Privacy Policy

1. What we collect

• Deal content: titles, descriptions, drafted and approved terms, delivery records, dispute reasons, and evidence you submit.
• Contact data: the email address you bind to a deal role.
• Payment data: handled by Stripe. Card and bank details go directly to Stripe; Holdshake never stores your full card number. We store Stripe identifiers needed to execute holds, transfers, and refunds.
• Technical data: standard server logs (IP address, timestamps, requests) used for security, rate limiting, and abuse prevention; and an audit log of actions taken on each deal, visible to both parties of that deal.

2. How we use it

To operate your deals: drafting terms, administering holds, running the release clock, resolving disputes, sending deal-related emails (invites, recovery links, rulings), preventing fraud and abuse, and complying with legal obligations including tax reporting where applicable. We do not sell your personal information and we do not use your deal content for advertising.

3. AI processing

Deal descriptions, terms, delivery records, and evidence are processed by our AI provider (Anthropic) to draft terms and produce referee determinations. This processing is performed to provide the service you requested. Do not include sensitive personal information (health, government ID numbers, etc.) in deal content; it is not needed to resolve a deal.

4. Sharing

We share data only with: the other party to your deal (deal content and the audit log are visible to both parties by design); Stripe, for payment processing and compliance; our AI provider, to generate terms and rulings; service providers under confidentiality obligations (hosting, email delivery); and authorities where required by law or to protect rights and safety. If Holdshake is acquired, data may transfer as part of that transaction under this policy's protections.

5. Retention

Deal records, rulings, and audit logs are retained after a deal completes because they document a financial transaction and a binding determination — retention supports both parties' interests and legal compliance. Recovery-link emails and server logs are retained for shorter operational periods. You may request deletion of data not required for these purposes.

6. Security

Deal access uses unguessable capability links; recovery requires a matching deal code and bound email, with rate limiting and identical responses that reveal nothing about whether a code exists. Transport is encrypted. No system is perfectly secure; keep your deal links private.

7. Your rights

Depending on your jurisdiction (including California and the EU/UK), you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. Contact [CONTACT EMAIL]; we will respond within the period required by applicable law. Note that we may retain what Section 5 requires.

8. Cookies

Holdshake uses only what is necessary for the service to function (such as remembering interface preferences on your device). No third-party advertising or cross-site tracking cookies.

9. Children

Holdshake is for adults 18 and over. We do not knowingly collect information from minors; if you believe a minor has used the service, contact us and we will act on it.

10. Changes and contact

We will post updates here with a new "last updated" date; material changes will be flagged on the site. Controller: [COMPANY LEGAL ENTITY], [ADDRESS], [CONTACT EMAIL].