Privacy Policy | Dealytix

Legal

Effective: October 2026

This Privacy Policy describes how Altus Capital GmbH, operating under the brand name Dealytix ("Altus Capital", "Dealytix", "we", "us"), collects, uses, stores, and protects personal data when you use dealytix.com and purchase any report or product. Altus Capital GmbH is the data controller. We are committed to compliance with the Swiss Federal Act on Data Protection (nDSG, in force September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable US state privacy laws including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and, where applicable, the UK General Data Protection Regulation and the Data Protection Act 2018 (together, "UK GDPR"). Where we obtain personal data about you from a source other than you, for example from a public marketplace listing or from a buyer who commissions an analysis, this Policy also serves as the information notice required by Art. 19 nDSG and Art. 14 GDPR.

1. Identity of the Data Controller

Controller: Altus Capital GmbH (operating as Dealytix), Canton Schwyz, Switzerland. Contact for data protection matters: hello@dealytix.com. Response within 5 business days.

Altus Capital GmbH does not have a statutory obligation to appoint a Data Protection Officer (DPO) under nDSG or GDPR at this time. Data protection inquiries are handled directly by the company.

2. Data We Collect

2.1 Data you provide directly:

—Identity and contact data: name and email address provided at purchase or via contact forms.

—Free resource requests: the email address you provide when requesting a free resource (such as a checklist or sample report).

—Transaction data: reports ordered, listing URLs submitted, order history, product type, pack size, and payment records.

—Submission data: YouTube channel URLs, marketplace listing URLs, and any seller-provided attachments (screenshots, spreadsheets, PDFs) you upload when placing an order. Where the seller of an asset under analysis authorizes a read-only connection to a platform account, the aggregate analytics returned by that connection are also submission data (see Sections 5 and 6).

—Communications: any correspondence sent to Altus Capital GmbH by email or contact form, including support requests and complaints.

2.2 Data collected automatically:

—Usage data: pages visited, time on page, clicks, browser type and version, operating system, device type, screen resolution, and referring URL, collected via standard server logs.

—IP address: collected as part of standard web server operation. Used for security, fraud prevention, and aggregate analytics only. Not used for individual profiling.

—Cookies and similar technologies: see Section 11 for full cookie disclosure.

2.3 Data we do not collect: We do not collect payment card data directly. All payment processing is handled by Stripe Inc. under their own privacy policy. We do not collect government identification numbers, biometric data, or sensitive personal categories as defined under Art. 5 nDSG / Art. 9 GDPR.

3. How We Use Your Data

—To deliver purchased reports to the email address provided at checkout.

—To read, with the seller's authorization, aggregate platform data about an asset under analysis, to prepare the Report commissioned on that asset and, in anonymized and aggregated form, to calibrate the Dealytix scoring methodology (see Section 6).

—To deliver free resources you have requested (such as a checklist or sample report).

—To process payments securely via our payment processor Stripe Inc.

—To send order confirmations, delivery notifications, and transactional emails directly related to your purchase.

—To respond to support requests, complaints, and general inquiries.

—To improve the Dealytix scoring methodology using anonymized, aggregated outcome data only, never using individually identifiable information.

—To detect and prevent fraud, abuse, and security incidents.

—To comply with applicable legal obligations including Swiss commercial record-keeping requirements (OR Art. 958f).

We do not sell, rent, or license your personal data to any third party. We do not use your data for advertising purposes, behavioral tracking, or targeted marketing. We do not share your identity, email address, purchase history, or submitted listing data with any marketplace, broker, seller, or platform.

4. Legal Basis for Processing

Swiss nDSG does not require a legal basis for processing by private persons; where processing could infringe personality rights, we rely on a justification under Art. 31 nDSG (consent, overriding private or public interest, or law). Where GDPR or UK GDPR applies, we process personal data on the following legal bases:

—Performance of contract and steps taken at your request (Art. 6(1)(b) GDPR / nDSG Art. 31): processing necessary to deliver your purchased report, fulfill our contractual obligations, and deliver free resources you have requested.

—Compliance with legal obligations (Art. 6(1)(c) GDPR / nDSG Art. 31): processing required by Swiss commercial law, tax law, and applicable regulatory requirements.

—Legitimate interests (Art. 6(1)(f) GDPR / nDSG Art. 31): fraud prevention, security monitoring, and anonymized methodology improvement. Our legitimate interests do not override your rights and freedoms.

—Consent (Art. 6(1)(a) GDPR): where we rely on consent (e.g., optional analytics cookies or a seller's authorization of a read-only platform connection under Section 6), you may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Seller Data

This section applies wherever we process data relating to the seller of an asset under analysis (a digital asset or online business, whether or not listed on a marketplace) with the seller's authorization: where the seller has requested an analysis from us directly, and equally where a prospective buyer has commissioned an analysis and the seller grants Dealytix view-only access to source data, for example by accepting an authorization link. In both cases we process: the seller's name and contact details; information already public about the asset, including any marketplace listing where one exists; and asset-level aggregate analytics read under the view-only access the seller grants, including access granted through a platform's own sharing features or an authorized connection. Where that connection is authorized through a Google account, Section 6 applies in addition to this Section. Aggregate analytics means figures such as revenue, traffic sources, engagement metrics, and audience composition as the platform reports them in aggregate. Where the analysis was commissioned by a buyer, the resulting report belongs to that buyer and is not shared with the seller. We do not access, collect, or store personal data of the seller's subscribers, viewers, or customers. We never ask for or accept passwords or account credentials.

