1. Identity and roles
Dobromir Kostov, individual operator of DealSalvage, Plovdiv, Bulgaria, is the controller for account, billing-contact, support and service-security information. Contact contact@dealsalvage.com for privacy requests. When your organisation supplies personal information about customers or staff for processing on its behalf, your organisation generally remains the controller and DealSalvage acts as a processor for those instructions. Contact us to arrange an appropriate data-processing agreement before uploading third-party personal data that requires one; this notice does not itself replace that agreement.
2. Information and purposes
Account and organisation information includes your sign-in email, user and organisation identifiers, membership and role. Workspace information includes CRM records you import, import metadata, settings, findings, action notes, agent prompts/evidence, generated drafts, task history and review status. Billing information includes Stripe customer/subscription/payment identifiers, status, billing period and usage allowances. Support messages and technical error/security information help resolve problems and protect the service. Account and payment details are required to provide the relevant paid features; optional workspace content is supplied by you. Full payment card details are entered in Stripe checkout, not in DealSalvage CRM imports.
3. Legal bases and permitted use
We process necessary account, subscription and support information to perform the contract with you or take requested steps before it (GDPR Article 6(1)(b)); records required by law on the basis of legal obligations (Article 6(1)(c)); and proportionate security, fraud prevention and service diagnostics for our legitimate interests in operating a safe service (Article 6(1)(f)). Where consent is required for an optional purpose, we request it separately and you may withdraw it. Accepting service terms or receiving a receipt is not consent to marketing. Customer content is processed for the customer's service instructions, not sold, used for targeted advertising or used to train our own models.
4. Providers, AI and international processing
Lovable Cloud and its database/authentication infrastructure provide application hosting and workspace storage; the application uses PostgreSQL with Supabase interfaces. Stripe handles payment processing and transactional payment emails. AI agent requests and supplied evidence are sent to the configured Google Gemini service directly or through the Lovable AI gateway when you run an AI task. CRM rule-based audit findings do not require sending the CRM dataset to an AI model. Provider infrastructure, support and AI processing may involve countries outside the EEA. We do not offer an EU-only hosting or provider zero-retention guarantee. Before supplying data subject to location or transfer restrictions, contact us to agree and verify the applicable provider terms, transfer mechanism and safeguards. Provider policies and any agreed processing terms also govern their handling of data. Public demo records are synthetic.
5. Access, security and storage
Sign-in, organisation membership, role checks and database access policies restrict access to customer workspaces. HTTPS protects connections to the site. Server credentials are kept out of the browser payment flow, and common credentials in AI task input are rejected by server-side checks; these checks cannot detect every secret. No system provides absolute security or a guarantee against data loss. Do not use this service as your only copy of business information. We do not claim an independent GDPR/security certification or a verified backup-restoration service.
6. Retention, cancellation and deletion
We keep account and workspace information while it is needed to provide the account and requested service, unless you request deletion earlier and no lawful reason requires retention. Cancelling a subscription does not automatically erase the account or workspace. Request account closure or deletion at contact@dealsalvage.com; after verifying authority, we remove information no longer needed, except records required for legal, accounting, fraud-prevention or legal-claims purposes, retained only for the applicable obligation or claim period. Support correspondence is retained only as needed to resolve the request and related obligations. Provider logs and backup copies follow their own retention cycles and may not disappear immediately. No fixed automated deletion or permanent-storage period is promised.
7. Your rights and requests
Subject to GDPR conditions, you may request access, correction, erasure, restriction, objection and portability; withdraw consent where processing relies on it; and complain to your supervisory authority, including the Bulgarian Commission for Personal Data Protection (cpdp.bg). Write to contact@dealsalvage.com. We may verify your identity and authority to prevent disclosure of another person's data. We respond without undue delay and normally within one month; if a lawful extension is needed, we explain it within that month. The workspace JSON export covers the available business snapshot, not every account or payment record. The workspace clear action removes sales records/findings/actions/imports; it does not by itself delete your login, organisation, agent history or Stripe records. Contact support for those categories.
8. Browser storage, decisions and updates
The browser stores language/theme preferences, sign-in state and synthetic-demo choices. Hosting infrastructure may process technical connection and diagnostic information to operate and secure the site. AI drafts and CRM findings are recommendations reviewed by people, not decisions made by DealSalvage that alone determine legal or similarly significant outcomes for individuals. This policy is versioned by the effective date above. Material changes to purposes or handling will be communicated before the changed processing applies.