Privacy Policy

Deal Flow Xchange Inc, a Delaware corporation ("DFX", "we", "us"), operates DFX Intelligence: the Data Factory and its verticals, Ask DFX, reports and exports, Network Intelligence, the DFX API, partner-branded editions of the platform, and The General, our AI operator, with its browser extension. This Policy explains how we handle personal information in all of them.

It covers three groups of people, and our role is different for each:

• +Customers, users, and visitors. If you have an account, try the product, take a demo, or visit our sites, we are the controller (or "business") for your information. Part II covers you.
• +Professionals in the DFX intelligence database. The Data Factory includes professional information about people connected to firms, funds, companies, and transactions, such as investment professionals, advisers, executives, founders, lenders, and real estate professionals. We are the controller for that information. Part III is written for you, and explains where the information comes from and how to correct it, opt out, or have your profile removed.
• +People in data our customers give us. When a customer uploads a list or uses The General to process information about their own contacts, the customer is the controller and we process it for them. Part IV covers that.

Part V applies to everyone: sharing, cookies, security, retention, your rights, and how to reach us. Read it with our Terms of Service and, where you direct us to process personal data about others, our Data Processing Addendum. The browser extension also has a dedicated notice at dfxintel.com/browser-extension-privacy.html.

We collect information you provide, information from accounts you connect, information generated through your use of the Services, and information the Services collect or produce at your instruction:

• +Data Factory activity: the searches you run, the records and profiles you open, what you follow, save, or add to a universe, the names and contacts you reveal, the exports and reports you request, and the API calls you make, recorded to meter your plan, keep your workspace, and improve the product.
• +Ask DFX questions and answers: the text of each question, how it was interpreted, which data tools ran, a preview of the results and the explanation, the model used, and its cost, stored with your account or an anonymous identifier and a daily-rotating hash of your IP address.
• +Uploaded lists: files you upload to Network Intelligence or similar features, the contacts parsed from them (such as name, company, title, profile link, and connection date), and the matches and results we generate. See Part IV.
• +Partner and attribution data: the partner edition, affiliate link, referral code, or campaign you arrived through, recorded so the right partner is credited and so we know which channels work.
• +Legal records: which version of our Terms and Privacy Policy you accepted, when, and where, and any privacy, opt-out, or correction request you send us.
• +Account and contact data: name, email, company, role, team and workspace membership, plan, roles and permissions, and authentication details.
• +Business context you provide: your goals, brand information, documents, pricing, notes, instructions, and rules.
• +Connected-account data: when you connect email, calendar, CRM, telephony, messaging, social, file storage, payment, a sending domain, source-code repositories, or other tools, we access the data needed to perform the work you request, which may include the content of messages, contacts, calendar entries, files, and records, and the metadata and status of those connections.
• +Communications content: where you connect a mailbox or sending channel, the content of inbound and outbound messages that the Services read, triage, classify, summarize, draft, or send on your behalf, threads you forward or hand to your General, and reply and outcome data such as whether a recipient replied, bounced, unsubscribed, or complained.
• +Text-messaging data: where you enable SMS/MMS messaging, the mobile phone numbers you or your customers provide, the content of the text messages the Services send and receive on your behalf, delivery and reply data, and related opt-in, consent, and opt-out (such as STOP and HELP) records.
• +Reviews and reputation data: where you enable review features, the customer contact details used to request reviews, the review-request messages sent, and the reviews and responses the Services draft or publish on the platforms you connect.
• +Call and meeting data: where you use voice, telephony, or the meeting assistant, call and meeting audio, recordings, transcripts, notes, and summaries.
• +Third-party and contact personal data: information about your contacts, prospects, leads, recipients, and other individuals that you provide, that we access in your connected accounts, that the Services collect from publicly available sources (such as company sites, news, public profiles, job boards, filings, and event pages) at your instruction, or that the Services obtain from third-party data-enrichment providers (such as contact-discovery and email-finding services) at your instruction for sourcing, research, enrichment, verification, and outreach. Where you trigger a lookup from a page you are viewing, the identifying details available at that moment, such as a person's name and company, are sent to those providers to perform the lookup.
• +Website concierge and lead-capture data: where you deploy our website concierge widget, front desk, or a voice or chat assistant on your own site or phone line, the messages, questions, contact details, and other information your site visitors and callers provide, and the transcripts, summaries, and lead records generated from those interactions.
• +In-app voice-assistant data: where you use an in-app or in-browser voice assistant or guide, the microphone audio captured while it is active and the transcripts, summaries, and instructions produced from it.
• +Demo, tour, audit, business-read, and evaluation data: where you request or take part in a demonstration, guided product tour, trial, business audit, or an automated read of a business and its public web presence, the information you submit (such as a business name, website, or domain), the sources read and the understanding, observations, and sample results generated, your intake, persona, and interaction details, and any microphone or call audio, recordings, and transcripts from interactive, voice-guided, or phone-based demonstrations and demo bookings.
• +Memory, learnings, and inferred preferences: what the Services record and infer about your business and how you work, including instructions and corrections you state, and inferences drawn from your behavior, such as the edits you make to a draft before sending it, the items you approve or reject, and the outcomes of your outreach. This is used to shape later work and may be scoped to you or to your whole workspace.
• +Approval, autonomy, and decision records: the approvals, rejections, grants, scopes, and settings you configure, the precedent derived from them, and the record of what the Services decided to do without asking and why.
• +Receipts, evidence, and activity records: the evidence records, screenshots, extracted content, step outcomes, work logs, timings, error details, and verification status attached to claims the Services make about work they performed.
• +Product-usage and attention telemetry: which surfaces, items, briefs, deliverables, and decisions you open, when, for how long, what you do with them (for example send, download, edit, ignore, or resolve), funnel events such as connecting a browser or completing a first task, and aggregate measures of the attention the product costs you. We use this to measure and improve the product, not to profile you for advertising.
• +CRM and connected-tool records: where you connect a CRM (such as HubSpot) or other tools via API keys or authorized connections, the records, notes, activities, and fields the Services read and write at your instruction, and the results of periodic read-only health checks on those connections.
• +Google data: where you connect a Google account, the calendar, meeting, mail, or Drive data covered by the scopes you approve, including the work-log file the Services may maintain in your own Drive.
• +Social media data: where you connect social accounts, the posts, drafts, and account information needed to publish or schedule content you direct.
• +Browser extension and browser-operation data: where you install the DFX browser extension or otherwise connect a browser, the web addresses, page titles, visible page text, page markup, and screen images of the pages a task you approved is carried out on, the outcome, timing, and error details of each step, the address and title of the tab you are viewing when you send a message from the side panel, files you attach in the panel, microphone audio and transcripts while a voice session in the panel is active, and connection details such as a device label, the extension version, the capabilities that version supports, presence and pause state, and error categories used to diagnose failures. See the dedicated section below.
• +Usage, deliverables, and activity: tasks, missions, autopilots, standing orders, conversations with The General, generated outputs and deliverables, and browser-action, local-command, software-build, and other automation logs where you use those features, together with device, browser, and network information, IP address, and analytics.
• +Referral and partner data: where you take part in a referral, partner, or promotional program, the referral links and codes you use, the introductions and accounts attributed to you, reward and qualification status, and, for cash payouts, the legal name, entity type, country, address, and payout status we hold, together with the tax and bank details held by our payout provider rather than by us.
• +Payment data: processed by our payment processor; we receive limited billing details and do not store full card numbers.
• +Cookies and similar technologies used to operate the site, keep you signed in, and measure usage.