This data is processed to produce the analysis and maintain the records supporting it, including anonymized calibration of our scoring methodology. The legal basis is the seller's consent and, where the seller has requested the analysis, the performance of that engagement. Consent may be withdrawn at any time by revoking access in the platform and emailing hello@dealytix.com; withdrawal does not affect processing before withdrawal. Analysis inputs are retained for 24 months from delivery, consistent with our retention of submitted listing data. The delivered report and its authentication record are retained for as long as the report may be in circulation with prospective buyers, so that we can confirm its authenticity and defend its contents, and thereafter as required by statutory retention duties. Sellers may request earlier deletion at any time; we will action such requests within 30 days except where continued retention is necessary for authentication of a shared report, ongoing dispute resolution, or legal compliance. Data is shared only with service providers acting as processors under data processing agreements.

6. Google User Data

This Section applies when the seller of an asset under analysis, or another person with authority over the relevant account, signs in with a Google account to authorize Dealytix to read data about that asset. Authorization is given on Google's consent screen, is read-only, and can be withdrawn at any time.

6.1 Data and purpose. With that authorization we read aggregate, asset-level metrics from YouTube Analytics, Google AdSense, and Google Search Console, and, where shown on the consent screen and separately consented to, Google Analytics and YouTube monetary analytics, together with the email address of the authorizing account and a technical access token. We use this data to prepare the due diligence analysis of the authorized asset and present the results in the Report delivered to the person who commissioned it. Figures derived from the analysis may be retained in anonymized and aggregated form, which cannot identify the seller, the account, or the asset, to calibrate and improve the Dealytix scoring methodology. We do not use Google user data for advertising, for profiling any individual, or to build, train, or improve generalized artificial intelligence or machine learning models.

6.2 Storage, sharing, and retention. Tokens and data are transmitted over TLS and stored encrypted at rest. They are shared only with the processors listed in Section 8 to the extent needed to prepare the Report, and are never sold, transferred to advertising networks or data brokers, or provided to the buyer in raw form. Humans access the data only to prepare or verify the Report, with the seller's consent, for security purposes, or where required by law. The access token is deleted 14 days after delivery of the Report, or earlier on revocation or cancellation of the Order. The data snapshot read at authorization is retained with the Report under Sections 5 and 7 and is then deleted.

6.3 Revocation. You may revoke access at any time in your Google Account under Security, then Third-party apps and services (https://myaccount.google.com/permissions), or by emailing hello@dealytix.com. On revocation we delete the token; data already read is handled under Section 6.2.

6.4 Google policy. Dealytix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Retention

Transaction and order data is retained for 10 years in accordance with Swiss commercial record-keeping requirements (OR Art. 958f). This includes order confirmations, payment records, and delivered report logs. Delivered Report content is retained in accordance with Section 5 and in any event for at least 10 years from delivery, being the limitation period for contractual claims under Art. 127 OR, so that we can authenticate a Report and defend its contents.

Submitted listing data (URLs, attachments) is retained for 2 years to support any dispute resolution or quality review, then deleted. Email correspondence is retained for 3 years. Usage data and server logs are retained for 12 months and then deleted or anonymized. Anonymized benchmark data (aggregate, non-identifiable scoring patterns) may be retained indefinitely as part of our methodology calibration dataset.

Personal data not covered by a specific period above is retained only for as long as necessary for the purpose for which it was collected, including to evidence that a resource was requested, and is then deleted.

You may request deletion of your personal data at any time. We will action deletion requests within 30 days, subject to any mandatory retention obligations under Swiss law.

8. Third-Party Processors

We use the following third-party processors, each governed by appropriate data processing agreements:

—Stripe Inc. (San Francisco, CA, USA): payment processing. Stripe processes payment card data directly under its own privacy policy. We receive only a payment confirmation token, never card data. Stripe is certified under PCI DSS Level 1.

—Supabase Inc.: database and storage infrastructure. Order data, listing submission data, and reports are stored on Supabase-hosted servers. Supabase infrastructure is hosted on AWS in regions selected by Altus Capital GmbH. Data at rest is encrypted.

—Anthropic, PBC (San Francisco, CA, USA): AI analysis engine. Submission data including listing URLs and seller-uploaded attachments are processed by Anthropic's Claude API to generate report content. Anthropic's API usage policy prohibits training on API inputs.

—Resend (email delivery): transactional email delivery for order confirmations, report notifications, and requested free resources.

—Railway (infrastructure): Node.js application hosting for the report generation pipeline.

—Framer (website hosting): hosting of the dealytix.com website frontend.

