Privacy Policy

1. Scope of this policy

This policy explains how DealRipe, Inc. (“DealRipe”, “we”, “us”) handles personal data in connection with the DealRipe website at dealripe.com and the DealRipe service (together, the “Services”).

DealRipe is a business tool for sales teams. It operates on the accounts an organization authorizes it to connect and on the business communications and records relating to that organization’s sales opportunities. “Personal data” means information that identifies, relates to or could reasonably be linked with an identifiable individual. “Google user data” means data obtained from Google APIs under an account holder’s authorization.

2. Information we process

2.1 Categories

We also use publicly available records relevant to a customer’s pipeline, such as published agendas, minutes and budget decisions of public bodies.

2.2 Google account data

Access to a Google account is granted through Google OAuth, one account at a time, and can be withdrawn at any time. Our OAuth client is branded DealRipe on the Google consent screen. We request the permissions below, which are those the features we operate require.

Google describes gmail.compose as “Manage drafts and send emails”. Granting it therefore gives an application the ability to send mail as well as to create drafts, and Google publishes no narrower permission that allows drafting alone. Our implementation creates drafts and contains no send operation, so a message leaves a mailbox only when a person sends it. Where your organization administers the mailbox, its audit logs record what our application created.

2.3 Sensitive information

We request business communications and records. We do not request special category data under the GDPR, health information, financial account information or government identifiers. Email, attachments and transcripts carry whatever the correspondents wrote, so information of that kind can appear incidentally. Where it does, we hold it under this policy and delete it on request.

Under California law, the contents of email are sensitive personal information where the business is not the intended recipient. We are not the intended recipient of the messages we read. We use that content only to provide the Services and for purposes that law permits, and we do not use or disclose it to infer characteristics about an individual, which includes not deriving or recording any characteristic that law treats as sensitive.

Where we serve a customer in education, our integrations do not reach student information systems, learning platforms, rostering systems or education records, we do not request student data, and we do not act as a school official under the Family Educational Rights and Privacy Act. Because we read a connected business mailbox, calendar and transcripts, we cannot guarantee that a message or document a customer’s own staff wrote never mentions a student. We do not seek that information, we do not use it to build a record about any student, and we delete it on request.

2.4 What we do not collect

We do not collect payment card data, government identifiers, precise geolocation, biometric data or advertising identifiers.

3. How we use information

We use personal data to:

• provide the Services, which means reading the sources in section 2, identifying the facts relevant to an opportunity, and generating briefings, recaps, suggested drafts, recommendations and forecast reads;
• deliver those outputs to the people a customer has designated, by email or to a messaging service the customer connects;
• write information back into a customer’s own systems where the customer has enabled it, such as a draft in a user’s mailbox or structured fields in the customer’s CRM;
• operate, support, troubleshoot and improve the Services, and investigate suspected abuse or a security incident;
• comply with legal obligations and respond to valid legal process.

We do not use personal data for advertising, advertising measurement, marketing profiling, or any credit or lending purpose. We do not sell personal data and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

4. Artificial intelligence

4.1 How we use AI

We use a large language model provided by Anthropic to read the sources in section 2 and produce the outputs in section 3. Message text, transcript text and document text are transmitted to Anthropic at the time an output is generated. Generated output is a draft for a person to review and can be inaccurate or incomplete. We do not use it to make automated decisions that produce legal or similarly significant effects.

4.2 Our commitments

We have not enabled any feedback or data-sharing option that would permit our AI provider to use this content for model training.

4.3 Anthropic’s own policies

Anthropic’s handling of what we transmit is governed by its terms, which are separate from our commitments above and from our retention practices in section 8. Anthropic states that it does not use inputs or outputs from its commercial products to train its models by default, and that it deletes API inputs and outputs within 30 days of receipt or generation. It states exceptions: content flagged under its usage policy may be retained for up to two years, with classification scores for up to seven years, and data associated with feedback submitted to Anthropic is retained for five years. Its published statements on model training and data retention are the authoritative versions. We do not make commitments on Anthropic’s behalf.

