Privacy Policy

Contents

This Privacy Policy explains how Business Brokerage Press, Inc., doing business as Deal Studio ("Deal Studio," "we," "us," or "our"), collects, uses, shares, and protects personal information. It covers our website at site.deal-studio.com (the "Site") and the Deal Studio platform (the "Platform"), which includes Broker Ops, MarketOps, DealBuilder, CIM Studio, the Buyer and Seller Portal, booking pages, and the Deal Studio client portal. Words with capitals, such as "Brokerage," "User," "Guest," and "Customer Data," have the meanings given in our Terms of Service.

1. The short version

• Brokers use the Platform to run their business. For the information they put into it, the brokerage is in charge and we act as its service provider.
• Your mailbox, recordings, and personal notes are yours. Your firm's admins cannot read them through the Platform, and Deal Studio staff do not open them. Texts and calls also pass through your firm's CRM account, where its administrators may be able to see them.
• We read your mail and calendar to show them to you. We keep only what we list in Section 4.
• We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to train AI models.
• AI never sends anything on its own. A person approves first.
• You can disconnect any account at any time, and ask us for a copy of your information or to delete it.

2. Who is responsible for your information

When Deal Studio is in charge. We decide how information is used for: the Site; people who contact us, book a call with us, or join our webinars; the account details of Users; and how we run, secure, and bill for the Platform.

When your brokerage is in charge. For Customer Data, including information about buyers, sellers, leads, and clients that a broker keeps in the Platform, the brokerage decides what is collected and why. We handle that information on the brokerage's behalf and on its instructions, under our Data Processing Addendum with the brokerage.

If you are a buyer, seller, or contact of a broker. The broker or brokerage is your first point of contact, and their own privacy notice applies to how they use your information. You can also contact us using Section 18 and we will pass your request to the right brokerage.

3. Information we collect

Information you give us. Name, business name, email, phone number, role, brokerage, and what you enter in forms, booking requests, webinar registrations, support requests, and the Platform.

Customer Data. What brokerages and their Users keep in the Platform, such as listings and deal records, contacts, notes, tasks, documents and data room files, signed non-disclosure agreements, messages, text and call records, recordings and transcripts, campaigns, and marketing content.

Information from accounts you connect. When you connect an account, we receive what that provider makes available within the permissions you grant. See Sections 4 and 5.

Information about buyers and sellers. See Section 8.

Information collected automatically. IP address, browser and device type, pages visited, sign-in and security events, and similar technical information, collected through server logs and the cookies described in Section 13.

Payment information. Billing contacts and invoice records. Deal Studio does not store card numbers.

4. Email, calendar, and contacts

What you can connect. Users can connect one or more mailboxes and calendars from Google (Gmail and Google Calendar), Microsoft (Outlook, Microsoft 365, and Outlook.com), Apple iCloud, Yahoo, and other email providers that support standard IMAP. Deal Studio team members connect their own work mailboxes to our internal system. Connecting is always your choice.

Who handles your mailbox.

• Your email provider (for example Google or Microsoft) holds your mail and calendar. You sign in on their page. We never see or store your mailbox password.
• Nylas is the connection service we use. It carries mail and calendar information between your provider and the Platform, as our service provider. When you connect a Google account, Google's sign-in screen may show the name Nylas.
• Deal Studio receives only what you allow, and uses it only as described here.

What we access. With your permission, the Platform can:

• read email messages, including headers, bodies, folders, labels, and attachments;
• send email from your address when you write or approve a message in the Platform;
• read, create, and change calendar events and availability, and create online meeting links;
• look up your contacts while you add a guest or recipient, where you grant that permission;
• change mailbox settings, such as your signature or automatic replies, when you ask it to.

Why. Only to provide the features you use: showing your mail and calendar in the Platform, sending and replying from your address, filing conversations against deals, listings, and contacts, scheduling, finding new leads in lead notification emails, and AI Features you turn on.

What we keep.

• Broker Ops reads your mail live through Nylas and does not keep a copy of your inbox. It keeps only: the subject and date of an email you file against a contact or listing; the summaries and suggestions of the AI inbox, if you turn it on; and the buyer's name, email, phone, and message read from a lead notification email, which become a contact. Calendar events are read live, and for other people's calendars only the busy or free result is used.
• Deal Studio's internal system keeps copies of its team members' own work mail and calendar invitations so they can be shown and searched.

