VO Deal Desk Privacy Policy

1. Scope and operator

This Privacy Policy covers the VO Deal Desk public website, protected application, subscriptions, analysis tools, support, Insider List, operational metrics, and related communications. The operator is VO Deal Desk, LLC; mailing notice address: 4715 Columbia Street, Cumming, Georgia 30040, United States. This notice describes our own practices, not the independent practices of third-party sites.

2. Information you provide

We may receive your email and authentication context; account and plan information; contracts, scripts, casting notices, briefs, screenshots, uploaded files, pasted text, and prompts submitted for analysis; History, Workspace, Earnings, and support records you choose to save or send; and Insider List signup and consent information. Customer Content may contain information about clients, talent, colleagues, or other people. Do not submit material you lack authority to process or unrelated highly sensitive data.

3. Analysis source and saved records

Analysis source material is designed for transient processing and is not intentionally saved as raw source in History, Workspace, or Earnings after the requested analysis. This does not mean that transit, security infrastructure, provider handling, or temporary technical processing cannot occur. History stores source-sanitized derived results; Workspace stores fields, notes, links, status, quotes, and next steps that you intentionally save; Earnings stores booking and earnings records, including optional client or contact details and private notes, until you delete them or an applicable account-lifecycle process applies. Do not treat persistent areas as confidential-source-free if you yourself enter confidential details there.

4. Account, billing, support, and Insider records

We store identity references, entitlement and authorized-seat metadata, subscription plan/cadence/status and dates, Stripe customer and subscription identifiers, and records needed to manage access and billing. Stripe handles full payment credentials; we do not intentionally store complete card or bank-account credentials. Support reports may retain your description, optional reply email, page/build context, and limited browser diagnostics. Insider records may include email, signup/consent/confirmation status, delivery and suppression information. Unsubscribing ends marketing sends, while minimal suppression records may remain to honor the opt-out. Transactional or legally required messages may still be sent.

5. Automatically generated information

Our infrastructure and security providers may process request, IP, device/browser, authentication, timestamp, error, rate-limit, and abuse-prevention metadata to deliver and protect the Service. VO Deal Desk's first-party product metrics are designed around allowlisted feature/route categories, outcomes, durations, coarse acquisition and device categories, and aggregate trends, rather than raw submitted source text, full URLs, query strings, cookies, or direct customer identifiers. Provider logs and retention may differ from application-level metrics. We may receive limited technical diagnostics when you submit support requests.

6. How we use information

We use information to provide requested analyses and saved features; authenticate users and administer plans, seats, and billing; send transactional messages and consent-based marketing; respond to support, privacy, and legal requests; prevent abuse and security incidents; monitor reliability and aggregate feature use; comply with law; and enforce our Terms. We do not use confidential analysis source to train a general VO Deal Desk AI model or for unrelated advertising. Improvements based on operational metrics or user feedback must not be described as reuse of confidential source content.

7. Model-backed processing and ZDR gate

Certain requested functions may use a model provider, including OpenAI if approved and enabled. Relevant source material may be transmitted through Cloudflare and the approved provider solely to deliver that function. Confidential model-backed processing remains disabled unless the required provider privacy and Zero Data Retention configuration is confirmed for the applicable project and endpoint. We do not claim Zero Data Retention is currently active merely because requests are configured not to store application state. Provider-specific handling, legal obligations, and technical processing may differ; we will update this Policy before enabling a material new processing path.

8. Providers and other disclosures

Current provider categories include Cloudflare for hosting, access, and security; Stripe for payments; Resend for transactional email; Kit for Insider List management; and OpenAI only for enabled model-backed functions. We may also disclose information to professional advisers, auditors, insurers, or authorities when reasonably necessary; to respond to lawful process, protect rights or safety, investigate fraud, or comply with law; or in a genuine business transfer subject to appropriate protection. We do not sell submitted confidential Customer Content or give it to providers for advertising. Any future advertising or tracking technology that materially changes these practices requires renewed review and notice.

9. Retention and deletion

We retain information for the purpose for which it is needed, considering user-directed storage, account status, billing and tax duties, fraud and security investigations, disputes, legal holds, and provider limitations. Raw analysis source is transient by design, not intentionally retained as raw History. User-saved History, Workspace, and Earnings records remain until deleted through available controls or handled under an applicable account-end process. Billing, entitlement, support, security, and opt-out records may be kept longer as needed for their purposes. Backups and provider copies may persist temporarily after live deletion. We do not promise an exact period or account-wide erasure control that has not been verified. Contact us for an account-level deletion request; we will explain what can be removed and what must be retained.