We use information to:

• +provide the Data Factory, Ask DFX, exports, reports, Network Intelligence, and the API, meter plan allowances, and keep your saved work;
• +credit partners, affiliates, and referrers for the customers they introduce, and pay them;
• +keep records of what you agreed to and of the privacy requests we receive and how we answered them;
• +provide, operate, secure, and maintain the Services and perform the work you request;
• +enable The General to research, draft, communicate, and, where you connect accounts and configure the settings, act on your behalf, including on a recurring, proactive, or autonomous basis through autopilots, missions, standing orders, scheduled campaigns, triggers, and automatic inbox handling;
• +decide, under the settings you enable, whether an action requires your approval, and to build the precedent that decision draws on from your own approvals, rejections, and corrections;
• +learn from how you work, including from the edits you make to drafts, the items you reject, and the outcomes of your outreach, and apply what is learned to later work across the Services;
• +build and maintain a working memory and an understanding of your business from your connected accounts, your website and public web presence, and the sources you connect, and present that understanding back to you for correction;
• +carry out, verify, and show you evidence of the browser tasks you approve, where you install the DFX browser extension or connect a browser, including reading the page being worked on so the next step can be planned;
• +read, triage, classify, and draft replies to email, take on threads you forward, send and receive text messages (SMS/MMS) on your behalf, request customer reviews and draft and publish review responses, source, enrich, and verify contact data from public sources and third-party data-enrichment providers, place and receive calls (including through a website or voice concierge and front desk that speaks with your customers and site visitors, and an in-app voice assistant that captures your microphone audio while active), transcribe calls, capture and summarize meetings, write to your CRM and connected tools and check that those connections still work, publish or schedule social content, maintain a work log in a Google Drive you connect, run approved commands on a computer you connect, and write code, open pull requests, and run builds on repositories you connect, where you enable those features;
• +operate our websites, business audit tool, business reads, demonstrations, product tours, and trials, record and analyze interactive and voice demonstrations to run and improve them, and respond to inquiries and contact prospects about DFX and the Services, including sales and marketing follow-up, subject to your choices;
• +process payments, manage subscriptions, credits, spend caps, seats, workspaces, and referral and partner rewards, meter usage and apply plan pricing, and prevent fraud and abuse of trials, credits, and reward programs;
• +provide support, communicate with you, and send service and transactional messages;
• +measure how the product is used, including which items you open and what you do with them, in order to debug, prioritize, and improve the Services and develop new features, using aggregated or de-identified data where practicable;
• +enforce our Terms, comply with law, and protect the rights, safety, and property of DFX, our users, and others.

