Privacy & data handling

How DealVolley treats the data in your deals.

Access model

Deal data is strictly scoped to the people on the deal.

Every deal belongs to exactly one intermediary organization.
Only the email addresses listed on a deal — the intermediary, the buyer side, and the seller side — can see that deal, its diligence list, its documents, and its activity.
Documents are stored privately and served only to authenticated deal participants.
Buyers and sellers see only the deals they were invited to, never the org's other deals.
Every material action (uploads, deletions, list changes, nudges, emails) is recorded in the deal's audit trail.

Used to organize documents and structure request lists. Key dates are entered manually by the broker.

When files are uploaded to the deal (rather than directly to a request), each file's name and a short preview of its contents are sent to an AI model via OpenRouter to match it to the right request. The preview is roughly the first 3,000 characters: the start of a PDF, Word document or text file, or the first rows of each spreadsheet tab. For scanned PDFs with no readable text, the first page is sent instead. Whole documents are not sent.
Request-list imports send the pasted text or the spreadsheet's contents to AI to structure the checklist.
Key dates are entered manually by the broker and are not sent to AI.
AI requests exclude providers that permit data collection; provider retention depends on the configured endpoints. Document contents are not included in operational AI logs.

Email notifications are sent only to deal participants, and only about deals they are on.
Payment is handled by Stripe. DealVolley never sees or stores card numbers — we store only Stripe's customer and subscription identifiers for your organization.
Sessions use signed, HTTP-only cookies.

Documents and deal data are retained for the life of the deal so all parties keep a consistent record.
The intermediary can delete documents unless they are retained as timeline or contract-analysis evidence. Source contracts and their prior versions are preserved for review. Storage deletion failures may require an operational retry.
Contact your intermediary (the deal admin) to request removal of material you uploaded.