Recovery copies of saved product records

Where product recovery is enabled, private recovery copies cover saved Workspace records and their links, support submissions, and saved script-pace calibration. These copies can include information you choose to enter in those saved fields. This recovery path does not add original uploaded screenshots, scripts, contracts, or other raw analysis source to the backups. If you copy confidential material into a saved note or support report, that material may be included.

Routine recovery checks the current saved version and deletion or expiry records rather than automatically restoring older deleted or expired records. Removing a live record does not promise immediate physical erasure of every backup copy. Where this recovery cleanup policy is enabled, an obsolete or originally expired copy first becomes eligible for scheduled removal 30 days after we confirm that status. A current usable recovery copy is not removed by this cleanup. Legal or security holds, unresolved storage outcomes, or service suspension can delay removal; passage of time alone does not confirm physical erasure. We consider recovery copies when handling account-level privacy requests, subject to applicable retention requirements and holds. Recovery copies supplement normal storage; keep your own copies of important material.

New refund and support recovery records

Supplemental notice dated 2026-10-31. If this new workflow is enabled, for records created through it on or after that date, we use the following retention review schedule. This applies to the new workflow only; it does not change the retention of existing records or records saved through other features.

• Case links: review 90 days after the case is finally closed, after preserving required financial evidence in the minimal case journal.
• Provider observations: review 90 days after final resolution, while preserving necessary final provider references and status in the journal.
• Case decisions and minimal duplicate-prevention references: review after seven complete calendar years following the calendar year of final case closure.
• Technical recovery-cycle records: review 90 days after terminal settlement of the recovery operation.
• Replaced workflow controls: review one year after replacement, unless they are needed for retained financial evidence or continuing service obligations.

A review date is not an automatic deletion date. Longer applicable obligations and unresolved legal, dispute or uncertain-processing holds can require us to keep records longer. These records do not add screenshots, scripts, full payment credentials or raw provider responses. Backups and provider copies may persist after live deletion; this schedule does not promise immediate physical erasure.

Support notification delivery receipts

Supplemental notice dated 2026-11-01. If our atomic support-notification workflow is enabled, it keeps minimal hashed request and payload references, a claim token, delivery state, timestamps and a provider receipt identifier to prevent duplicate support emails and preserve uncertain outcomes. It does not add email bodies, subjects or submitted source content to this claim ledger. We review confirmed accepted delivery receipts one year after durable acceptance. Unresolved sending or unknown outcomes remain held until qualified resolution; applicable legal, security and dispute holds take precedence. A review date does not automatically delete a record or authorize another email. These delivery receipts are separate from refund or support recovery-case records and their case-closure schedule.

10. Security and incidents

We use safeguards appropriate to the information and current Service, including authenticated private routes, entitlement checks, user-scoped records, encrypted transport, provider-managed storage protection, request validation, rate limits, security headers, monitoring, and incident procedures. No system is perfectly secure. These measures are not a claim of SOC 2 or ISO certification, independent penetration testing, or immunity from breach. You should secure your own account and device, limit sensitive submissions, and keep copies of important documents.

11. Choices and privacy requests

Available Service controls may let you review, export, edit, or delete supported records, manage billing, and unsubscribe from Insider marketing. You may request access, correction, deletion, or account assistance at admin@vodealdesk.com. We may verify identity, clarify a request, preserve records required by law or security needs, and respond under the law that applies to you. Depending on where you live, you may have additional statutory rights; this Policy does not claim that every right applies in every location. If a request is denied where an appeal right applies, reply to the decision to ask for reconsideration.

12. Cookies and anti-abuse tools

We and our providers may use cookies, tokens, and similar technologies needed for authentication, session continuity, security, preferences, and anti-abuse. Cloudflare Turnstile may process device and interaction signals on protected forms. Current first-party metrics are operational and aggregate rather than third-party behavioral advertising. Browser restrictions may affect access or form completion. We will revisit disclosures and choice controls before adding nonessential advertising trackers.

13. Children and country availability

The Service is intended for adults at least 18 and is not directed to children. Contact us if you believe a child supplied information. The selected-country offering includes business customers and consumers in the United States and United Kingdom only when the corresponding access, checkout, customer and processing release is qualified and activated. Country availability is controlled by the secure subscription review; this notice does not expand existing access. Informational-page availability is not an offer in every jurisdiction. Provider processing can occur outside your state or country under the applicable contractual and legal safeguards; this notice does not promise UK-only storage or processing.

14. Changes and contact

We may revise this Policy when our services, providers, practices, or law change. We will identify the effective version and provide additional notice or seek consent when required. For privacy, account, or security questions, contact admin@vodealdesk.com. VO Deal Desk, LLC; mailing notice address: 4715 Columbia Street, Cumming, Georgia 30040, United States.