We do not use your content, your communications, or your connected-account data to train generalized or third-party AI models, and we do not permit our model providers to do so under our arrangements with them. We may use aggregated and de-identified data, which does not identify you or any individual, to analyze and improve our products.

To provide the Services, we share information with sub-processors and service providers who process it on our behalf under contractual obligations. These include providers of AI language and voice models, payment processing, communications and email delivery, telephony, meeting capture, contact-data enrichment, cloud hosting and databases, authentication, and web analytics, and any third-party applications you connect. Representative sub-processors currently include Anthropic (primary AI language models, including for Ask DFX), OpenAI (fallback AI language models used to maintain availability), Tavily and Brave (web search used by research features, which may receive the text of a search query), PostHog (product analytics), ElevenLabs (synthetic voice), Twilio (telephony and messaging), Recall.ai (meeting capture and transcription), Resend (email delivery), Apollo and Hunter (contact-data enrichment and email finding), Stripe (payment and payout processing), Google (calendar, Drive, and video-meeting scheduling for bookings, the work log, and the meeting assistant), Clerk (authentication), Supabase (cloud hosting and database), Vercel (application hosting and storage), and Railway (hosting for the background worker that carries out scheduled and long-running work). This list may change; we maintain a current list of sub-processors and provide it on request, and material changes are described in our Data Processing Addendum.

When the Services generate outputs, take actions, or classify communications, relevant content (such as your instructions, business context, connected-account data, message content, page content and screenshots from browser work, and documents) is transmitted to third-party AI model providers, including Anthropic and OpenAI, to produce the result. We may route between providers, models, and versions to maintain availability, manage cost, or improve results. By using the Services you understand and agree that this content is sent to those providers. We use enterprise arrangements with our model providers under which your content is not used to train their general models. We do not control, and are not responsible for, the independent practices of these providers beyond our contractual arrangements with them.

The Services make automated decisions in the course of doing the work you ask for. This includes classifying and prioritizing communications, grouping work for approval, scoring or ranking contacts and opportunities, generating content and recommendations, and, where you enable it, determining whether a given action may proceed without your approval based on factors such as reversibility, consequence, confidence, the scopes you granted, and precedent drawn from your own past approvals, rejections, and corrections.

These decisions are made to operate the Services at your direction and under settings you control. They do not produce legal or similarly significant effects on you, and we do not use them to evaluate individuals for employment, credit, housing, insurance, education, or essential services, which is prohibited by our Terms. You can review what the Services have learned, correct or delete it, change or revoke autonomy and approval settings, and return to per-action approval at any time. Where applicable law gives you a right to obtain human review of an automated decision, contact us at hello@dfxintel.com.

Learnings and corrections recorded at the company level apply to your whole workspace and may be visible to, and change work produced for, other members of that workspace. Learnings we derive from behavior (for example from an edit you made to a draft) are recorded with their provenance so you can see where they came from.

Where you connect a mailbox, the Services may read, analyze, classify, triage, summarize, and draft replies to your email, take on threads you forward to your General, and send email as you, according to the settings you choose. Where you enable text messaging, the Services may send and receive text messages (SMS/MMS) on your behalf under your settings, and process the numbers, message content, and consent and opt-out records involved. Where you enable voice, telephony, or the meeting assistant, the Services may place and receive calls, including outbound calls that The General places on your behalf using an artificial, synthetic, or AI-generated voice, may capture your microphone audio through an in-app or in-browser voice assistant while it is active, and may join meetings and record, transcribe, and summarize calls, meetings, and interactive demonstrations.

We process this communications, call, and meeting content to provide the Services and at your instruction. When you enable outbound calling, you are the caller and the party responsible for each call. You are responsible for providing all legally required notices to, and obtaining all legally required consents from, the individuals involved before any call, recording, transcription, or capture, and for directing outbound calls only to individuals who have opted in to being contacted by you and given the consent required by law (including, for calls using an artificial or AI-generated voice, the prior express written consent required by the TCPA and FCC rules), and for honoring do-not-call and opt-out requests, all as further described in our Terms of Service. We retain recordings, transcripts, and message content as described under Data retention.

