Privacy Policy

Short version: your company gets its own server and its own database, and nobody else's data is on it. We hold what you put in so the software can work, and for nothing else. We do not sell it, we do not pool it, we do not train an AI on it, and there is no advertising tracker anywhere near it. Driver's licences are read on the machine they already sit on and are never uploaded anywhere. Ask and we will hand your data back or delete it. The long version, including exactly which outside companies touch what, is below.

1. Who we are, and which hat we are wearing

Dealbrace is operated by Phorbes Industries, a Utah company. "We" and "us" mean that company. "You" means the brokerage that subscribes and the people who sign in under it.

There are two different kinds of data here and they work differently:

• Data about you as our customer — your account, your email address, your sign-in records. For this we are the controller. It is covered in section 3.
• Data about your customers, which you put into Dealbrace — the applicant names, phone numbers, dates of birth, bank statements and credit reports on your deals. For this you are the controller and we are your processor. You decide what goes in and why. We hold it and process it on your instructions, and we do not use it for our own purposes. It is covered in section 2.

That distinction matters if one of your customers asks you to produce or delete their information: the request is yours to answer, and section 11 explains how we help you answer it.

2. What lives in your instance

Dealbrace is where your pipeline lives, so it holds:

• Deals — company, amount, equipment, stage, dates, the notes your team writes, tasks and follow-ups.
• Contacts — your customers and vendors: names, business names, phone numbers, email addresses, addresses, and dates of birth where a licence on the deal supplied one.
• Documents you upload — credit applications, bank statements, invoices, driver's licences, credit reports, signed documents.
• Lender activity — who a deal went to, what they said, approvals, stipulations, declines, funding details.
• Team activity — who did what and when, so the board has an audit trail.

All of it sits in your instance. We do not mine it, profile it, aggregate it into a benchmark, or look at it except when you ask us to help with something and we need to.

3. What we collect about you as an account holder

• Your email address and display name — to sign you in, to reach you about the service, and to reset access.
• A password hash, never a password. Passwords are stored as a PBKDF2-HMAC-SHA256 hash with a random per-user salt and 210,000 iterations. We cannot read your password, and nobody here can tell you what it is.
• Two-factor enrolment data — a passkey's public key, or an authenticator secret. A passkey's private key never leaves your device; we could not use it if we wanted to.
• Sign-in records — the time, the IP address, the device, and whether it succeeded. This is what makes a lockout and an account-takeover investigation possible.
• Trusted devices — if you tick "trust this device", a signed token identifying that browser, for 30 days, up to 20 devices.
• What you send us — emails, bug reports, anything you tell us in support.

We do not collect a credit card, because there is nothing to pay during the free period. When paid plans start in 2027 the card will be handled by a payment processor and we will update this policy before that happens.

4. Your instance is your own, and this is the whole point

Inside your own instance, some things are deliberately shared across your team — the lender reference notes, the call pool, your team's own playbook — because that is a shared workspace and that is what it is for. The isolation boundary is your company, not each individual user.

When a new customer is set up, we can seed the instance with our general lender reference material. That seed carries lender knowledge only — rate guidelines and credit-box notes. No deal, no customer record and no contact from any other brokerage travels with it, ever.

5. Driver's licences and dates of birth: read on the machine, never uploaded

Dealbrace can read a date of birth off a driver's licence already attached to a deal, so nobody has to type it. That reading happens entirely on the machine the file is already sitting on. The optical character recognition runs locally as part of the application. The image is not sent to Google, Amazon, Microsoft, Anthropic or any other document or vision API, and the code that performs it makes no network calls at all.

Only the extracted date is written back to the contact record. If the scan cannot read a plausible date, or two documents disagree, it records nothing rather than guessing. The licence image itself stays where you put it, behind your login.

6. The AI assistant, and exactly what it sends

The assistant summarises deals, drafts follow-ups and screens a deal against lender rules. To do that it calls Anthropic's API. Here is the honest split, taken from the code rather than from a brochure.

What is sent to Anthropic

• Deal fields: company name, stage, amount, city and state, days since activity, contact name.
• Lender names and their status on the deal, blockers and stipulations.
• Notes on the deal, and Salesforce Chatter for that deal if you have connected Salesforce.
• Open tasks and the next reminder.
• Lender rate sheets and credit guidelines, as text extracted locally from the PDFs.
• Where your instance uses call transcription, the text of a call transcript you asked to be summarised.

What is not sent

• Uploaded documents never go. No driver's licences, no credit reports, no bank statements, no signed contracts. The assistant is not given file attachments of any kind.
• No passwords, no authentication data, no full customer contact database.

We do not use your data to train any AI model, and we do not permit our AI provider to. Anthropic's commercial API terms provide that inputs submitted through the API are not used to train their models. That is their commitment to us, and it is one of the reasons they are the provider we use.