Who can see it. Your mailbox is personal to you. Other people at your brokerage, including admins, cannot read it through the Platform. You can share a single conversation with a teammate, and you can stop sharing at any time. Deal Studio staff do not read your mail. They would see a specific message only if you share it with us for support, where it is needed to investigate a security incident, or where the law requires it.

Disconnecting. You can disconnect a mailbox or calendar at any time in the Platform's connection settings, or for Google and Microsoft also from your account settings with them. When you disconnect, we end our access at Nylas and delete the connection. We delete the AI summaries, lead details, and deal tags we kept from that mailbox. Contacts created from lead notification emails stay in your contacts. You choose whether emails you filed against a contact or listing stay in your notes as a subject and date. Copies in backups expire on the schedule in Section 14.

Google user data. Deal Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described in this section.
• We transfer it only to provide those features (for example, to Nylas and to our AI provider, or your brokerage's own AI provider if it chose one, when you turn on an AI Feature for your mail), for security, to comply with law, or as part of a merger or sale of our business with your prior consent.
• We do not use it for advertising, and we do not sell it or give it to data brokers or information resellers.
• People do not read it unless you give us your agreement to view specific messages, it is needed for security, it is required by law, or it is aggregated and anonymized for internal operations.
• We do not use Google Workspace API data, or any other Google user data, to develop, improve, or train generalized or non-personalized AI or machine learning models.

Microsoft user data. We use information received through Microsoft sign-in and Microsoft Graph only to provide the features described in this section, under the same limits as Google user data.

5. Meetings, Zoom, recordings, and transcripts

Zoom meeting links. If you connect a Zoom account, the Platform can create Zoom meeting links for events and bookings. We receive what Zoom provides for that purpose, such as meeting IDs, links, and times.

Recordings and AI notes. Where you turn on recording or AI notes:

• In Broker Ops, you can record or upload a call or meeting. The file is stored privately and is visible only to you unless you share it.
• In Deal Studio's internal system, Zoom meetings that a team member hosts can be recorded in Zoom's cloud, and the transcript, audio, and summaries are brought in for that team member only. Video stays in Zoom.
• Transcripts are made by AssemblyAI or by Zoom. After AssemblyAI returns a transcript, we delete AssemblyAI's copy of the file.
• Summaries are made by our AI provider, or by your brokerage's own AI provider if it chose one (Section 9).

Consent. Brokers are responsible for telling people they are being recorded and for getting any consent the law requires before recording. Zoom shows its own notice when cloud recording starts.

Keeping and deleting recordings. Recording audio is deleted automatically 12 months after it is recorded. Transcripts are kept until the broker deletes them. When you delete a recording, we delete the file, its transcript, and its summary. Tasks you created from the summary stay until you delete them. Recordings that stay in your Zoom account are governed by your agreement with Zoom.

Removing our Zoom app. If you remove Deal Studio's app from your Zoom account, we stop accessing Zoom for you and delete the Zoom connection and any Zoom data we hold for you within 10 days, except recordings and transcripts you have already brought into the Platform, which stay until you delete them.

6. Texts, calls, and email marketing

Texting and calling. Brokers can text and call from a line assigned to them. The content and records of those texts and calls are stored in the Platform so the broker can see the conversation with the deal. In the Platform they are personal to the broker. Texts and calls are carried by the brokerage's account with our CRM and marketing automation provider and its telecommunications carriers. People with administrator access to the brokerage's CRM account may be able to see texts and call records there.

The broker is the sender. When a broker texts, calls, or emails people, the broker and their brokerage decide who to contact and are responsible for getting consent. The Platform helps by honoring opt-out replies such as STOP, and other clear requests to stop, by answering HELP with the brokerage's contact details, by holding scheduled text campaigns to daytime hours where the recipient may be, by keeping a record of consent for personal contacts in text campaigns, and by requiring an unsubscribe link and postal address in marketing email.