Where you deploy our website concierge widget, front desk, or a chat or voice assistant on your own website or phone line, the Services interact with your site visitors and callers, answer questions, and capture leads and the information those individuals choose to provide. This information is collected on your behalf and for your use. You are the controller or business with respect to that information and the deployer of that AI system, and you are responsible for providing your visitors and callers with any required notices (including notice that they are interacting with an automated or AI system and any recording notice) and for obtaining any required consents. We provide the functionality and process this information as your processor or service provider on your instructions.

This section describes how information is handled when you install the DFX browser extension (the "Extension") or otherwise connect a browser so that The General can work in it. It applies in addition to the rest of this Policy. We also publish a dedicated privacy notice for the Extension at dfxintel.com/browser-extension-privacy.html, which is the notice referenced from the extension store listing; where the two describe the same practice, they are intended to be read together. That notice carries a revision number, and when our data handling changes we raise a notice inside the Extension to existing users rather than relying on a quiet edit to a web page.

How the connection works. The Extension runs on your device and dials out to your own DFX workspace over HTTPS to ask whether you have approved any work. It does not open an inbound port and does not expose your browser to the public internet. It carries out approved work in a tab it creates and owns rather than in the tab you are using, using the browser's developer tooling interface. Your browser displays its own notice while that interface is attached.

What is collected while a task runs. To carry out the work you approved and to show you evidence of what happened, the following is transmitted from your device to us: the web address and title of the page being worked on, the visible text of the page or of a selected element (currently truncated at approximately 200,000 characters), the page markup with scripts and styles removed (currently truncated at approximately 400,000 characters), images of the page captured as screenshots, the result or error of each step, and a short non-reversible fingerprint of the page used to prove the page changed. THIS MAY INCLUDE ANY INFORMATION PRESENT ON THOSE PAGES, INCLUDING PERSONAL INFORMATION, THIRD-PARTY DATA, AND CONFIDENTIAL BUSINESS INFORMATION. You choose which pages a task operates on and you are responsible for ensuring you are permitted to disclose what is on them. Do not direct browser work on pages containing information you may not lawfully or contractually share with us or with our sub-processors.

What is collected from the side panel. When you send a message from the panel, we receive your message, the conversation it belongs to, and the web address and title of the tab you are currently viewing, so that instructions like "add this person" are complete. The content of that tab is not sent with a message; page content is read only while a task you asked for is running. Files you attach are transmitted with the message and processed to extract their text or, for images, to be read visually. Where you use a panel feature that requires it, the details that feature needs are transmitted for that purpose: for example, finding a contact's email address sends the person's name and company, taken from the page title or from what you type, to our contact-discovery providers, and subscribing sends the details our payment processor needs. If you use voice in the panel, your microphone audio is streamed while the session is active to our voice provider and to us, together with the resulting transcripts, and the call duration is recorded for metering and billing. Dictation, where offered, uses the browser's own speech recognition and is subject to your browser vendor's practices.

Connection and health signals. The Extension reports the workspace it is registered to, a device label you choose, its version and the capabilities that version supports, its connection, presence, and pause state, and health signals used to tell when the Extension stops working for people: whether a connection or step succeeded or failed, and a general category for the failure such as network or timeout. These signals never include page content, addresses, titles, error messages, or anything you typed.

What the Extension does not collect. It does not read or transmit your passwords, saved credentials, cookies, session tokens for other sites, autofill data, or browsing history. It does not monitor, log, or transmit the pages you visit outside a task you approved. It does not run script supplied by our servers in your pages, and it refuses navigation to a list of restricted financial, payroll, and personal-email domains. These are design characteristics, not guarantees; as described in our Terms of Service, such controls are aids that may fail or be circumvented, and no method of transmission or storage is completely secure.

What is stored locally on your device. The Extension stores, in your browser's local extension storage and only on your device, the DFX address it connects to, the access token that identifies that browser to your workspace, short-lived session tokens, its connection and pause state, the identifier of its working tab, your recent panel conversation (retained for up to 24 hours so the panel survives being closed), and, if a step's result could not be delivered because the network or the browser interrupted it, a bounded queue of undelivered results, which may contain extracted page text or a screenshot until it is delivered. Anyone with access to that browser profile can access this data and use the connection. Disconnecting or uninstalling the Extension clears the connection; uninstalling removes its local storage.

