Privacy policy

The Dealflou platform (the “Platform”) is operated by MasValor S.A.S., tax ID NIT 900681742-2, with registered offices at Cra 11A # 99-25, Bogotá D.C., Colombia (“MasValor”, “we”, “us”). We are the responsable del tratamiento — the data controller — for the processing described in this policy.

Privacy contact: privacy@dealflou.com. Data Protection Officer: dpo@dealflou.com. You may write to us in Spanish or English.

Controller vs processor. For your account and your use of the Platform, we are the controller. For the content your firm uploads into its workspace — deal documents, data rooms, counterparty records — your firm is the controller and we act as its processor under the Data Processing Agreement. If your data reached us because a firm invited you to a deal, that firm decides why your data is there; this policy still tells you what we do with it and how to reach us.

Under the GDPR and the LGPD every purpose needs a legal basis. Under Colombian law we rely on your authorisation and on the exceptions in article 10 of Law 1581 of 2012. Our purposes and bases are:

• Providing the Platform — creating your account, running workspaces, data rooms, NDAs, offers and diligence. Basis: performance of the contract with you or your firm (GDPR art. 6(1)(b); LGPD art. 7(V)); your authorisation under Colombian law.
• Keeping the audit chain — recording who did what, when and from where, so that an executed NDA or offer can be evidenced later. Basis: performance of the contract, and our legitimate interest in providing an evidentiary record that our customers and their counsel rely on (GDPR art. 6(1)(f); LGPD art. 7(IX)). We consider this proportionate because the data is limited to what an evidentiary record requires, is visible to the parties themselves, and is what makes the service work at all.
• Security and abuse prevention — multi-factor authentication, bot protection, rate limiting, detecting unauthorised access. Basis: legitimate interest in protecting the Platform and its users, and our legal obligation to keep personal data secure.
• KYB, sanctions and AML screening — deciding whether to grant a firm access. Basis: compliance with legal obligations, and legitimate interest in not admitting counterparties we may not lawfully serve.
• Billing and tax — charging for the service and issuing invoices. Basis: performance of the contract and compliance with tax and accounting obligations.
• AI diligence — analysing documents you have explicitly marked as available for AI processing. Basis: your consent, expressed per document; withdraw it and the document stops being sent for analysis.
• Service communications — transactional email you cannot opt out of while you hold an account — an NDA was countersigned, a payment failed, a security event occurred. Basis: performance of the contract.
• Marketing communications — product news and commercial email. Basis: your consent, withdrawable at any time from the footer link or the unsubscribe link in every message.
• Analytics — understanding how the Platform is used. Basis: your consent. No analytics provider is currently loaded on the Platform; if that changes, it will run only for visitors who have consented.
• Defending legal claims — retaining what we need to establish, exercise or defend a claim. Basis: legitimate interest and compliance with legal obligations.

If you refuse. Account and audit data are necessary to provide the Platform: without them we cannot open an account. AI processing, analytics and marketing are optional and refusing them costs you nothing but those features.

AI diligence produces findings, scores and summaries from documents in a data room. These are decision support: no automated decision producing legal or similarly significant effects about you is taken by the Platform, so GDPR article 22 is not engaged. A human being at the advising firm decides what to do with any finding.

Documents are sent for analysis only when the uploading firm has marked them as available for AI processing. We use Anthropic and OpenAI as processors under terms that prohibit training their models on our customers’ content. Access requests and KYB outcomes are reviewed by a person; you can ask for the reasons behind a decision and contest it by writing to privacy@dealflou.com.

We disclose personal data only in these situations:

• Inside your firm's workspace — to members of your firm, according to the permissions your firm’s admin sets.
• To the counterparty on a deal — once an NDA is executed, the other side sees what the workflow requires — your firm name, the signatory, and the audit record of your actions on that deal.
• To our sub-processors — listed below, each under a written contract that limits them to our instructions.
• To our professional advisers — auditors, lawyers and insurers, bound by confidentiality.
• To authorities — where we are legally compelled. We assess each request, require it to be valid and specific, and notify you unless we are legally prohibited from doing so.
• In a corporate transaction — if we are acquired or merge, under confidentiality and with this policy continuing to apply until you are told otherwise.

Our current sub-processors are Supabase (database, authentication and file storage), Railway (application hosting), Resend (transactional email), Stripe (payments and tax), Cloudflare (bot protection), Anthropic and OpenAI (AI analysis of documents opted in for it), and — only if you connect them — Google and Slack. The current list with each provider’s role and location is maintained in the DPA; customer firms are notified before a new sub-processor is added and may object.

Each workspace is pinned to an in-region replica based on the firm’s country of incorporation — the EU (Frankfurt), the United States (Virginia), Brazil (São Paulo) or APAC (Singapore). Writes commit only to the home region.