Texts from Deal Studio. If you give us your phone number on the Site or a booking page, you can choose to receive texts from Deal Studio about your request and, if you separately opt in, about our services. Agreeing is optional and not a condition of any purchase. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. We do not share mobile numbers or text messaging consent with third parties or affiliates for their marketing or promotional purposes. We share them only with the providers that deliver the texting service, or where the law requires.

7. Contacts, sharing, and what your firm can see

Personal contact books. By default, the contacts each broker keeps are personal to that broker. Nobody else at the firm sees them: not other brokers, not admins, and not Deal Studio staff.

Firm contacts. Contacts that come from firm sources, such as the firm's website forms, firm pipelines, and deals, are firm contacts. So are contacts a broker chooses to share. Brokerage admins can choose to share buyers, sellers, or other contacts across the firm using three separate settings, each off by default.

When a contact reaches the firm's CRM. Texting, calling, automations, bookings, and marketing sends run through the brokerage's CRM. The first time a broker does one of these things with a personal contact, that contact's name, email, phone number, and the broker as owner are added to the brokerage's CRM, where the brokerage's admins can see them. Notes, tasks, deals, labels, and personal fields are never added. We show the broker a notice the first time this applies.

What brokerage admins can do. Admins manage the firm's settings, Users, firm contacts, and shared items. They can see the firm's contact list (name, owner, and linked deal) so contacts can be reassigned when someone leaves. They cannot read another person's mailbox, texts, call records, recordings, or personal notes through the Platform. Texts and call records also sit in the brokerage's CRM account, where people with administrator access to that account may be able to see them (Section 6).

Deal Studio staff access. Our staff may need to work inside a brokerage's account to set it up or support it. They do so only through an operator session that is time-limited, shown on screen, and recorded in a tamper-resistant audit log. Operator sessions cannot open mailboxes, texts, call records, recordings, or personal notes. Like any software provider, a small number of our engineers have technical access to the underlying systems for maintenance and security. They use it only for those purposes, and that access is logged by our hosting providers.

8. Buyers and sellers

If a broker invites you as a buyer or seller, the Platform collects:

• your name, email, phone number, and the profile and buyer criteria you give the broker;
• non-disclosure agreements and confidentiality agreements you sign, with the date signed;
• proof of funds or other documents you upload, and whether the broker has marked proof of funds as verified;
• your activity in the portal: when your link was first opened, when you were last active, which documents you opened, previewed, or downloaded, and how many minutes you spent with each document;
• portal sign-in codes and session records, for security.

How brokers use this. Brokers use it to manage the deal, to know who has signed a non-disclosure agreement, and to decide who to follow up with first.

Buyer and lead ratings. A broker can set criteria that give a buyer or lead a rating out of ten, calculated in plain software from deal activity (for example, whether and how quickly a non-disclosure agreement was signed, whether proof of funds is verified, whether the profile is complete, and time spent with documents) and from information the broker chooses. Ratings help the broker decide where to look first. They are shown only to the broker's team, never to buyers, and are not a decision about you. The Platform refuses criteria that name a protected characteristic such as race, religion, national origin, sex, age, disability, or family status. AI may help a broker write criteria, but AI does not see buyers, leads, or ratings.

Your rights. Contact the broker first. You can also contact us (Section 18).

9. AI features

Our AI provider. AI Features run on models from Anthropic, using Deal Studio's own account, unless your brokerage has given that feature one of its own AI provider keys.

Your brokerage's own AI provider. Where Deal Studio turns this option on, a brokerage can add one or more of its own AI provider keys: Anthropic, Google Gemini, OpenAI, or Perplexity. The brokerage admin chooses which key runs which features: a default key for most AI Features, a key for the assistant, and a key for image generation (Google Gemini or OpenAI). A Perplexity key is held for a future research feature. Any feature not given a key runs on Deal Studio's own Anthropic account. Image generation in MarketOps is available only on a brokerage's own key. Only a brokerage admin can add a key, after accepting a notice for that key that is recorded with its version, the time, and who accepted it. Each key is encrypted, is never shown again after it is saved, and is removed when the admin removes it or the option is turned off. Requests on a key go to that provider under the brokerage's own agreement with it. That agreement governs the data, including what the provider keeps and for how long. The brokerage is responsible for that provider's terms, settings, charges, and how it handles data. We send only what each request needs: the words of the request and the facts it is about, not user ids, email addresses, or account details. We ask the provider not to store the exchange where the provider offers that. If a key stops working or runs out, only the AI Features that use that key pause for that brokerage, and its admins are told. We never switch those features to Deal Studio's account. Images made this way are saved in the brokerage's MarketOps Media, with the provider recorded, and stay unapproved until a brokerage admin approves them.