—Google LLC (Mountain View, CA, USA): not a processor, but the source of data read under Section 6 with the seller's authorization. Google's handling of the authorizing account is governed by Google's own privacy policy.

All processors are contractually required to: process data only on documented instructions from Altus Capital GmbH; implement appropriate technical and organizational security measures; not engage sub-processors without our approval; and assist with data subject rights requests. We may add or replace processors; the current list is available on request and material changes are reflected in this Policy.

9. International Data Transfers

Your data may be transferred to and processed in countries outside Switzerland and the European Economic Area, including the United States. Where such transfers occur, we rely on:

—The Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework, which the Swiss Federal Council and the European Commission respectively recognize as providing an adequate level of protection, where the recipient is certified (for example Stripe and Google).

—Standard Contractual Clauses (SCCs) approved by the European Commission and recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC), with the Swiss addendum, for transfers to countries without an adequacy determination.

—For personal data subject to UK GDPR, the UK International Data Transfer Agreement or the UK Addendum to the SCCs, or the UK-U.S. Data Bridge where the recipient is certified.

10. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

—Right of access (Art. 25 nDSG / Art. 15 GDPR): obtain confirmation of whether we process your data and receive a copy.

—Right to rectification (Art. 32 nDSG / Art. 16 GDPR): request correction of inaccurate or incomplete data.

—Right to erasure (Art. 32 nDSG / Art. 17 GDPR): request deletion of your personal data, subject to legal retention obligations.

—Right to restriction of processing (Art. 18 GDPR): request that we limit processing of your data in certain circumstances.

—Right to data portability (Art. 20 GDPR): receive your data in a structured, machine-readable format.

—Right to object (Art. 21 GDPR): object to processing based on legitimate interests.

—Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

—California residents (CCPA/CPRA): right to know, right to delete, right to correct, right to opt out of sale (we do not sell data), right to non-discrimination for exercising privacy rights.

—Residents of other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, and Oregon): equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, or profiling, which we honor to the extent those laws apply to us. We do not sell personal data, do not share it for cross-context behavioral advertising, and do not engage in profiling that produces legal or similarly significant effects, so no opt-out is required; where the law requires it, we treat a Global Privacy Control signal as an opt-out request.

—UK residents (UK GDPR): the same rights as under GDPR, exercisable in the same way.

To exercise any of these rights, contact hello@dealytix.com. We will respond within 30 days (extendable by a further 60 days for complex requests, with notice), or within any shorter period required by the law applicable to you. We may need to verify your identity before actioning a request. There is no fee for standard requests; we reserve the right to charge a reasonable administrative fee for manifestly unfounded or excessive requests.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, with the supervisory authority in your EU member state of residence, or, for UK residents, with the Information Commissioner's Office (ico.org.uk).

11. Cookies and Tracking Technologies

10.1 What we use. We use minimal cookies and tracking. Our website uses cookies for the following purposes:

—Strictly necessary cookies: session management and security tokens required for the website to function. These cannot be disabled.

—Analytics cookies (optional, consent required): aggregate, anonymized visitor statistics to understand how the website is used. We do not use advertising cookies or cross-site tracking.

10.2 What we do not use. We do not use advertising cookies, retargeting pixels, social media tracking pixels, or any technology that tracks your behavior across other websites.

10.3 Managing cookies. You can control non-essential cookies through your browser settings. Disabling analytics cookies does not affect your ability to use the website or purchase reports. Where EU or UK law requires it, analytics cookies are set only after you accept them in the cookie notice shown on your first visit.

12. Security

Altus Capital GmbH implements the following technical and organizational measures to protect personal data: TLS encryption for all data in transit; encryption at rest for stored data and access tokens; access controls limiting data access to authorized personnel only; API key authentication for all service integrations; Supabase row-level security policies; and regular review of third-party processor security certifications.

No security system is completely impenetrable. In the event of a personal data breach that poses a risk to your rights and freedoms, Altus Capital GmbH will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by nDSG or GDPR), and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

13. Automated Decision-Making

Dealytix Scores and Reports are prepared with the assistance of automated systems and are reviewed by an analyst before delivery. They are information about a business asset provided to the person who commissioned them. They do not constitute a decision based solely on automated processing that produces legal or similarly significant effects on any individual within the meaning of Art. 21 nDSG or Art. 22 GDPR, and we make no such decisions about you.

14. Children's Privacy

The Service is not directed at children under the age of 18. Altus Capital GmbH does not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, contact hello@dealytix.com and we will delete it promptly.

15. Changes to This Policy

Altus Capital GmbH may update this Privacy Policy from time to time. The updated version will be posted at dealytix.com/privacy with a revised effective date. For material changes affecting how we use your personal data, we will notify registered users by email at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

16. Contact for Privacy Matters

For any privacy-related inquiry, to exercise your rights, or to lodge a concern, contact Altus Capital GmbH at: hello@dealytix.com. Altus Capital GmbH, Canton Schwyz, Switzerland. We aim to respond to all privacy inquiries within 5 business days.