5. How we share information

5.1 Service providers

We share personal data with the providers below, each only to the extent needed to deliver the Services and each bound by obligations no less protective than those in this policy. Where we process on a customer’s behalf, we notify the customer before a new provider processes its data and the customer may object on the terms of its agreement.

Google, Microsoft, Salesforce and your transcription provider are systems we read from under your authorization rather than recipients of your data. We send them only what is needed to authenticate and make a request, together with any draft or CRM field we write back at your direction.

5.2 Other disclosures

• Legal and safety. To a law enforcement, governmental or regulatory authority where required by applicable law or valid legal process, and where necessary to protect the rights, property or safety of DealRipe, our customers or the public.
• Corporate transactions. In connection with a merger, acquisition, financing or sale of assets, subject to the limits in section 5.3 for Google user data.
• At your direction. Where you ask us to share information with a third party.

5.3 Additional limits on Google user data

The following apply to Google user data in addition to the rest of this section, and override it where they differ:

• We use it only to provide or improve features that are visible to the user in the application.
• We transfer it only as necessary to provide those features, to comply with applicable law, or for security purposes such as investigating abuse. In a merger, acquisition or sale of assets we transfer it only after obtaining the explicit prior consent of the affected user.
• We do not allow humans to read it, except with the user’s explicit consent to view specific messages or files, where necessary for security purposes, where required to comply with applicable law, or where the data is aggregated and anonymized and used for internal operations.
• We do not use it, or transfer it to anyone to use it, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models.
• We do not sell it and do not transfer it for advertising, data brokerage or credit assessment.

6. Where information is processed

We store and process information using systems we operate and the service providers identified in section 5.1. Our primary database and the application compute that reads and writes it are located in a United States region.

Not everything is confined to that region. The website is delivered through a content delivery network whose points of presence are distributed worldwide, and connections are terminated and routed at the point of presence nearest the visitor. Request metadata, including IP address, is therefore handled outside the United States for visitors outside it. Operational logs are retained by our hosting provider under its own arrangements. Each provider in section 5.1 processes data in the locations its own terms permit.

If you are located outside the United States, using the Services involves transferring information to the United States, where data protection laws differ from those where you live. Where a transfer from the European Economic Area, the United Kingdom or Switzerland requires a specific safeguard, we put an appropriate mechanism in place, such as the European Commission’s standard contractual clauses. Where a customer agreement commits to processing in a particular location, that commitment applies to that deployment.

7. Security

We maintain a written information security policy. The controls include:

• Access through revocable credentials. We reach a connected system only through credentials that the account holder or an administrator grants and can withdraw at any time, and we request the narrowest capability a feature needs.
• Credential protection. Credentials and API keys are held in our hosting platform’s encrypted environment configuration and are not kept in source code. They are rotated on suspicion of exposure, on a change in who holds access, and at a customer’s request.
• Encryption. Traffic to connected systems and providers is encrypted in transit using TLS, and data in our managed database is encrypted at rest by the database provider. Key management for data at rest is handled by that provider; we do not operate our own key material.
• Customer segregation. Records carry a customer identifier and scheduled processing is scoped to a single customer.
• Logged CRM access and fail-closed writes. Reads from and writes to a connected CRM are recorded with their outcome, including refusals. Authorization for writes fails closed, so a target outside an explicit allowlist is refused rather than attempted.
• Change control. Code is version controlled, and a deployment is built and type checked before it ships.

DealRipe does not hold a SOC 2 or ISO 27001 certification. Providers we rely on publish their own reports, obtainable from them, and the infrastructure controls at the hosting, storage and physical layers are theirs. Our security documentation is available to customers and prospective customers on request. No service can be guaranteed completely secure.

7.1 Security incidents

On becoming aware of a personal data breach we contain it, determine which data and which customers are affected, and notify affected customers. Where a customer agreement sets a notification period, that period applies; otherwise we notify without undue delay and in any event within 72 hours of confirming the incident. We then rotate affected credentials and record the cause, timeline and scope.

