Privacy Policy
Last updated September 10, 2026
This policy explains what Deal Route collects, why, and what we do with it. Deal Route is operated by Cortada Capital Group (“we”, “us”). It applies to the Deal Route web application at dealroute.app.
Who this covers
Deal Route is business software sold to brokerages. The people using it are employees of a brokerage that holds an account with us, and most of the information in it is entered by them about their own customers. Where a brokerage decides what goes in and why, that brokerage is the controller of it and we process it on their behalf.
What we collect
Account information
- Your name, work email address and role.
- Sign-in times, and security events such as two-step verification codes.
Business records you enter
- Merchant and deal details, funders, submissions, offers and their status.
- Documents you upload, such as applications and bank statements.
- Commission, payout and accounting records.
Google account data, if you connect one
Connecting Google is optional. Deal Route works without it; you lose the ability to send from your own address and to read deal mail in the app. If you do connect, we request only the following, and only what the features you use require:
| Permission | What it lets Deal Route do | Why |
|---|---|---|
gmail.send | Send mail as you. It cannot read your mailbox. | So deal submissions, offers, funded notices and verification codes come from your own address and appear in your Sent folder. |
gmail.modify | Read your mail and change its labels — for example marking a thread read when you open it in Deal Route. | To show the deal inbox inside the app, and to record a funder's reply against the submission it belongs to. |
userinfo.email, openid | See the email address of the Google account. | To link the connected mailbox to your Deal Route login. |
How Google data is used
- Mail is read to display it to you and to detect a funder's response to a deal you sent. The text of a reply may be saved against that submission as its notes, so your team can see what the funder said.
- We do not read your mail for any other purpose. We do not scan it for advertising, we do not sell it, and we do not use it to train machine learning models.
- No employee of ours reads your mail except where you have asked us for support with a specific problem and given permission, or where we are required to by law.
Deal Route's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How it is stored and protected
- Data is held in a Postgres database hosted by Neon, in the United States.
- Google access and refresh tokens, and any SMTP password you enter, are encrypted before they are written to the database. They are decrypted only in memory, at the moment they are used to send or read on your behalf.
- Traffic to and from the application is encrypted in transit.
- Access within a brokerage is limited by role and permission, and each brokerage's records are separated from every other brokerage's.
No system is perfectly secure, and we do not claim otherwise. We tell affected customers about a breach of their data without undue delay.
Who we share it with
We do not sell personal information. We share it only with service providers who run the product for us, under contract and only for that purpose:
- Vercel — application hosting.
- Neon — database hosting.
- Google — where you have connected an account, to send and read your mail.
We may also disclose information where the law requires it, or to protect our rights or someone's safety.
How long we keep it
- Business records stay for as long as the brokerage's account is active, and are deleted on request or when the account closes.
- Google tokens are deleted as soon as you disconnect the mailbox, and become unusable the moment you revoke access from your Google account.
- Mail is not mirrored into our database. Threads are read from Gmail when you open them. What we store is the reply text recorded against a submission, and the identifier of the thread it came from.
Your choices
- Disconnect Google at any time — in Deal Route under My Account, or from your Google account at myaccount.google.com/permissions. Revoking there stops all access immediately.
- Access, correct or delete your information — ask your brokerage's administrator, or write to us at privacy@dealroute.app.
Children
Deal Route is business software and is not directed at anyone under 18. We do not knowingly collect information from children.
Changes
If this policy changes we will update the date at the top of this page, and tell account administrators where the change is material.
Contact
Cortada Capital Group — privacy@dealroute.app. See also our Terms of Service.