Where the information goes. Browser-operation content is transmitted to us and, to plan the next step and interpret what is on the page, to our AI model providers (currently Anthropic, with OpenAI as a failover) as described in the AI processing and service providers section; voice audio is transmitted to our voice provider; and details required by a panel feature you invoke are transmitted to the provider that feature uses. It is processed to deliver the Services you requested and to show you records and receipts of what your General did. We do not sell it, we do not share it for cross-context behavioral advertising, and we do not use it to build advertising profiles.

Limited use commitment. Our use of information received from the extension platform, including any Google user data, adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements, and our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we use this data only to provide and improve the single, user-facing feature the Extension exists for, which is letting your DFX General carry out browser work you asked for and report what it did; we do not transfer this data except as necessary to provide or improve that feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you; we do not use it for advertising, retargeting, personalized advertising, or credit or lending decisions; we do not sell it; and we do not use it, or allow humans to read it, to train generalized or third-party AI or machine-learning models, except where required for security or to comply with law, where the data is aggregated or de-identified, or where you give us express consent for a specific purpose such as investigating a support issue you report.

Retention and control. Browser-task records, including the addresses worked on, extracted content, screenshots, and step outcomes, are retained as part of your workspace activity so that you can review what your General did, subject to the Data retention section below. You can pause browser work, disconnect the browser from the Extension or from your portal at any time, revoke a connection so its token stops working, uninstall the Extension, and request deletion of your data by contacting us at hello@dfxintel.com.

When you visit our own websites, use our business audit tool, request an automated read of a business, request or take part in a demonstration, guided product tour, or trial, book a demo or call, sign up, install the Extension, or contact us, we collect the information you provide and generate, and with respect to that information we act as the controller. This includes your name, email, company, role, the business, website, or domain you submit, the sources read and the results generated, your intake, persona, and interaction details, demo bookings, and any microphone or call audio, recordings, and transcripts from interactive, voice-guided, or phone-based demonstrations. Interactive demonstrations, tours, and demo calls may be recorded, transcribed, and analyzed.

We use this information to operate, secure, and improve these experiences and the Services, to respond to you, and to contact you about DFX and the Services, including sales and marketing follow-up. You can opt out of marketing communications at any time using the unsubscribe link in our messages or by contacting us at hello@dfxintel.com; we may still send necessary service and transactional messages. Please do not submit confidential, regulated, or sensitive information, or personal information about other people, into a demonstration, tour, trial, audit, or business read. Demonstration and tour workspaces use sample data and may be reset or wiped.

Where an unauthenticated business read is run against a company domain, we read publicly available sources about that business at the moment of the request in order to show what the Services can do. That read may include information about individuals connected with the business that is published on the public web.

The Data Factory helps businesses understand capital markets and the firms in them: who manages which funds, who invests in what, which companies raised money or changed hands, who advises whom, and who works where. That picture is made of firms and of the professionals who run them, so it includes information about people in their professional roles, for example partners at investment firms, registered investment advisers and their representatives, family office principals, executives and founders, lenders, fund managers, real estate professionals, and the service providers who work with them.

We include information about a person because of their professional role, and we limit what we publish to information about that role. We do not build profiles of people as consumers, and the Data Factory is not a people-search service.

Depending on the person and the vertical, a profile may include:

• +identifiers and professional contact details: name, title, employer, business email address, business phone number, office location, firm website, and links to published professional profiles;
• +professional and employment information: current and past roles, firms, dates, and career moves;
• +regulatory and registration records: for example adviser and broker registrations, registration numbers, exams, designations, and the states where a person is registered, as published by regulators and self-regulatory organizations;
• +affiliations and activity: funds managed, investments, transactions, board seats, events, and published deal announcements naming the person;
• +relationships: connections to other people and organizations that are documented in a source, derived from records, or inferred, each labeled as such;
• +published biographies and, only where we have a documented right to show it, a headshot; and
• +inferences: conclusions we draw from the above, such as a likely current employer, a pattern-based email address, a probable relationship, or an aggregate pattern signal, labeled as inferred.

We do not seek out sensitive personal information, such as health, religion, sexual orientation, racial or ethnic origin, government identification numbers, financial account numbers, or precise geolocation, and we do not use any to infer characteristics about a person. We do not show subscribers residential addresses or personal (non-business) contact details.

We collect professional information from these categories of sources:

• +public records and government filings, such as securities, adviser, corporate, property, court, procurement, and other regulatory filings and registries;
• +self-regulatory organization and professional licensing records;
• +firm, fund, and company websites, press releases, and published materials;
• +news, industry publications, conference and event materials, and other publicly available sources;
• +published professional biographies and profiles;
• +third-party data providers, including contact-data providers, under license;
• +the people and firms described, and our customers, when they send corrections or additions; and
• +DFX's own processing, which normalizes, matches, derives, infers, and summarizes information from the sources above, sometimes using AI.

