DealFlowPlugin.com ("we," "our," or "us"), operated by Sean Mahoney, respects your privacy. This policy explains what information we collect when you visit dealflowplugin.com or purchase Deal Flow, how we use it, and your rights regarding that information.
When you purchase Deal Flow: We collect the information you provide during checkout via Stripe: name, email address, and billing address. Stripe processes your payment card information directly — we never receive or store raw card data.
When you activate your license: The Deal Flow plugin installed on your server contacts our license API at purchase activation. The API receives your Mautic® instance subdomain and your license key to verify the license. We log this activation event (subdomain, timestamp, license key hash) for license validation and support purposes.
When you visit this website: We collect standard web server logs (IP address, browser type, pages visited, referrer) for security purposes. We also use Google Analytics 4 to understand how visitors use this site, and Google Ads cookies to measure which of our own ads brought you here. Whether those start switched on, or wait for your permission first, depends on where you are — see "Cookies & Analytics" below for what that involves and how to control it.
When you contact us: If you email us for support, we retain that correspondence to provide support and improve the product.
We use Google Analytics 4 (GA4) to understand how visitors use this site — which pages get traffic, how visitors found us, and whether the purchase flow completes. GA4 collects usage data (pages viewed, time on site, referring site), approximate location (derived from IP address, not precise geolocation), and device/browser information. We do not use this data to identify you personally, and it is never combined with your Mautic® contact or deal data — Deal Flow's license activation call and this website's analytics are entirely separate systems.
Consent: What happens on your first visit depends on where you are. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, a banner at the bottom of the page asks whether you'd like to allow analytics and advertising cookies. Nothing analytics- or advertising-related is stored until you click "Accept" — all four Google consent signals (analytics storage, ad storage, ad user data, ad personalization) start denied, and are granted together only when you accept. Clicking "Decline," or ignoring the banner and closing the tab, keeps all four off. Everywhere else, analytics and advertising cookies are enabled by default, as permitted by local law, and you can switch them off at any time using the link below. Either way, once you have made a choice it is saved in your browser's local storage and respected on every later visit, wherever you are — we don't ask again once you've decided.
How we determine your region: Two separate checks, and neither one uses a location lookup service. The default consent state is set by Google, from the region it resolves for your IP address. Whether the banner appears at all is decided inside your browser, from your device's timezone setting alone — nothing about your location is sent anywhere for that check, and it deliberately errs toward showing the banner when your timezone is unclear.
Changing your choice: You can change your mind at any time, from anywhere: change your cookie choice reopens the banner on this page, and whatever you pick replaces your saved choice immediately. Clearing your browser's site data for dealflowplugin.com (in most browsers: site settings → cookies and site data → clear data for this site) also erases the saved choice, which returns you to whichever default applies in your region.
Advertising: We advertise Deal Flow on Google Search to bring visitors to this site. We do not display third-party ads on this site, and we do not sell ad space. Google Ads cookies let us see which of our own ads led to a visit or a purchase, so we can stop paying for ads that don't work. In the EEA, the UK, and Switzerland these are set only after you click "Accept"; elsewhere they are on by default and stop as soon as you decline. Whenever ad storage and ad personalization are denied, no advertising signals are sent.
Checkout campaign context: Only after you have explicitly clicked "Accept," a purchase-link click may pass Stripe a one-click anonymous reference plus controlled campaign labels (such as an approved source, campaign, landing page, button location, or experiment name). Declining, not choosing, blocked storage, or any read error leaves the original checkout link unchanged. This reads only your saved consent choice; it does not read or contain a Google Analytics client ID, cookie identifier, email address, IP address, customer ID, or browser fingerprint. Unapproved, malformed, personal-looking, or unique-identifier-shaped values are discarded, the reference is not stored in your browser, and checkout always remains available. We use the resulting paid, refund, and dispute totals only in aggregated marketing reports; attribution indicates a path to purchase and is not treated as proof that a campaign caused the sale.
We do not sell, rent, or trade your personal information to third parties. We do not use your purchase information (name, email, license key, subdomain) for advertising — it is never uploaded to Google Ads or any ad platform. Website analytics and advertising cookies, described in "Cookies & Analytics" above, are a separate system, and they operate according to the consent choice described there.
Deal Flow is a self-hosted plugin that runs on your server. We have no access to:
The only communication between your server and our infrastructure is the license validation call at plugin activation. No deal or contact data is ever transmitted to us.
If you sign up for our monthly newsletter, we collect the email address you provide. Signup uses double opt-in: after you submit your email, we send a confirmation message, and you are not subscribed until you click the confirmation link inside it. Unsubscribe anytime using the link in every newsletter email, or by emailing privacy@dealflowplugin.com.
Newsletter signup and delivery is processed on our self-hosted Mautic instance; SendGrid is our delivery provider for these emails, in the same processor role described for transactional email in Section 6. We do not sell or share your newsletter email address with third parties, and it is never combined with your Mautic® contact or deal data if you are also a Deal Flow customer.
Stripe: We use Stripe for payment processing. Stripe's privacy policy is available at stripe.com/privacy.
SendGrid: We use SendGrid to deliver transactional emails (license key delivery, receipts). SendGrid processes your email address to deliver these messages.
Google Cloud: Our license API and this website are hosted on Google Cloud Run. Google's privacy policy is available at policies.google.com/privacy.
Google Analytics: We use Google Analytics 4 to measure site usage, subject to the consent choice described in "Cookies & Analytics" above. Google acts as a data processor on our behalf for this data. Google's privacy policy is available at policies.google.com/privacy.
Google Ads: Subject to that same consent choice, we use Google Ads to measure which of our own search ads led to a visit or purchase. This links your visit to the ad you clicked, and lets Google use that data to improve the ads we show. Google's privacy policy is available at policies.google.com/privacy; you can control ad personalization across all Google services at myadcenter.google.com.
We retain your purchase record (name, email, license key, subdomain) for as long as your license is active plus 3 years, for tax, audit, and support purposes. Web server logs are retained for 90 days. Support emails are retained for 2 years. Google Analytics data is retained by Google for up to 14 months from collection, after which it is automatically deleted, per GA4's default retention setting.
You may request access to, correction of, or deletion of your personal information by emailing privacy@dealflowplugin.com. We will respond within 30 days. Deletion of your account will revoke your license key.
If you are in the European Economic Area or United Kingdom, you have additional rights under GDPR/UK GDPR, including the right to data portability and the right to lodge a complaint with your supervisory authority.
We use industry-standard security practices: TLS in transit, encrypted storage at rest, and access controls limited to personnel who need the data. However, no system is perfectly secure. If you discover a security issue, please report it to security@dealflowplugin.com.
We may update this policy as our practices evolve. We will notify active licensees of material changes via email. The effective date at the top of this page reflects the most recent revision.
Questions about this policy? Email us at privacy@dealflowplugin.com.
Sean Mahoney, Founder
DealFlowPlugin.com