Google Gemini keys. A brokerage's Google Gemini key must come from a Google Cloud project with billing enabled, never a free AI Studio key. Google's Gemini API terms call the free tier "Unpaid Services". On that tier, Google's terms say it uses content and responses "to provide, improve, and develop" its products, and that "human reviewers may read, annotate, and process your API input and output." Google's terms tie its Data Processing Addendum only to paid services, and treat a key as paid when it runs "through a Cloud Project associated with an active billing account." (Gemini API Terms) Before a Gemini key is saved, the brokerage admin must confirm that it comes from a Google Cloud project with billing enabled. That confirmation is recorded with the notice. Google's documentation describes no way for an app to tell a free key from a paid one, so we rely on the admin's confirmation.

What is sent. Only what a feature needs for the task you started or turned on. For example: the sender, subject, and up to the first several thousand characters of an email, when you turn on the AI inbox; the transcript of a recording you ask to summarize; or the text of a draft you ask to improve. Deal Studio's internal system and Broker Ops keep a record of AI use (who, which feature, which provider and model, and how much) but not the content of the request or answer, except the summaries and suggestions you keep.

Training. We do not use Customer Data, mail, or recordings to train AI models. Anthropic's commercial terms state: "Anthropic may not train models on Customer Content from Services." (Anthropic Commercial Terms) That statement about Anthropic applies to Deal Studio's own account. When a request runs on one of a brokerage's own keys, the brokerage's agreement with that provider decides whether it may keep or train on the content.

A person decides. AI output is a suggestion. Nothing AI drafts is sent to a buyer, seller, client, or anyone else until a person approves it.

Limits. We set daily limits on AI use per brokerage and per person. Use on a brokerage's own AI keys does not count against the brokerage's limit, but the limits for each person still apply.

CIM and design engines. CIM Studio and MarketOps design tools send the listing information and files you choose to our CIM and creative engines, which use Anthropic and Google models to draft and lay out pages. The creative engine keeps nothing after it returns a design. The CIM engine keeps working files for up to 30 days after a job's last activity, and number checks for up to 7 days, and deletes them sooner when the job is released.

10. How we use information

• To provide, secure, support, and improve the Services.
• To respond to inquiries, hold calls you book, and deliver resources you request.
• To send service messages, such as sign-in links, notifications, and support replies.
• To send marketing about our services where you have agreed or where the law allows, with an easy way to opt out.
• To detect, prevent, and investigate fraud, misuse, and security incidents.
• To bill, keep business records, meet legal obligations, and enforce our Terms.

11. How we share information

Service providers. We share information with providers that help us run the Services, under written terms that limit their use of it to providing their service to us. The current list, with what each one does and where it processes data, is at site.deal-studio.com/subprocessors. It includes hosting and database providers, our mail and calendar connection service, our AI and transcription providers, our email delivery provider, our CRM and marketing automation provider, video meeting providers, and our support desk.

Your brokerage's own providers. When your brokerage connects its own accounts, such as one or more of its own AI provider keys, information goes to that provider under the brokerage's own agreement with it, not ours. That agreement governs the data (Section 9).

Within your brokerage. As set out in Section 7.

Other cases. We may disclose information when the law requires it, to protect the rights and safety of any person, or as part of a merger, acquisition, or sale of assets, where the recipient must honor this policy. For Google user data, we would first ask for your consent.

12. No sale, no sharing for advertising, and browser signals

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use mail, calendar, or recordings for advertising of any kind. Because of that, we have nothing to opt you out of. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing, and we would honor it if we ever began either. We do not respond differently to "Do Not Track" signals, because there is no common standard for them.

