Data Processing Agreement

For data you upload or generate in the platform (company profiles, negotiation content, counterparty contacts), you act as the Controller and DeelFlow acts as the Processor. DeelFlow processes this data only on your documented instructions, which include your use of the product's features.

We process personal data for the duration of your account and only as needed to provide the service. On termination, data is deleted or returned in accordance with our retention settings and your instructions.

• Hosting and storing your negotiation, company, and contract data.
• Generating AI negotiation guidance and suggested responses.
• Delivering transactional emails such as invitations and notifications.
• Securing, maintaining, and improving the service.

Data subjects may include you, your team members, and counterparties you invite. Personal data may include names, business email addresses, company affiliations, and the content of negotiations you choose to enter.

You authorise DeelFlow to engage the sub-processors listed in our Privacy Policy (including Supabase, Vercel, Resend, and our AI model provider). We impose data-protection obligations on each sub-processor consistent with this DPA and will give notice of material changes to the sub-processor list.

We implement appropriate technical and organisational measures, including encryption in transit, row-level access controls, least-privilege roles, and audit logging. See our Security page for details.

Where personal data is transferred outside its region of origin, we rely on lawful transfer mechanisms such as Standard Contractual Clauses and ensure equivalent protection travels with the data.

We will provide reasonable assistance to help you respond to data subject requests (access, correction, deletion, portability) and to meet your obligations for breach notification and impact assessments.

We will notify you without undue delay after becoming aware of a personal data breach affecting your data and provide the information you reasonably need to meet your own notification obligations.

On request or on termination, we will delete or return personal data, except where retention is required by law. Retention behaviour can be configured in your workspace's data-retention settings.

To request a countersigned copy of this DPA or to discuss data-protection terms, contact privacy@deelflow.dev.