Privacy Policy
This policy explains what personal data DealPulse processes, why, and what rights you have. It is written to be read, not skimmed past.
1. Who is responsible
The controller for your account and website data is Digiteum Sp. z o.o., with its registered office at Szafarnia 11/F8, 80-755 Gdańsk, Poland, entered in the National Court Register (KRS) under number 0000866372, NIP 5833409796 (EU VAT: PL5833409796), REGON 387354235 ("Digiteum", "we"). For personal data contained inside the transcripts you upload (for example the names of people on your sales calls), you are the controller and we act as your processor, handling that data only to provide the Service.
2. What we process, and why
| Data | Where it comes from | Why we process it | Legal basis |
|---|---|---|---|
| Account data: name, email, Google account identifier | Google sign-in | Creating and securing your account | Contract |
| Your Content: uploaded transcripts and the analysis derived from them (signals, summaries, recommendations) | You | Providing the analysis the Service exists for | Contract (as your processor for in-transcript personal data) |
| Usage and technical data: log records, IP address, approximate request metadata | Your use of the Service | Security, abuse prevention, keeping the Service working | Legitimate interest |
| Contact and access-request form data | You | Answering you, managing pilot access | Legitimate interest / pre-contract steps |
We do not sell personal data, and we do not use advertising trackers.
3. AI processing
Transcript analysis runs through the OpenAI API. Under OpenAI's API terms, data submitted through the API is not used to train their models. We send only what is needed to perform the analysis you requested.
4. Who helps us run the Service
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services (AWS) | Hosting: application and database | EU (Ireland, eu-west-1) |
| Supabase | Authentication (Google sign-in) | EU (Ireland) |
| OpenAI | Transcript analysis via API | United States |
Where data leaves the EU (OpenAI), the transfer is covered by the European Commission's Standard Contractual Clauses and the provider's data processing addendum.
5. How long we keep data
- Your Content: until you delete the deal it belongs to, or your account. Uploaded transcript files are processed and the extracted text retained as part of your deal history; you can delete deals at any time from within the Service.
- Account data: for the life of your account, then deleted or anonymised within a reasonable period.
- Logs: kept for a short rolling window for security and troubleshooting.
6. Your rights
Under the GDPR you can ask us for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Use the contact form and we will respond within the statutory time. You also have the right to lodge a complaint with a supervisory authority; in Poland that is the President of the Personal Data Protection Office (PUODO), or the authority in your own EU country.
7. People on your calls
If you upload transcripts of calls with other people, you are responsible for having a lawful basis to record and process those conversations. As your processor for that data, we handle it only on your instructions: we analyse it, show the results to you, and delete it when you delete it.
8. Security
Data is encrypted in transit, hosted in the EU, and access to production systems is restricted. Sign-in is delegated to Google via Supabase; we never see or store your password.
9. Changes
If this policy changes materially we will say so in the Service before the change takes effect. The date at the top always tells you when it was last touched.