Privacy Policy

Last updated: November 1, 2026

In short: your exposé, the property address and the owner never reach us. We only store what is needed for your account, your balance and abuse protection.

Controller

Creststone Advisory LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. Email: office@dealkern.com

Search and exposé

A search sends asset class, location and the midpoint of a price range. We do not store these search inputs; we only count how many searches an account makes per day.

If you paste exposé text, your browser extracts the key facts. The text is not sent to us. Internal property titles stay in your browser’s storage.

Account

For your account we store name, office, email address, the time you accepted the terms and your password (hashed only). If you sign in with Google, we receive your name and email address from Google. For this the sign-in page loads Google's sign-in button, which gives Google your IP address.

We also store your balance, all transactions, the investors you unlocked and API keys (hashed only). To prevent abuse we store for which email address and company domain free starting addresses were already granted.

Legal bases: performance of contract (Art. 6(1)(b) GDPR) and our legitimate interest in a secure service free of abuse (Art. 6(1)(f) GDPR).

Bot protection

When you sign in, register or reset your password, Cloudflare Turnstile checks that a human is using the form. Cloudflare processes technical data such as IP address and browser characteristics (Art. 6(1)(f) GDPR).

Payments

Purchases are processed by a payment provider we name at checkout. If it is the merchant of record, it handles payment and billing data under its own responsibility. We receive no card details, only the property, amount, transaction ID and the purchase email address.

Emails

Confirmation and password emails are sent through Google Workspace. We do not send marketing emails.

Cookies and analytics

We only use cookies that are strictly necessary for sign-in. We use no analytics, advertising cookies or tracking.

Service providers and transfers to the US

Vercel Inc. (hosting, US), Supabase Inc. (database and sign-in, US data center), Google (Workspace, email delivery), Cloudflare (bot protection) and, for purchases, the payment provider named at checkout. Data processing agreements are in place with our processors.

Transfers to the US rely on the EU-US Data Privacy Framework where the recipient is certified, otherwise on the EU Commission’s standard contractual clauses.

Retention

Account data is kept until you have your account deleted. Transaction records are kept as long as statutory retention rules require. Hosting logs are deleted after a short time.

Investor data

DealKern contains company details and general company email addresses from acquisition profiles that investors publish to receive property offers. We do not include personal email addresses. Legal basis: legitimate interest in relevant property offers (Art. 6(1)(f) GDPR).

Investors can object or request deletion at any time: office@dealkern.com

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and you may lodge a complaint with a data protection authority.