We add and retire sources over time. The sources page in the product names the main sources behind each vertical.

We use professional information to build and maintain the Data Factory and to provide it to subscribers for business purposes such as research, deal sourcing, market mapping, diligence, and business development. Our Terms prohibit subscribers from using it to decide anyone's eligibility for employment, credit, insurance, or housing, and from using it for consumer marketing, harassment, or any purpose unrelated to the person's professional role.

• +Subscribers on a paid plan or trial can see names and profiles in the verticals they subscribe to, and can reveal and export business contact details within their plan's allowances.
• +Visitors without a subscription see limited, partly masked records.
• +Search engines may index some profile pages and may display a person's name and role in search results.
• +Our keyless public API and our public AI connector do not provide person contact details. Enterprise customers with an API key can export contact details within their agreement, on the same terms as other subscribers.
• +Partners who offer a co-branded edition do not receive the database; they receive information about their own members' accounts as described in Part V.

Subscribers pay to access the Data Factory, including professional information about people. Some state privacy laws, including California's, define a "sale" broadly enough to include making personal information available to a third party for payment. We therefore treat subscriber access to professional profiles as a possible sale of personal information under those laws, and we give everyone, wherever they live, the right to opt out of it.

We do not share professional information for cross-context behavioral advertising, and we do not sell information about our customers or website visitors.

You can ask us to do any of the following, using the request form at dfxintel.com/privacy/request (or the "Suggest a correction" link on any profile), whether or not your state's law requires it:

• +Correct: fix a title, firm, date, relationship, or anything else that is wrong or out of date. A person reviews every correction.
• +Opt out of sale and sharing: we stop making your profile available to subscribers and never reveal or export your contact details. We act on this within 15 business days, and usually much sooner.
• +Remove your profile: we take your profile page down for every reader, including search engines on their next visit.
• +Access: we tell you what we hold about you and where it came from.
• +Delete: we delete what we hold about you, except what the law requires us to keep and the minimum needed to keep you suppressed.

We do not ask for identification to opt out. For access and deletion we may confirm your request by email before acting. To make sure an opt-out or removal sticks when sources are read again, we keep a minimal suppression record (such as your name, firm, and the identifier of your record) and check it before we show your information. If we have told a subscriber that you opted out, our Terms require them to stop using and delete contact details they exported.

Customers can upload lists, such as a LinkedIn connections export, a CRM or contact export, or an investor or attendee list, so DFX can match them against the Data Factory. Customers can also use The General to research, enrich, store, and contact people in their own networks. In both cases the customer is the controller and DFX processes the information on the customer's behalf, under our Terms and Data Processing Addendum.

• +Uploaded lists are private to the customer's account. We do not add them to the DFX graph, show them to other customers, sell them, or use them to train AI models offered to others.
• +For LinkedIn exports, message text never leaves the customer's browser; only connection details and message counts and dates are uploaded.
• +Uploaded files are parsed and then deleted from storage; the parsed contacts and match results stay in the customer's account until the customer deletes the upload or closes the account.
• +Where The General looks up a contact at a customer's instruction, the identifying details available at that moment, such as a name and company, are sent to contact-data providers to perform the lookup.

If you are an individual whose information a customer gave us, please contact that customer first. If you contact us, we will tell the customer and help them respond, and where we can identify the customer we will tell you who they are.

Network Intelligence can use the history in your connected calendar and mailbox to measure how well you know the people in your network and to find introduction paths. It is off unless you turn it on yourself, on the My Network page, where the full terms of this permission are shown before you choose. Calendar and email are separate choices.

• +What we read: for past meetings in the last 18 months, when they happened, how long they lasted, whether they repeat, who was invited and how each invitee responded; for email, the sender, recipients and date of each message and the header markers that identify a mailing list or an automated message.
• +What we never read for this purpose: email subjects, message bodies or attachments, and meeting titles, descriptions, notes, locations or join links. We store no field for any of them.
• +How we use it: only to measure relationship strength, find introduction paths and show your own network to you. It is private to your account, never shown to other members, never added to the DFX graph, never sold, and never used to train AI models offered to others. Large meetings, mailing lists, newsletters and automated email never count as a relationship.
• +Your control: you can turn either part off at any time on the same page. Turning a part off stops reading it and deletes the meeting or email records we stored for it immediately. Closing your account deletes all of it. We keep a record of when you gave or withdrew permission and which version of the terms you saw.

