needed to keep the connection working.
• Why we use it: to show your upcoming meetings in DealSharp, link meetings to the right project, help you prepare for a meeting (including identifying the company you are meeting and writing a short meeting context summary), and send the meeting reminders you have enabled. Upcoming events that match one of your projects are automatically added to that project as a scheduled live session, with the event's title, time, attendees and invitation text saved as the session's agenda; people you invite to that session can see this agenda. Calendar data is used only to provide these user-facing features.
• AI processing: to identify the counterpart company and write the meeting context summary, the event title, time, location, invitation text and attendee names and email addresses may be sent to our AI inference subprocessor (Google Gemini, EU/EEA) solely to generate that output for you. The agenda of a scheduled live session created from a calendar event is also given to the AI inference subprocessors that power that live session, solely to assist you in it. Data received from Google APIs is not used to develop, improve or train generalised AI or machine-learning models, by us or by our subprocessors.
• What we never do: we do not sell calendar data, do not use it for advertising, and do not transfer it to anyone except the subprocessors listed below as needed to provide the features above, or where required by law. DealSharp personnel do not read your calendar data except with your consent, for security purposes or where required by law.
• Retention: the calendar connection (tokens and calendar email address) is kept until you revoke access or ask us to delete it. Per-meeting preparation data — project links, preparation status, the identified company, the meeting context summary and reminder records — is kept for the meeting it belongs to; while reminders are enabled it is removed about two days after the meeting starts. Meetings you link to a project, and scheduled live sessions created automatically from matching events, become part of that project and follow the Retention section below.
• Revoking access: you can revoke DealSharp's access at any time in your Google Account under Third-party apps & services, or in your Microsoft account under Apps and services (work or school accounts: My Apps or your administrator). Once access is revoked, DealSharp can no longer read your calendar. To have your stored calendar connection and calendar-derived data deleted, contact us at the addresses above.

Email Integrations (Gmail and Microsoft Outlook mail)

You can choose to let DealSharp read your own Gmail or Outlook mailbox. Nothing is read until you choose to connect email and approve access in Google's or Microsoft's consent screen.

• Access we request: read-only. For Gmail: https://www.googleapis.com/auth/gmail.readonly. For Microsoft Outlook: Mail.Read, added to the same connection as your calendar. DealSharp never sends, drafts, edits, moves, labels or deletes email.
• When we read it: only when you ask DealSharp's assistant or strategy chat to look in your email (for example "find the latest draft from the other side"). We then search your mailbox for that request and read the matching messages: sender, recipients, date, subject, body and attachment names. An attachment's content is read only when you ask for that attachment or add its email to a project.
• Why we use it: to find the emails, drafts and attachments that belong to a negotiation you are preparing and, when you choose to, add a specific email or attachment to your project as a document. Adding an email also adds its attachments (other than calendar invitations) as project documents.
• What we store: the OAuth access and refresh tokens and the connected email address, so the connection keeps working. An email or attachment you add to a project is stored as a project document. Search results shown in a chat are kept as part of that chat conversation. We do not copy or index your mailbox.
• AI processing: the messages found for your request are given to the AI inference subprocessors that power the chat, solely to answer that request. Data received from Google APIs is not used to develop, improve or train generalised AI or machine-learning models, by us or by our subprocessors.
• What we never do: we do not sell email data, do not use it for advertising, and do not transfer it to anyone except the subprocessors listed below as needed to provide the features above, or where required by law. DealSharp personnel do not read your email data except with your consent, for security purposes or where required by law.
• Retention and revoking access: the connection (tokens and connected email address) is kept until you disconnect it in DealSharp's connector settings or ask us to delete it. Revoking access in your Google or Microsoft account stops DealSharp obtaining new access; an access token already issued may keep working until it expires (typically within about an hour). Disconnecting in DealSharp deletes the stored tokens immediately. Documents and chats follow the Retention section below.

DealSharp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subprocessors

We use nine subprocessors. Each is bound by confidentiality and security obligations, including obligations prohibiting them from training on DealSharp customer data. Where each one processes data is stated with it:

• Amazon Web Services (AWS): hosting and storage (EU/EEA).
• Google (Gemini): AI inference (EU/EEA).
• ElevenLabs: voice synthesis and speech processing (EU/EEA).
• Beyond Presence: live video avatar (EU/EEA).
• LiveKit: real-time audio and video transport (EU/EEA).
• Vercel: application hosting and delivery. Customer content is stored in AWS in the EU/EEA; Vercel serves the application in front of it and does not hold the system of record.
• Axiom: application log management (EU/EEA).
• PostHog: product analytics (EU cloud). Usage events only — not negotiation content.
• Microsoft: Outlook calendar synchronisation and read-only Outlook mail access, only where a user chooses to connect their own calendar or email. Access is user-authorised OAuth with least-privilege scopes and can be revoked by the user at any time; the calendar data we receive is stored in our EU/EEA infrastructure.

Each subprocessor is covered by written data-protection terms — either a signed data processing agreement or the provider's standard data-processing terms incorporated into the service agreement we accepted. Every subprocessor is risk-assessed before use and reviewed at least annually.

International Transfers

All personal data is processed within the EU/EEA. We do not rely on any international transfer mechanism.

Retention

We keep personal data only as long as reasonably necessary for the purposes described above, unless a longer retention period is required by law, contract, security needs or dispute handling. Customers may request deletion of account data and customer content, subject to backups, legal holds and legitimate retention needs.

Security

We use technical and organisational safeguards designed to protect personal data, including access controls, encryption in transit, restricted production access, logging and operational security controls. No system is perfectly secure, but we work to keep risk proportionate to the sensitivity of the data.

Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict or object to processing of your personal data, request portability, withdraw consent, and lodge a complaint with a supervisory authority. EEA users may contact their local data protection authority.

Children

DealSharp is intended for professional users and is not directed to children. We do not knowingly collect personal data from children.

Changes

We may update this policy as the service develops. If changes are material, we will take reasonable steps to notify users or customers.