Dealbook
Privacy policy
What personal data Dealbook processes, why, who receives it, how long it is kept and what you can do.
Controller
Dreyer & Co AS (Norwegian org. no. 912 161 072) provides Dealbook and is the controller of the personal data processed in the service. The same company runs Companybook, which you sign in with. Send privacy questions to hei@dealbook.no.
What we process
About you as a user
- Name, email and the id of the Companybook account you sign in with.
- The parties you are a member of (yourself or a company, with its organisation number) and your role there.
- API keys: name, prefix, when they were created and last used. The key itself is stored only as a hash.
- API and MCP usage: which tool or route was called, with which key, whether the call succeeded and how long it took. The content of the call is not stored in analytics.
- Usage statistics from the website and the app (page views and events such as “agreement sent”).
In the documents you create or upload
- Agreements, minutes and other documents, with versions, files and the data layer (parties, terms, deadlines).
- Name, email and role of the parties, signers and recipients you add.
- Feedback that recipients write in a preview or on the signing page.
- The board: name, role and email, fetched from the Brønnøysund Register Centre via Companybook or added by you.
- The share register: shareholders with name, date of birth, address, email and phone. A national identity number is optional, stored encrypted apart from the rest of the register, and every reveal is written to the change log.
About signers and recipients
When someone signs, the signature evidence records the name they type, the signature, the time, their IP address and their browser. We record when the link was sent and opened, and any reason given for rejecting. Signers and recipients need no account, and the signing page (sign.dealbook.no) runs no analytics.
Why we process it
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Providing the service: storing documents, sending them for signature, checking signing authority and keeping the smart documents | Contract with you (b) |
| Processing the signers, recipients, board members and shareholders you add | Legitimate interest (f): you and they need a signed, verifiable document |
| Keeping the share register and former owners for ten years (Norwegian Private Limited Liability Companies Act § 4-7) | Legal obligation (c) |
| Security and abuse prevention: limits per API key and quotas on invitations | Legitimate interest (f) |
| Improving the product: usage statistics and debugging | Legitimate interest (f) |
Who receives the data
We do not sell personal data. These providers process it on our behalf:
| Provider | What | Where |
|---|---|---|
| Supabase | Database and files | EU (Stockholm) |
| Vercel | Hosting the website, the app and the API | EU (Stockholm); US company |
| Resend | Sending email (signing links, invitations, notices) | EU (Ireland) |
| PostHog | Usage statistics and debugging | EU |
| Mistral AI | Text recognition in the PDFs and images you upload | EU |
| Anthropic (Claude) | Reads the documents you upload, the articles of association and meeting notes, and suggests the content | USA |
| TypeSafe (Jev) | Fast classification of uploaded files (document type, whether it is signed) from an excerpt of the text | USA |
| Companybook (Dreyer & Co AS) | Sign-in, and company and role data from the Brønnøysund Register Centre | See Companybook’s privacy page |
Anthropic and TypeSafe process the data in the USA, and Vercel is a US company. The recipients you send a document to receive that document and the names of the other signers.
If you connect an AI agent (such as Claude or ChatGPT) to Dealbook, the agent receives the results of the tool calls it makes with your access. What the agent provider does with the conversation is governed by their terms.
Analytics also stores the name and email of signed-in users, to find bugs. The text sent to and from the AI models is not stored there: analytics only gets which model was used, how long it took, the token counts and any error codes.
How long we keep it
- Documents, signature evidence and the log are kept as long as the party exists in Dealbook, or until you ask us to delete them.
- Uploads you do not save as a document are deleted after seven days.
- The share register cannot be deleted, and former owners are kept for at least ten years, as § 4-7 of the Act requires. Mistakes are corrected by voiding an event with a reason, not by deleting it.
- A revoked API key stops working. The row with its name and timestamps is kept for the log.
What you can do
- View, download and archive your documents in the app, and fetch signed PDFs with signature evidence.
- Revoke API keys under Account ▸ API keys. Calls with the key are rejected at once.
- Access, correct or delete data about you, and object to or restrict the processing. Write to hei@dealbook.no.
- Complain to the Norwegian Data Protection Authority (datatilsynet.no) if you think we process the data wrongly.
If you are a signer, recipient or shareholder in a document someone else created, you can also contact the person who sent it to you.
Changes
We update this page when the processing changes and put the date at the top. Users are told by email about material changes.