8. Retention and deletion

We retain personal data for as long as needed to provide the Services and for the duration of the applicable customer agreement, because the product depends on the history of an opportunity over time. Different stores behave differently:

• Source content and attachments, derived information and generated outputs. Held in our database for the period above and removed when we delete a customer’s data.
• Meeting recordings. Where a notetaker captures a call, the source recording is deleted from the capture provider once the transcript has been retrieved; the transcript is retained as source content.
• Operational logs. Retained by our hosting provider under its own retention arrangements, which are shorter than the service record above and are not controlled by us on a per-customer basis.
• Backups. Our database provider maintains backups on its own schedule. A deleted record can persist in a backup until that backup expires and is overwritten in the provider’s normal cycle.
• AI provider. Governed by Anthropic’s retention policy, not ours. See section 4.3.

We delete a customer’s data on request at any time, and on termination of an agreement without a request being required. Deletion removes the data from our database and the files we hold with it, and we confirm when it is done. It does not reach backups already taken, which expire as described above, and it does not reach the systems we read from, which remain yours.

We may retain information for longer where the law requires it, where it is necessary to resolve a dispute or enforce an agreement, or where a customer agreement provides for it. Revoking our access does not itself delete data already held; see section 9.2.

9. Your rights and choices

9.1 Rights available to you

Subject to applicable law and verification of your identity, you may ask us to confirm whether we hold personal data about you and provide a copy with its categories, sources, purposes and recipients; correct it; delete it; provide it in a structured, commonly used and machine-readable format; restrict or object to particular processing; withdraw consent where processing is based on it, which does not affect prior processing; or appeal a decision on your request where the law provides for it.

9.2 Revoking access

You can revoke our access at any time from your own administrative console, without contacting us. In Google Workspace, removing access for our OAuth client invalidates the tokens issued under it, and an individual user can remove access from their own account page. Revoking stops further reads. It does not delete data already held, which is a separate request under section 8.

9.3 Making a request

Write to maanit@dealripe.com describing the right you want to exercise and the account it concerns. We may ask for information sufficient to verify your identity and your relationship to the data. We may decline where we cannot verify the request, where it is manifestly unfounded or excessive, where granting it would adversely affect the rights of others, or where the law does not require it. We respond within the period required by applicable law, for example 45 days under California law, and will tell you if we need an extension the law permits. Exercising these rights is free and we will not discriminate against you for it.

9.4 Regional rights

United States. The categories of personal data we have collected in the preceding twelve months are in section 2.1 with their sources, the purposes are in section 3, and the recipients are in section 5. We have not sold personal data and have not shared it for cross-context behavioral advertising. We receive personal data as a service provider and process it only for the purposes specified in the applicable agreement. You may use an authorized agent, and California residents may complain to the California Privacy Protection Agency or the California Attorney General.

European Economic Area, United Kingdom and Switzerland. Our lawful bases are performance of a contract, where processing is necessary to provide the Services; legitimate interests, in operating, securing, supporting and improving the Services, where not overridden by your rights; consent, where we ask for it, including authorization to connect an account; and compliance with a legal obligation. You may lodge a complaint with a supervisory authority, which in the United Kingdom is the Information Commissioner’s Office and in the European Economic Area is the authority for your country of residence.

9.5 Where we act as a processor

If your data reached us through an organization’s use of DealRipe, that organization is the controller and we act on its instructions. Direct your request to that organization. If you send it to us we will not act on it unilaterally; we will inform the organization and assist it in responding.

10. Cookies

The public pages of dealripe.com do not set cookies and do not run advertising, analytics or third-party tracking scripts. Signed-in areas of the application set cookies that are necessary to keep you signed in. We do not track users across third-party websites and we do not respond to “Do Not Track” signals.

Our hosting provider may set cookies necessary to operate, route or secure a request. If you book a demonstration through the scheduling link on the website, that opens a third-party scheduling service which sets its own cookies and handles the details you submit under its own privacy policy.

11. Children

The Services are a business tool for adults and are not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to maanit@dealripe.com and we will delete it.

12. Changes to this policy

We may update this policy. The effective date above changes with it, and the updated version applies from the date it is posted. Where a change materially affects how we handle Google user data, we will reflect it here before the change takes effect and will seek authorization again where the change requires it. Where a change materially affects your rights and it is practicable to do so, we will give advance notice.

13. Contact us

For questions about this policy, for a copy of our security documentation, or to make a request under section 9, write to maanit@dealripe.com.