This Privacy Policy explains how we handle personal data when you use Deal Master (the "Service"), in line with the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for your personal data is Catalyne B2B Sales Acceleration Suite UG (haftungsbeschränkt) in Gründung, Kaiser-Friedrich-Str. 12, 10585 Berlin, Germany, email ben@thecatalyne.com. See our Imprint for full details.
2. What we collect
- Account data: your name, email address, and password (stored only as a secure hash).
- Usage & gameplay data: the scenarios you play, your choices, checkpoints, run history, scores, and credit balance.
- Content you submit: information you enter to generate your own scenarios (e.g. a deal you describe, counterpart details you type in).
- Technical data: a strictly-necessary session cookie to keep you signed in, plus server logs (e.g. IP address, timestamps) for security and operation.
3. Why we use it, and our legal basis
- To provide the Service and your account — performance of a contract with you (Art. 6(1)(b) GDPR).
- To process payments and paid features — performance of a contract and compliance with legal (e.g. tax) obligations (Art. 6(1)(b) and (c) GDPR).
- To keep the Service secure, prevent abuse, and operate reliably — our legitimate interests (Art. 6(1)(f) GDPR).
4. Processors we share data with
We use carefully selected service providers who process data on our behalf under data-processing agreements, only as needed to run the Service:
- Hosting & database: Render (Render Services, Inc.), EU region — Frankfurt, Germany.
- Email delivery: Resend (transactional sign-in and account emails).
- Scenario generation (optional): when you generate your own scenario, the information you submit is sent to an LLM gateway (OpenRouter) to produce it. Only what you provide for that generation is sent.
- Payments: no payment processing is active at launch. When paid features launch, a third-party payment provider will handle card data directly and we will receive only the transaction result, never full card numbers; we will name the provider here before any payment is taken.
- Product analytics: PostHog, EU region (eu.i.posthog.com).
Where a provider is outside the EU/EEA, transfers are protected by appropriate safeguards such as the EU Standard Contractual Clauses.
5. How long we keep it
We keep account and gameplay data while your account is active. When you delete your account, we delete your personal data and associated gameplay records, except where we must retain certain records to meet legal obligations (e.g. billing records for statutory retention periods) or to establish or defend legal claims.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased ("right to be forgotten");
- restrict or object to certain processing;
- data portability — receive your data in a structured, machine-readable format.
You can exercise the core of these rights yourself from your Account page: Download my data (access & portability) and Delete my account (erasure). For anything else, contact us at ben@thecatalyne.com. You also have the right to lodge a complaint with a supervisory authority (for our establishment, the Berlin Commissioner for Data Protection and Freedom of Information — Berliner Beauftragte für Datenschutz und Informationsfreiheit).
7. Cookies
We use a single strictly-necessary cookie to keep you signed in and to secure forms; it does not track you and does not require consent. We do not use advertising cookies. If we ever add non-essential cookies (e.g. analytics), we will ask for your consent first via the cookie banner.
8. Changes
We may update this policy; we will change the "Last updated" date above and, for material changes, notify you in the Service.