We share personal information only:

• +with subscribers, for professional information in the Data Factory, as described in Part III;
• +with service providers and sub-processors that process it for us under contract, as described in the section on service providers;
• +at your direction, including with accounts you connect, recipients of communications you send, participants of calls and meetings, and other members of your workspace;
• +with a partner whose co-branded edition you joined through: that you joined, your plan, and aggregated activity, so the partner can run its program and be credited; not your Ask DFX questions, uploads, or saved work unless you share them;
• +with affiliates and referrers, limited to whether a customer they introduced signed up and paid, so they can be credited;
• +with professional advisers, auditors, and insurers under duties of confidentiality;
• +to comply with law, legal process, or lawful requests, to establish or defend legal claims, or to protect rights, safety, and security, including investigating fraud, abuse, or violations of our Terms; and
• +in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy.

We do not sell, and do not share for cross-context behavioral advertising, the personal information of our customers, users, or website visitors.

Mobile numbers and messaging consent. We do not sell, rent, or share the mobile phone numbers, text-messaging opt-in, or SMS consent of you or your customers with any third parties or affiliates for their own marketing or promotional purposes. Text-message consent and phone numbers are used only to operate the messaging you enable and are not shared for third-party marketing. This does not restrict our use of the messaging sub-processors (such as our telephony provider) that transmit messages on your behalf, or disclosures required by law.

We use a small number of first-party cookies and browser storage, and one third-party analytics tool. We do not use advertising cookies, advertising pixels, or cross-site tracking. Visitors in the European Economic Area, the United Kingdom and Switzerland see a short consent notice: until they accept, PostHog does not load and we keep nothing that remembers them between visits beyond what is strictly necessary, and their choice is stored in a df_consent cookie for 180 days. What we use:

• +Strictly necessary: sign-in and session cookies set by our authentication provider (Clerk), security and fraud-prevention cookies set by our payment processor (Stripe) on payment pages, and short-lived cookies used during third-party sign-in.
• +Preferences: small cookies and browser storage that remember choices such as a persona you picked, panels you dismissed, recent items, and the answers you gave the guided start (what you are trying to get done and the criteria you chose), so a saved result is still there when you come back. A workspace cookie (dfx_ws_visit, up to about 400 days) records when you last opened your workspace in that browser, so it can show what is new since then.
• +Product analytics: PostHog, which records page views and interactions so we can see how the product is used, and which links that activity to your account when you are signed in using our own account identifier, never your name or email. A first-party anonymous identifier (df_anon, up to one year) joins your activity before and after sign-up, and a session cookie (df_sid, 30 minutes of inactivity) groups the pages of one visit.
• +Attribution: first-party cookies that remember the partner, affiliate, referral link, or campaign you arrived through (dfx_ref, dfx_gp, dfx_aff, dfx_campaign, dfx_campaign_last, and dfx_ai_ref), kept for 30 to 90 days, so the right partner is credited and we know which channels work.

If your browser sends a Global Privacy Control signal, we treat it as an opt-out of any sale or sharing for that browser, and PostHog does not load. You can also block or delete cookies in your browser settings, although signing in needs the necessary cookies.

We design the Services for per-client isolation: your data and your General operate within your own tenant, and we apply technical and organizational measures to keep clients separated, including access controls, row-level database policies, per-member request scoping, and logging.

Sensitive credentials you provide (such as connected-account passwords, app passwords, OAuth tokens, and API keys) are encrypted before storage using strong industry-standard encryption (AES-256-GCM), are never returned to your browser, and are decrypted only server-side when needed to perform the work you request. We log access to such credentials. Extension connection tokens are stored as hashes rather than in plain text. Notwithstanding these measures, no product, method of transmission, or method of storage is completely secure, and we do not warrant or guarantee that your information or credentials will be free from unauthorized access, loss, or misuse. You provide credentials and data at your own risk.

If we become aware of a security incident affecting your personal data that requires notification under applicable law, we will notify you without undue delay and provide the information reasonably available to us so that you can meet your own notification obligations.

We keep information only as long as we need it for the purpose it was collected for, then delete or de-identify it. The criteria we apply:

• +Account, workspace, and Data Factory activity: while your account is active, and after it closes for as long as needed to provide the post-termination export window in our Terms, resolve disputes, and meet legal obligations.
• +Ask DFX questions and answers: as long as needed to operate, meter, secure, and improve Ask DFX.
• +Guided start answers and saved results (what you said you are trying to do, the criteria you chose, the results you saved, and the email you gave to receive them): while your account is active if you create one. Without an account, or after you close one, up to 24 months from your last visit, so your saved results are still there if you come back. You can ask us to delete them sooner at dfxintel.com/privacy/request.
• +Product analytics (first-party events and PostHog), whether or not you were signed in: up to 13 months.
• +Uploaded lists and their results: until you delete the upload or close your account. Uploaded files themselves are deleted from storage after they are parsed.
• +The General's records (messages, recordings, transcripts, memory, receipts, and browser-task records): as part of your workspace while it is active, as described in the sections above.
• +Billing, tax, and transaction records: for the period tax and accounting law requires, generally seven years.
• +Records of what you accepted, and privacy requests with how we answered them: for at least 24 months, and longer while a claim could be brought.
• +Suppression records for people who opted out or asked to be removed: for as long as we operate the Data Factory, because deleting them would let their information reappear.
• +Professional information in the Data Factory: while it remains relevant and accurate enough to be useful; records are refreshed from sources and retired when superseded.
• +Backups: overwritten on their own rotation.

