Privacy Policy | DealHarbor

1. Data we collect

Account data: name, email address and company. Posters and viewers sign in with one-time links we email them; staff accounts also have a password and a one-time code we email at each sign-in. Sign-in links, passwords and codes are stored only as secure hashes.
Listing content: the public fields of a listing (title, category, jurisdiction, summary, description, commercial range) and its private details, data room links, and uploaded files.
Listing contact details: the name, email, phone or WhatsApp number, and company you enter as the contact for a listing.
Subscription data: your plan, selected categories, alert timing, and up to 3 notification email addresses, including your own.
Payment data: payments are processed by Stripe. We receive the payment status, amount, the last four digits and brand of the card, and a card fingerprint used to apply promotion rules. We never receive or store full card numbers.
Messages to us: what you send through the contact form or by email.
Technical data: IP address, browser type, and pages visited, used for security, rate limiting, and analytics.

2. How we use it

to create and secure your account, and to sign you in;
to review, publish, renew, and archive listings;
to show listing details and contact information to subscribers who are entitled to them;
to send listing alerts, payment links, receipts, reminders, and account notices;
to process payments, apply discount codes and promotions, and prevent promotion abuse;
to prevent fraud, spam, and misuse, and to meet legal obligations;
to understand how the site is used and improve it.

3. Who can see or receive your data

Paid subscribers. A listing's contact details and private details are shown to paid subscribers whose plan includes at least one of the listing's categories. Posters consent to this when they submit a listing. Alert emails never include contact details.
The public. Public listing fields are visible to anyone and may be indexed by search engines.
Service providers who process data on our behalf: Stripe (payments), Cloudflare R2 (file storage), Resend (email delivery), our hosting and database providers, and our analytics providers.
Authorities, where required by law or to protect the rights and safety of users and DealHarbor.

We do not sell personal data.

4. Uploaded files

Files attached to a listing are stored in Cloudflare R2. They are never public or indexed. They are available only to the poster, DealHarbor admin, and entitled paid subscribers, through short-lived links issued after an access check. Do not upload identity documents, bank statements, or other sensitive personal data.

5. Cookies and analytics

We use essential cookies to keep you signed in and to protect forms. These are always on because the site does not work without them.

Analytics are off until you choose. We use Google Analytics and Fathom (a cookie-free analytics service) only after you click Accept in the cookie banner. Until then, and if you click Decline, neither analytics script is loaded. We remember your choice in your browser’s local storage; clearing your browser data resets it and the banner appears again. Analytics are never loaded for DealHarbor staff accounts.

6. How long we keep data

Account data is kept while your account is open and deleted or anonymized after closure, except where we must keep records.
Sold, closed, and expired listings remain public as archived records showing public fields only. Contact details and private details are no longer shown.
Payment and invoice records are kept as required for tax and accounting purposes.
Contact form messages are kept as long as needed to answer them and handle any follow-up.

7. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can update most account and listing information yourself, change alert timing or turn alerts off, and ask us to close your account. To make a request, email [email protected]. We may need to verify your identity before acting on it.

8. Security and transfers

We use encryption in transit, single-use emailed sign-in links, hashed staff passwords, emailed sign-in codes for staff accounts, and access controls. No system is completely secure. DealHarbor is operated from the United States, and your data may be processed in the United States and other countries where our service providers operate.

9. Changes and contact

We may update this policy and will post changes on this page with a new “Last updated” date. For privacy questions, contact us at:

Faisal Khan LLC
[email protected]