DDealybee
Get access

Privacy Policy

Last updated: 2026-05-17

Dealybee is the AI transaction layer for buying and selling across marketplaces. This Privacy Policy explains what we collect, why we collect it, how long we keep it, and the choices you have over your data.

1. Who we are

Dealybee ("we," "us," "our") operates the website at dealybee.ai and any related products. If you have questions about this policy, contact [email protected].

2. What we collect

We collect the minimum data we need to operate the service.

Account data

  • Email address (used as your account identifier; we do not use passwords)
  • A display name you choose

Content you submit

  • Listings (titles, descriptions, photos, asking prices)
  • Buyer intents (descriptions of what you want)
  • Messages in your conversations with other users
  • Photos, voice transcripts, and URLs you submit through the universal input
  • Dispute submissions (notes, photos)

Transaction data

  • Records of every transaction you participate in (price, status timeline, fees)
  • Shipping addresses you provide for completed sales
  • KYC details collected by our regulated payment processor for sellers receiving payouts (we do not store full bank or government-ID information; the payment processor holds it)

Usage and security data

  • IP addresses (used for rate limiting, fraud prevention, and security logging)
  • Device and browser information from your interactions
  • Logs of authentication events (sign-in attempts, sign-outs)

Cookies and similar technologies

  • A session cookie that keeps you signed in
  • A short-lived referral cookie that attributes signups to the link that brought you (30 days)
  • Short-lived share cookies used by the PWA share-target feature (5 minutes)

We do not use third-party advertising or behavioral tracking cookies.

3. Why we collect it

  • To operate the service (authenticate you, render your listings, deliver your messages, hold escrow, calculate fees, compute your Dealybee Score)
  • To prevent fraud and abuse (rate limiting, anomaly detection, blocking known bad actors)
  • To comply with legal obligations (tax reporting, responding to lawful requests, dispute records)
  • To improve the product (aggregate analytics; no individual profiling)
  • To send you transactional emails (sign-in links, transaction updates, dispute notifications)

We do not sell your personal information. We do not share it with advertisers.

4. Who we share it with

We share data with a small set of categorically-described third parties (called "sub-processors" under data-protection law). Each is bound by a contract that limits their use of your data to what we instruct.

| Category | What they do | |---|---| | Cloud hosting + database providers | Run the application servers and store data | | Payment processors (regulated US financial institutions) | Hold funds in escrow, process payouts, perform seller KYC | | AI processors | Item identification, valuation, listing copy generation, voice transcription, dispute summarization | | Email delivery providers | Send sign-in links and transactional emails | | Fraud-detection and rate-limit infrastructure | Detect abuse and protect the service |

A current list of named sub-processors is available on request from [email protected].

We may also disclose data when required by law (court order, subpoena, government investigation). We will tell you about lawful requests unless the law prohibits us from doing so.

5. How long we keep it

Different data has different retention windows:

| Data | Retention | |---|---| | Account data (email, profile) | Lifetime of the account | | Listings and intents | Lifetime of the account, then 90 days | | Messages between users | Lifetime of the account or 5 years, whichever is shorter | | Voice transcripts | 30 days | | Inquire history (universal-input lookups) | 12 months | | Transaction records | 7 years (US tax requirement) | | Dispute records | 7 years | | Auth session tokens | Until you sign out, or 30 days inactive | | Magic-link sign-in tokens | Until consumed, or 15 minutes | | Security logs (IPs, auth events) | 12 months |

When you delete your account, we delete or anonymize data immediately except for records we are legally required to retain (transactions, tax records).

6. Your rights

Depending on where you live, you have some or all of these rights:

  • Access — request a copy of the data we hold about you
  • Correction — fix inaccurate data
  • Deletion — ask us to delete your account and data (subject to legal-retention exceptions above)
  • Portability — receive your data in a machine-readable format
  • Objection — object to specific processing
  • Withdraw consent — for any processing based on consent

To exercise any right, email [email protected] from the address on your account. We respond within 30 days.

If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local data-protection supervisory authority.

If you are in California, you have the rights described above under the CCPA/CPRA, including the right to know, correct, and delete. We do not sell or share personal information for cross-context behavioral advertising.

7. International data transfers

Data is hosted in the United States. If you access Dealybee from outside the US, you understand that your data is transferred to and processed in the US. For transfers from the EEA, UK, or Switzerland, we rely on the Standard Contractual Clauses approved by the European Commission.

8. Security

We follow the engineering security policy at SECURITY.md (linked from our public engineering documentation). Highlights:

  • All traffic encrypted in transit (TLS)
  • Database at rest encryption
  • Row-level security on the database
  • Strict authentication, ownership checks, and rate limiting
  • Vulnerability monitoring and patching

No system is perfectly secure. If you discover a vulnerability, please report it to [email protected].

9. Children

Dealybee is not directed to children. You must be 18 or older to use Dealybee. If you are under 16 and in the EEA, you may not use Dealybee at all. If we learn we have collected data from a person under 18, we delete it.

10. Changes to this policy

If we make material changes to this policy, we will email registered users at least 30 days in advance and post the change on this page with an updated date. Continued use of Dealybee after the effective date means you accept the updated policy.

11. Contact

Questions? Privacy requests? Email [email protected].