Who we are and what this covers
This policy covers the Deal Haven marketing website at dealhaven.app and the application at app.dealhaven.app. Deal Haven is operated by Prelva Ltd, company number 16658596, registered in England and Wales. Our registered office is Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom.
Contact team@dealhaven.app about privacy or to exercise your rights. We determine the purposes of website operations, enquiries, account administration, billing and security. When an organisation supplies personal information in its deal workspace, we process it to provide the service on that organisation’s instructions. Contact that organisation about its own use of your information; we can help direct a request.
Website visits and enquiries
Requests to our website can generate hosting and security information such as your IP address, requested URL, browser or device information, request time and errors. We use operational information for our legitimate interests in delivering the website, investigating faults and protecting it against misuse.
If you email us, we receive your email address, the details you choose to include and related correspondence. We use this to respond and manage enquiries, based on our legitimate interests in communicating with people about Deal Haven. Where an enquiry is about entering a contract with you, we may also use the information to take steps at your request before that contract.
The marketing website does not provide account creation, document uploads or payment forms itself. Following a link into the application or checkout brings the relevant processing described below into scope. Please do not send passwords, payment credentials or unnecessary confidential deal material by email.
Information processed in the app
- Account identifiers, contact details, sign-in information, organisation memberships and roles.
- Workspace and deal records, financial and business documents, contacts, tasks and material you upload or share.
- Connected-mail information and correspondence when you enable an email integration.
- AI requests, responses, tool activity and related audit information when AI features are used.
- Subscription and customer identifiers, invoices, verified payment status, billing correspondence, usage and reservation records.
- Device, browser, interaction, diagnostic and security information used to operate and understand the service.
Information comes from you, people authorised in your organisation, connected services and service providers. Payment credentials are handled through Stripe’s hosted payment surfaces rather than entered into Deal Haven’s own forms. Organisation administrators manage shared workspaces; material in an organisation workspace is subject to that organisation’s access arrangements.
Why information is used
Account and subscription information is used to provide the requested service and perform our agreement with you. For organisation workspace information, the organisation determines the purposes and lawful basis of its processing.
We use operational and security information for our legitimate interests in protecting accounts, investigating misuse, resolving faults and improving service reliability. Billing and audit information may also be needed to meet legal recordkeeping obligations or establish and defend legal claims.
Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing. Contact us about the basis for a particular use of your information.
Service providers and sharing
Website hosting and enquiry handling involve our hosting and communications providers. The application’s integrations include Clerk for identity and organisations; Convex for backend processing and storage; Vercel for hosting and performance information; Stripe and Link for payments; Resend for billing confirmations; OpenAI for enabled AI features; Nylas for connected email; and PostHog for product analytics and diagnostics. Which providers receive information depends on the service and features you use.
Visiting the marketing website alone does not create an app account or upload your information to every application integration. Only use integrations and AI features with information you are entitled to process. Authorised workspace members and invited recipients can receive material you choose to share.
We may disclose information where required by law or necessary to investigate abuse and protect legal rights. Providers can process information outside the UK or EEA. The applicable arrangements depend on the provider and service. Contact us for information about the relevant processing locations and international-transfer arrangements.
Retention and deletion
We assess retention by the purpose of each record. For website and enquiry information, relevant criteria include whether an enquiry remains open, whether records are needed to investigate a fault or security issue, and applicable legal recordkeeping or claims requirements. We do not specify an automatic deletion period for hosting logs or correspondence here.
In the app, cancellation, refund and subscription expiry retain workspace data; they do not initiate deletion. Request account or workspace deletion separately through support. Organisation members must also respect their organisation’s authority over shared records.
Retention depends on whether information is needed to provide or restore the requested workspace, investigate a security or support issue, satisfy a legal obligation, or establish and defend a claim. AI conversation audit content is retained without an automatic age-based cutoff. Contact us about deletion or restriction rather than assuming a conversation disappears after a set number of days.
When handling a deletion request, we assess your identity and authority, applicable rights and any records that must remain for security or legal reasons. Payment providers can retain their own records under their separate obligations. We will explain applicable limitations when responding.
Your rights and complaints
Depending on the law and processing involved, you may have rights to access, correct, erase, restrict or receive a portable copy of your information. You can object to processing based on legitimate interests and withdraw consent where consent is the basis for processing.
Write to team@dealhaven.app to make a request. We may need to verify your identity and authority before acting. Applicable legal response periods are separate from our five-business-day initial product and billing support-response target.
You can complain to the UK Information Commissioner’s Office or, where applicable, your local data protection supervisory authority. You do not have to contact us first to exercise that right.