Privacy
Last updated 16 August 2026. This describes what the product does today, at this build. Where something is not built yet, it says so instead of describing an intention.
1. What you put into a room
A deal room holds what you typed into the builder: the room title, the buyer and seller names you chose, your content blocks, and the steps of the mutual action plan. It is stored in a MongoDB Atlas database that only this application talks to, and it is retrieved by its slug, the random string in the room link.
A room link is unguessable but it is not a password. Anyone who has the link can read the room, which is the point of sending it to a buyer, and it also means a forwarded link works for whoever it was forwarded to. Do not put anything in a room that you would not want a buyer to forward.
2. What the room records about the person reading it
Exactly four things per event, and this is the complete list:
- A session id, a random string the page makes up when it loads and forgets when the tab closes. It is not derived from anything about the reader, and the same person opening the room twice is two sessions.
- A section name, the heading of the part of the room that was on screen.
- Milliseconds visible, measured while that section was at least half in view. Under 400ms is discarded as a section that scrolled past.
- A timestamp.
It does not record a name, an email, an IP address, a user agent, a cursor position or a scroll heatmap. The request that carries it goes to this site and nowhere else.
From those rows the seller is shown two figures. The time spent in the room is the longest single section reading in a session, because sections overlap on screen and adding them up would count the same minute several times. The per-section figures are exactly the rows above, so they add up to more than the visit. Nothing else is derived, and no figure about a reader is shared with anyone but the seller who owns the room.
3. The honest part about "anonymous"
The data is anonymous to us and it is often not anonymous to the seller. A room built for one buyer and sent to one person means the seller can reasonably infer who read it, and the product exists so they can. What they get is what was read and for how long, never who the reader is, unless the reader told them some other way. If you are a buyer reading a room and you would rather not be measured at all, closing the tab before it loads is the only reliable answer, and we would rather write that sentence than pretend otherwise.
4. Analytics on this site, and not in the room
On our own pages we use Vercel Analytics to count page views. If your browser reports a time zone in the EU or EEA you are asked first, with a banner, and nothing analytics-shaped loads until you answer: pressing Decline means no tag and no request. Everywhere else the tag loads on the first page view and there is no banner.
Inside a deal room at /r/there is no site analytics tag and no cookie banner at all. You did not come to DealPage, you were sent a link, and putting our product analytics on your reading of somebody else's proposal is not ours to do. The section-level recording in section 2 still happens, because it is the seller's own reading of the seller's own room.
5. Every company that can touch any of this
Five, and no others at this build:
- Vercel, which hosts the site and, after consent, provides the page-view analytics in section 4.
- MongoDB Atlas, which stores the rooms and the view events.
- Slack and Resend, which carry operational alerts to us when something in the infrastructure fails. Those alerts say what broke, never a room's contents, and anything that looks like a key or a token is stripped before either of them is called.
- Stripe, which runs the subscription if you start one. Stripe holds the card and the billing address; this site never sees a card number and stores no payment details of its own, only the customer reference Stripe gives back.
6. If you create an account
The free tool needs no account, and this section describes nothing that happens until you ask for a sign-in link. When you do, we store your email address, a record of your current sign-in sessions, and which rooms you have added to the account. Resend carries the sign-in link. Sign-in is a one-time link rather than a password, so there is no password here to store or to leak.
Adding a room to an account does not change who can read it or edit it. The link still works the same way for the buyer, and the browser that built the room can still edit it whether or not anybody signs in.
7. Keeping and deleting
Rooms and their view events are kept until they are deleted. A room can be deleted from the browser that built it, and an account can be deleted from the workspace: that button removes the email address, the sessions, every room in the account and every view event those rooms recorded, immediately and irreversibly, including the live links buyers hold. If a room is not in an account and the browser that built it is gone, mail dario@leanaistudio.com with the room link and it is deleted along with its view events. DealPage is a validation build run by one person, which is why that last one is a person answering an email rather than a button, and why this page says so.
8. Contact
DealPage is built by Dario Verghi at LeanAI Studio. For anything on this page, including a request to see or delete what is stored, dario@leanaistudio.com.