Legal
Privacy Policy
Last updated: 2 August 2026
DealDoor is operated by Search Marketing Success Ltd, a company registered in Ireland (company number 685490), registered office 77 Lower Camden Street, Dublin 2, Ireland. In this policy, "we", "us" and "our" mean Search Marketing Success Ltd.
We are the data controller for the personal data described below. You can contact us about anything in this policy at hello@dealdoor.io.
Who this policy covers
DealDoor has two kinds of people using it, and we handle their data differently.
Investors are people who create a DealDoor account, set up a thesis, and receive pitches at their own DealDoor link.
Founders are people who submit a pitch to an investor through that link. Founders do not create an account.
What we collect
From investors
- Name and email address
- Account credentials (passwords are hashed; we never see them in readable form)
- Your chosen DealDoor link name
- Your investment thesis, including stages, sectors, geographies, cheque size, deal breakers and any free text you write
- Your reply templates and any edits you make to draft replies
- Records of the submissions you have received, graded, replied to or archived
From founders
- Name and email address
- Company name and website
- The answers you give on the submission form, including stage, sector, location, traction and the amount you are raising
- Any pitch deck you upload
- Technical information collected automatically when you submit, including IP address and timestamp, used to prevent spam and abuse
Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run investor accounts and provide the service | To deliver what the investor signed up for | Performance of a contract |
| Receive founder submissions and pass them to the investor | This is the purpose the founder submitted for | Legitimate interests, and performance of a contract at the founder's request |
| Grade submissions against the investor's thesis using AI | To give the investor a structured view and the founder a specific answer | Legitimate interests |
| Draft a reply for the investor to review, edit and send | The core function of the service | Legitimate interests |
| Send transactional email (notifications, replies, digests) | To operate the service | Performance of a contract, legitimate interests |
| Rate limiting, duplicate detection, spam prevention | To keep the service usable and secure | Legitimate interests |
| Respond to support requests and legal obligations | To run a lawful business | Legal obligation, legitimate interests |
Where we rely on legitimate interests, we have considered the effect on you. Founders submit specifically in order to be assessed and answered by the investor, so the processing is what they intend and expect.
Automated assessment
Submissions are assessed by an AI model against the investor's written thesis. The assessment produces a score, a category (Fit, Borderline, Not a Fit) and a written rationale.
No decision about a founder is made by AI alone. Every reply is reviewed by the investor, who can edit it, override the grade, or choose not to send anything. Nothing reaches a founder without a human approving it. Founders can ask us for an explanation of an assessment, or ask the investor to reconsider, by contacting us at hello@dealdoor.io.
Who we share it with
We do not sell personal data, and we do not use it for advertising.
Submissions are shared with the specific investor whose link was used. That is the point of the service.
We use the following service providers, who process data on our behalf under contract:
- Supabase — database, file storage and backend hosting
- Lovable — application hosting
- Resend — transactional email delivery
- Lovable AI — AI assessment and draft generation
Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
How long we keep it
- Investor account data: for as long as the account is open, and for 6 months after closure, then deleted.
- Founder submissions and decks: kept until the investor deletes them, or automatically for 12 months, whichever is sooner.
- Email delivery logs: 12 months.
- Backups: deleted data may persist in encrypted backups for up to 30 days before being overwritten.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data deleted
- Restrict or object to how we use it
- Receive your data in a portable format
- Withdraw consent, where we rely on consent
To exercise any of these, email hello@dealdoor.io. We will respond within one month.
Founders: if you want your submission and deck deleted, email us and we will remove it. Note that the investor may already have read it, and any reply already sent to you sits in your own inbox and theirs.
If you are unhappy with how we have handled your data, you can complain to the Irish Data Protection Commission at dataprotection.ie.
Cookies
We use only the cookies necessary to keep you signed in and to keep the service secure. We do not use advertising or third party tracking cookies.
Security
Data is encrypted in transit and at rest. Access to the production database is restricted, and row level security prevents users reading each other's data. Uploads are limited to PDF files. No system is perfectly secure, but we take reasonable steps appropriate to the data we hold.
Children
DealDoor is for business use and is not intended for anyone under 16.
Changes
If we change this policy materially we will update the date at the top and, where the change affects you meaningfully, notify account holders by email.