Privacy Policy

1. Who we are

DealHafen (“we”, “us”) operates dealhafen.com, an AI co-pilot for Mittelstand business-succession search. [Owner: insert your legal entity name, address, and commercial register number (Handelsregisternummer) here before publishing.]

2. What data we collect

• Account data: email address, a hashed password (we never store your password itself), and — if you sign in with Google — the email, name, and account identifier Google provides.
• Investor profile data: the acquisition criteria you enter (sectors, regions, revenue/EBITDA bands, strategy).
• Usage data: your session (a login cookie) and your language preference (English/German), stored in your browser.
• Contact form submissions, if you send us one: name, email, and message.

We do not collect data on the business sellers behind a listing beyond what the source exchange already publishes anonymously — see our approach in our public documentation on seller anonymization.

3. Why we process it (legal basis)

Account and profile data: necessary to provide the service you signed up for (Art. 6(1)(b) GDPR). Security logs (e.g. failed login attempts, used only to prevent abuse): our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

4. Who else processes your data (sub-processors)

• Neon — our database host (EU region, Frankfurt). Stores your account, profile, and pipeline data.
• Vercel — hosts the application itself and runs its server-side code.
• Google — only if you choose “Continue with Google” to sign in; we receive your email, name, and a Google account identifier.
• Anthropic — used to parse free-text business listings into structured fields (industry, revenue, etc.). Listing text is not personal data about you; if you submit content through the product that includes personal data, it may be processed by this provider as part of that feature.

[Owner: a data processing agreement (Auftragsverarbeitungsvertrag / DPA) should be in place with each of these before real customer data is processed at scale — see docs/compliance.md in the project repository.]

5. How long we keep it

We keep your account and profile data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we're required to keep records for longer by law.

6. Your rights

Under GDPR you have the right to access, correct, delete, restrict, or export your data, and to object to our processing of it. To exercise any of these, contact us at [Owner: insert a real contact email, e.g. privacy@dealhafen.com]. You also have the right to lodge a complaint with your local data protection authority.

7. Cookies and local storage

We use one essential cookie to keep you signed in, and your browser's local storage to remember your language preference. Neither is used for advertising or cross-site tracking, so no cookie-consent banner is required for them under current guidance — this may change if we add analytics or advertising in the future, at which point this policy (and a consent mechanism) will be updated first.