Because we are established in Colombia and use providers established elsewhere, personal data is transferred internationally. We rely on: the European Commission and UK adequacy decisions where they exist; the EU Standard Contractual Clauses and the UK Addendum where they do not; the equivalent LGPD transfer clauses for data originating in Brazil; and, for transfers out of Colombia, the country declarations of adequacy issued by the Superintendencia de Industria y Comercio, or your express authorisation where no declaration covers the destination. We carry out a transfer risk assessment for each recipient and apply encryption in transit and at rest throughout. Write to dpo@dealflou.com for a copy of the safeguards for a specific transfer.

We use a small number of first-party cookies. We do not use third-party advertising or cross-site tracking cookies. No analytics provider is currently loaded on the Platform.

• dealflou_consent — stores your cookie and data preferences so we do not ask again. Set only after you choose. Duration: 12 months. Rejecting the optional categories still writes this cookie — it is what records the rejection.
• sb-*-auth-token (Supabase) — keeps you signed in and ties every action to your account. Strictly necessary. Duration: the session, refreshed while you stay active.
• dealflou_recovery_aal2 — short-lived, HTTP-only token that bridges a multi-factor recovery-code sign-in. Strictly necessary.
• dfl_oauth_nonce and dfl_oauth_pkce — HTTP-only, single-use values that protect a third-party integration connection against CSRF. Strictly necessary. Deleted as soon as the connection completes.

Strictly necessary cookies are required for the Platform to work and are not subject to consent. You can change or withdraw consent for the optional categories at any time through the Privacy preferences link in the site footer, or by deleting site data in your browser. Withdrawal is as easy as consent and does not affect processing carried out before you withdrew. We honour Global Privacy Control signals where your browser sends one.

• Audit events and executed NDAs — 7 years from the event, to match financial-services evidentiary norms and the limitation periods that apply to the transactions they evidence. This is the one category we will not delete early: it is the record the parties themselves rely on.
• Account and profile data — the life of the account plus 90 days.
• Data-room documents — deleted on workspace closure unless your firm has contracted a longer retention.
• KYB and AML records — 5 years after the relationship ends, as anti-money laundering rules require.
• Billing and tax records — 10 years, as Colombian commercial and tax law requires.
• Consent and acceptance records — for as long as the consent is relied on, plus the applicable limitation period.
• Support correspondence — 3 years from the last message.

When a period ends we delete the data or irreversibly anonymise it. Backups are overwritten on a rolling cycle, so data may persist in backups for a short period after deletion from the live system.

Wherever you are, you may ask us to:

• Know and access — what we hold about you, why, who we shared it with and where it came from, and get a copy.
• Correct — inaccurate or incomplete data.
• Delete — data we no longer have a basis to keep. We will tell you plainly when we must refuse — an audit record of an executed NDA, for instance, is retained for the period above and we will explain why rather than delete it quietly.
• Restrict or object — to processing based on legitimate interest, including profiling. If you object we stop unless we can show compelling grounds that override your interests.
• Port — data you gave us, in a structured, commonly used, machine-readable format, and have it sent directly to another provider where technically feasible.
• Withdraw consent — at any time, without affecting processing already carried out. This applies to marketing, analytics and AI processing.
• Not be discriminated against — for exercising any of these rights. We will not deny service, charge a different price or degrade quality because you exercised them.

California (CCPA/CPRA). In the preceding 12 months we have not sold or shared personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics — so there is nothing to opt out of or limit, but the right remains available to you. You may use an authorised agent, and we will verify the authorisation.

How to exercise them. Write to privacy@dealflou.com from the address on your account, or ask your firm’s admin. We may need to verify your identity. We respond within 30 calendar days (GDPR/LGPD) and within 45 days for CCPA requests, extendable once where the law permits and we tell you why. Under Colombian law, a consulta is answered within 10 business days and a reclamo within 15 business days, extendable once with notice. Requests are free unless manifestly unfounded or excessive.

If we get it wrong. Tell us first — we would rather fix it. You may also complain to your supervisory authority: in Colombia the Superintendencia de Industria y Comercio; in the EU, the authority of your country of residence or workplace; in the UK, the ICO; in Brazil, the ANPD; in Japan, the PPC.

AES-256 encryption at rest and TLS 1.3 in transit; tenant isolation enforced at the database layer through row-level security, so an application-level mistake cannot leak data across firms; multi-factor authentication; per-viewer watermarking on document views; downloads denied by default and granted explicitly; and an append-only audit chain. The full controls list is at /security, which also states plainly which independent certifications we hold and which are still planned.

No system is perfectly secure. If a breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware and notify affected users without undue delay, in line with GDPR articles 33–34, the LGPD and the reporting duties of the Superintendencia de Industria y Comercio. Report a vulnerability to security@dealflou.com.

When we change this policy we update the effective date above and keep the prior version available on request. For changes that materially affect how we use your data, we notify you by email or in the Platform at least 30 days before they take effect, and where the change requires your consent we ask for it rather than assume it.

MasValor S.A.S. · NIT 900681742-2 · Cra 11A # 99-25, Bogotá D.C., Colombia.

Privacy: privacy@dealflou.com · Data Protection Officer: dpo@dealflou.com · Security: security@dealflou.com.