Privacy Notice

Norbert Chaber, trading as DataDeal is the data controller of the personal data described in this notice. DataDeal is a trading name of Norbert Chaber, a sole trader. Business address: 20 Norgate Road, Norwich, Norfolk, NR4 7BT, United Kingdom. VAT registration number: GB 196 4421 85. ICO registration: ZC131565. You can reach the data protection contact at datadeal50@gmail.com.

We are not currently required to register a separate Data Protection Officer under Article 37 of the UK GDPR; the named contact above answers all data-protection enquiries.

We process the following categories of personal data:

• Account data — email address, hashed password, subscription tier, trial start date, Stripe customer ID, registration timestamp.
• Usage data — analyses run, property details and optional listing links you enter, strategies viewed, saved deals, layer toggles on the Intelligence Map, all logged with a per-request correlation ID.
• Billing data — your billing address (asked for at checkout: we sell to UK customers only) and payment details, held by Stripe Payments UK Ltd. as the payment processor; card details stay with Stripe. We store the customer reference and the subscription and payment status, and we read the country of your billing address to apply the UK-only rule (we do not store it).
• Technical data — IP address (used for rate limiting and security only; our request logs record it with your user id, see section 7), browser user-agent, language and time-zone offset.
• Pilot sign-up data — if you join the pilot at /pilot: your email address, your answers to its three questions, whether you would take a call, and the consent you gave with its date and wording. No account is needed.
• Research interview notes — if you agree to an interview: written notes kept under a code, with your name and contact stored separately.
• Analytics data (opt-in only) — anonymised event metadata via PostHog (EU region) and JavaScript error traces via Sentry (EU region). See section 5.

We do not knowingly collect special-category data (UK GDPR Art. 9) and do not run advertising profiling.

We rely on the following lawful bases under UK GDPR Article 6:

• Contract (Art. 6(1)(b)) for account data, usage data and billing data — processing is necessary to deliver the service you have subscribed to.
• Legitimate interests (Art. 6(1)(f)) for technical data used to keep the platform secure and to enforce rate limits.
• Consent (Art. 6(1)(a)) for analytics cookies and product analytics (withdraw at any time via the cookie preferences link in the footer), and for pilot sign-ups and research interview notes (withdraw at any time by email; we then delete them).
• Legal obligation (Art. 6(1)(c)) where we retain accounting and tax records under HMRC record-keeping rules.

• to register your account, authenticate logins and persist saved analyses;
• to run the strategy engine against the property details and inputs you submit, and to return the result to your browser (listing links are stored for your reference only and are never fetched);
• to administer the subscription (Stripe Checkout, dunning, invoices in the Customer Portal);
• to monitor for abuse, enforce rate limits and protect the platform’s integrity;
• to send essential service emails (trial-ending notice, payment failure, security alerts);
• to improve the product through aggregated, anonymised analytics (subject to your consent).

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

Essential cookies (login session, CSRF token, billing checkout) are always set because the platform cannot function without them. Analytics cookies (PostHog product analytics and Sentry error tracking, both EU-hosted) are only set after you click Accept analytics in the banner. The full breakdown is on the Cookie Policy page.

We do not run session recording, autocapture or behavioural advertising.

We use the following sub-processors:

• Hetzner Online GmbH (Germany) — our servers: the application and the database.
• Cloudflare Inc. — encrypted off-site copies of the database and the code (R2 storage). Cloudflare decides where R2 keeps them; our storage is not restricted to the EU.
• Stripe Payments UK Ltd. — subscription billing, invoices and the customer billing portal. Stripe states that it transfers personal data to other countries, including the United States and India.
• Plus Five Five, Inc. (Resend) (United States) — sends the emails your account needs: password resets and subscription notices. Resend states that it stores email data (address, subject, delivery records) in the United States.
• PostHog Inc. (EU region) — opt-in product analytics.
• Functional Software Inc. (Sentry) (EU region, Germany) — error tracking: errors on our servers are reported so we can fix them; error tracking in your browser runs only after you accept analytics.
• BetterStack — uptime and status-page service polling our public /health/readyendpoint; no user data is shared.

Stripe’s data-processing terms form part of its services agreement, and Resend’s are in force from sign-up. PostHog’s and Sentry’s data-processing agreements are accepted in their own dashboards; we are completing that. Some of these providers process data outside the UK — see section 11.

• Account and saved analyses — kept while your account exists, including after a subscription ends. You can delete them at any time under Account → Your data; deletion is immediate in the live database, and copies in backups expire within thirty (30) days.
• Billing records — including the subscription emails we sent you (reminders, cancellation and refund notices) and refund records — retained for six (6) years from the end of the relevant financial year to comply with HMRC record-keeping rules, also after you delete your account.
• Security and request logs — application logs, which include IP addresses and your user id, are kept for up to ninety (90) days; web-server access logs for up to fifteen (15) days. They are then deleted automatically.
• Pilot sign-ups — twelve (12) months from the day you sign up, then deleted automatically; earlier if you ask.
• Research interview notes — twelve (12) months from the interview, then deleted; earlier if you ask.
• Database backups — nightly snapshots held in Cloudflare R2, which encrypts every stored object at rest (AES-256), with a thirty (30) day retention window enforced by rclone delete --min-age 30d.
• Analytics and error reports (analytics and browser error reports only if you accept analytics; errors on our servers are always reported) — PostHog keeps events for one (1) year on its free plan and seven (7) years on paid plans, and offers no shorter period; Sentry keeps error reports for thirty (30) days on its Developer plan and ninety (90) days on paid plans. Both are tied to your account’s random user id, not your email.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where the lawful basis no longer applies;
• restrict or object to processing;
• receive a portable copy of your data in machine-readable form;
• withdraw consent for analytics processing at any time.

Signed in, you can download all your data (JSON) and delete your account yourself under Account → Your data; deletion cancels any subscription first. For anything else, or to exercise any of these rights by email, write to datadeal50@gmail.com from the email address on your account. We respond within one calendar month. You can also lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.

Passwords are hashed with bcrypt at cost factor 12. Access tokens are short-lived JWTs (15-minute access, 30-day refresh) stored in HttpOnly cookies marked Secure and SameSite=Lax. Traffic is served exclusively over HTTPS (TLS 1.2+) with HSTS for one year. The platform is protected by a Content Security Policy and per-endpoint rate limits. Backups are encrypted in transit and at rest. We test database restore on a recurring basis.

DataDeal is a B2B product and is not intended for, marketed to or used by anyone under 18. We do not knowingly process children’s personal data.

Our servers are in Germany. Two providers transfer personal data outside the UK: Stripe (it states: to countries including the United States and India) and Resend (it states: email data is stored in the United States). Both list among their transfer safeguards the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses and the UK Extension to the EU-U.S. Data Privacy Framework. Our off-site backup copies at Cloudflare R2 are not restricted to the EU.

We may update this notice from time to time. The version number and effective date at the top change with each revision. Material changes will be notified by email to the address on your account at least thirty (30) days in advance where practicable.