Anything the assistant produces is a draft for a human to check. See section 5 of the terms — a lender screen is a rules check, not an approval.

7. Salesforce, only if you connect it

Salesforce sync is optional and off by default. Nothing happens until you give us credentials for your own Salesforce org. If you switch it on:

• We read opportunities, related contacts and phone numbers, Chatter posts, funder decision records, user names, and files attached to those records, and mirror them onto your board.
• On a deal handoff between your own reps, we write a Chatter comment back into your org so the receiving rep gets the notification. That is the only thing we write.
• Your credentials are stored in your instance's own configuration and are used for nothing else.

Turn it off and the sync stops. What is already on your board stays.

8. Who else touches your data

These are every outside company involved in running Dealbrace. Each gets the minimum needed to do its job, and there are no others.

Nobody else. No advertising network, no data broker, no marketing platform, no analytics vendor, no lead exchange. We do not sell or rent personal information, and we never have. If we ever add a sub-processor that handles your customers' data, we will update this table and tell you before it goes live.

We will also disclose data if a valid legal process compels us to. Where the law allows it, we will tell you first so you can respond.

9. Cookies and tracking

The app sets two cookies, both strictly functional: a session cookie that keeps you signed in, and, only if you asked to trust a device, a device cookie so you are not challenged for a code every time. Both are marked HttpOnly and SameSite, and are sent over HTTPS only on the hosted service. The session expires within 24 hours; the device cookie lasts 30 days.

There is no analytics, no advertising pixel and no third-party tracking script in the app or on this website. No Google Analytics, no Tag Manager, no Meta pixel, no session recording, no fingerprinting. The only request either goes to an outside company is the one that fetches the typefaces from Google Fonts, which is why it is listed in the table above.

Like any web server, ours records ordinary request logs — time, IP, the page requested, the browser string — which we use to keep the service running and to investigate abuse, and which are not shared with anyone.

10. How long we keep things, and how they are backed up

• Your instance's data — kept for as long as your subscription is open, because it is your working file. We do not expire your deals.
• Backups — your hosted data is copied off the hosting provider onto separate hardware we control, and we keep 30 days of daily restore points. Older copies are deleted automatically.
• Save snapshots — the application keeps a short rolling history of recent saves so a bad edit can be undone. It is a small window, not an archive.
• Sign-in and audit records — kept while the account is open, because they are the only way to answer "who changed this".
• After you close the account — see section 11.

11. Getting your data back, correcting it, and deleting it

• Export. Email privacy@dealbrace.com from an address on the account and we will send a complete copy of your instance's data — deals, notes, contacts and documents — in a usable format, free, normally within 14 days and always within 30. Leaving is not a negotiation.
• Correct. Most of it you can edit yourself on the board. If something is stuck, tell us and we will fix it.
• Delete. Ask us to close the account and we shut down the instance and delete its data. It is gone from live systems within 30 days, and from backups as those roll off, within 60. We confirm in writing when it is done. We keep only what a law obliges us to keep.
• One of your customers has asked you for their data. Send us the request and we will produce or delete their records inside your instance so you can answer them. Because you are the controller of that data, the answer is yours to give, and we will not respond directly to your customer without your say-so.
• State and international privacy laws. If you or your customers are covered by a law such as the CCPA or the GDPR, those laws give further rights. Email us and we will honour them. We do not sell or share personal information for advertising, so there is nothing to opt out of.

12. Security

How the service is actually protected — the isolation model, passwords and passkeys, sign-in lockouts, how documents are gated, and a plain list of what we have not built yet — is set out on the security page. It is deliberately specific and deliberately honest about the gaps.

No system is perfectly secure and anyone who tells you otherwise is selling something. If we discover a security incident affecting your data, we will email the account contacts within 72 hours of becoming aware of it with what we know at the time, what is affected, and what we are doing, and we will keep you updated as we learn more rather than waiting until the story is tidy.

13. Children

Dealbrace is a business tool sold to companies. It is not directed at children and we do not knowingly collect personal information from anyone under 18. If you believe we hold a child's information, tell us and we will delete it.

14. Changes to this policy

We may update this policy. If a change is material — anything that meaningfully expands what we collect, adds a sub-processor that touches your customers' data, or changes your rights — we will email the account contacts at least 30 days before it takes effect, and the "last updated" date above will change.

15. Contact

Privacy questions, export requests, deletion requests, a security concern, or a demand from one of your own customers you need help answering: privacy@dealbrace.com. It reaches a person, not a queue.

Nothing on this page is legal advice to you or to your customers. Your own obligations under the Gramm-Leach-Bliley Act, state privacy law and your lender agreements are yours to meet; ask your own counsel about them.

Dealbrace is operated by Phorbes Industries, Utah, United States · support@dealbrace.com · See also Terms of Service and Security.