Depending on where you live, you may have the right to know what personal information we hold about you and how we use it, to get a copy, to correct it, to delete it, to opt out of its sale or sharing, to opt out of targeted advertising and of profiling that produces legal or similarly significant effects (we do neither), to limit the use of sensitive personal information (we do not use it for inferring characteristics), and to appeal our decision on a request. We offer the access, correction, deletion, and opt-out choices to everyone, wherever they live.

To make a request, use dfxintel.com/privacy/request or email hello@dfxintel.com with "Privacy request" in the subject. We will confirm receipt within 10 business days and respond within 45 days (we may extend once by another 45 days where the law allows, and we will tell you why). Opt-outs of sale are acted on within 15 business days. For access, deletion, and correction we may verify your request, usually by confirming it from the email address involved; we do not require identification to opt out. You may use an authorized agent where the law allows, and we may ask for proof of the agent's authority.

If we decline a request, you can appeal by replying to our answer with the word "Appeal" or by choosing "Appeal a decision" on the request form. We will answer within the time the law requires, and if we still decline, we will tell you how to contact your state attorney general. We do not discriminate against you for exercising a right.

Customers can also disconnect accounts, revoke browser and device connections, change send, approval, and autonomy settings, correct or delete The General's memory and learnings, delete uploads, and pause activity at any time. You can stop marketing email with the unsubscribe link in any message; we will still send account, billing, and security email.

Where we process information on behalf of a customer (Part IV), please direct your request to that customer; we will help them respond.

California and several other states require specific disclosures. In the last 12 months:

• +Categories we collected: identifiers (such as name, email, account identifiers, and IP address); professional and employment information; commercial information (such as plans and purchases); internet and electronic activity (such as product usage and Ask DFX questions); audio and electronic information (recordings and transcripts where you use voice or meeting features); and inferences. We did not knowingly collect sensitive personal information for the purpose of inferring characteristics.
• +Sources: you; the accounts you connect; your devices; our customers; public records and other public sources; licensed data providers; and our own processing, as described above.
• +Purposes: providing and improving the Services, security and fraud prevention, billing, support, marketing to business customers, and the purposes in Part III for professional information.
• +Disclosed for a business purpose: to service providers and the other recipients described in "How we share information".
• +Sold: identifiers, professional and employment information, and inferences about professionals in the Data Factory, to subscribers, as described in Part III. Not sold: information about our customers, users, and website visitors. We do not knowingly sell or share the personal information of anyone under 16.
• +Shared for cross-context behavioral advertising: none.

Our "Your Privacy Choices" page at dfxintel.com/privacy/choices is how to opt out of sale or sharing, and it shows whether your browser's Global Privacy Control signal is being honored.

DFX is based in the United States, and we and our service providers process information in the United States. If you use the Services from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from yours. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland under a customer agreement, we use the safeguards in our Data Processing Addendum, including the European Commission's Standard Contractual Clauses and the UK Addendum.

Where the GDPR or UK GDPR applies to our processing, we rely on contract (to provide the Services you request), legitimate interests (to secure, operate, and improve the Services, for business-to-business marketing, and to maintain the Data Factory's information about professionals in their professional roles), consent where required, and legal obligation. You may object to processing based on legitimate interests, including the inclusion of your professional information in the Data Factory, using the request form, and you may lodge a complaint with your local supervisory authority.

The Services are for business use and are not directed to anyone under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

We update this Policy as the platform changes. Each version carries an effective date and version number, and prior versions and a change history are kept at dfxintel.com/legal. If we make a material change, such as collecting a new category of personal information or using it in a materially different way, we will tell account holders by email or in the product before the change takes effect, and where the law requires consent for a new use, we will ask for it. Changes to how the browser extension handles data are also announced inside the extension.

For privacy questions or requests: dfxintel.com/privacy/request, or hello@dfxintel.com with "Privacy request" in the subject. By mail: Deal Flow Xchange Inc, Attn: Privacy, Delaware, United States. If you are a customer and need data processing terms, see our Data Processing Addendum.