13. Cookies and similar technologies

The Site and Platform use first-party cookies and local storage to keep you signed in, protect sign-in and connection steps, remember choices such as your theme, workspace, and selected mailbox, and limit session length. The Platform does not use advertising cookies or third-party analytics. On the Site, booking calendars and forms embedded from our CRM and marketing automation provider may set their own cookies so the booking or form can work. You can block cookies in your browser, but the Platform will not work without its sign-in cookies.

14. How long we keep information

Exports after an account closes. Once an account is closed, exports are prepared by Deal Studio staff only on a written request from the account owner. Firm data goes only to the brokerage, and a person's Personal Items go only to that person. We delete our copy of the export after we hand it over.

15. Security

We protect information with administrative, technical, and physical safeguards, including:

• encryption in transit (HTTPS) and encryption at rest by our hosting providers;
• additional AES-256-GCM encryption, with keys kept outside the database, for mailbox and Zoom connection tokens, integration keys, and similar secrets;
• row-level access rules in the database that keep each brokerage's information separate and keep personal items visible only to their owner;
• audited, time-limited operator sessions for staff support (Section 7);
• signed web requests between our systems and our providers.

Our providers publish their own security information. For example, see Supabase, Vercel, and Nylas. No system is completely secure, and we cannot promise that information will never be accessed without permission.

If something goes wrong. If we learn of unauthorized access to Customer Personal Data in our systems, we will notify the affected brokerage promptly so it can meet its own obligations, and we will notify individuals and regulators where the law requires us to.

16. Your choices and rights

Choices anyone has.

• Disconnect a connected account at any time.
• Reply STOP to texts, or use the unsubscribe link in marketing email.
• Ask us for a copy of your information, to correct it, or to delete it.

Rights under state privacy laws. Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, to get a copy, to correct it, to delete it, to opt out of sale, sharing, targeted advertising, or certain profiling, to limit the use of sensitive personal information, and not to be treated differently for using these rights. Residents of California, and of other states with similar laws, can use these rights where those laws apply to us. We do not use sensitive personal information to infer characteristics about anyone.

Requests about Customer Data. If your information is in the Platform because a broker put it there, we will pass your request to that brokerage and help it respond, as its service provider.

How to make a request. Email privacy@deal-studio.com or write to us at the address in Section 18. We will verify your identity by confirming your email address or phone number, and we will respond within the time the applicable law allows. You may use an authorized agent, and we may ask the agent for proof of authority. If we decline your request, you can appeal by replying to our decision, and we will tell you the outcome and, where applicable, how to contact your state attorney general.

Notice at collection, California. The categories of personal information we collect are set out in Sections 3 to 8: identifiers and contact details; commercial information (deal and billing records); internet activity (Section 3); audio recordings (Section 5); professional information; and inferences in the form of buyer and lead ratings (Section 8). Some Customer Data may be sensitive personal information, such as the contents of mail and text messages, and financial account information in documents a buyer uploads. We use it only to provide the Services. We keep each category for the periods in Section 14. We do not sell or share any of it.

Canada. If you are in Canada, you can ask to access and correct your personal information, and withdraw consent, by contacting our privacy contact in Section 18. You may also complain to the Office of the Privacy Commissioner of Canada.

17. Where information is stored, and international transfers

We are based in the United States. Broker Ops, MarketOps, and Deal Studio's internal system store data in the United States. DealBuilder, including the Buyer and Seller Portal, stores data in Canada (AWS ca-central-1, Montreal). Nylas states that it keeps some account administration data in the European Union. Information about Canadian brokers and contacts may therefore be processed in the United States, and information about US buyers and sellers in Canada, where it may be accessible to authorities under local law. We protect it with the contracts and safeguards described here wherever it is processed.

18. Contact us

Privacy contact: privacy@deal-studio.com
By mail: Business Brokerage Press, Inc., d/b/a Deal Studio, Attn: Privacy, 2726 Warlick Drive, Wilmington, NC 28409

19. Children

The Services are for business professionals. They are not directed to anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

20. Changes to this policy

We may update this policy. We will post the new version with a new version number and date and keep earlier versions at site.deal-studio.com/legal/archive. If a change materially affects how we use information we already hold, we will notify Users by email or in the Platform before it takes effect and, where the law or our provider agreements require it, ask for consent again.