Privacy Notice
Effective Date: October 21, 2026
GlobalDeal Inc. ("GlobalDeal," "we," "us") runs globaldeal.app, a free database of about 12.6 million company profiles in more than 180 countries. This notice explains what personal data we process, why we process it, who receives it, how long we keep it, and what rights you have. We are the controller of this data.
How to contact us about privacy: email
info@globaldeal.app or use the request form at
/request ("Contact & data requests"). The same form handles corrections, objections and account deletion.
1. Who This Notice Covers
- Visitors who search and browse the site without an account.
- Registered users with a free account.
- Contributors who add companies, suggest edits or upload logos.
- Donors who make a voluntary donation through Stripe.
- People who contact us through the request form or otherwise.
- People connected to company profiles, for example a sole trader whose business carries their own name (see section 3).
2. What We Collect About Users and Visitors
- Account data — your email address and name, or your Google account ID if you sign in with Google. Passwords are handled by our sign-in service (Keycloak) and stored only as salted hashes.
- Projects and exports — the projects you create, the companies you save in them, and how many rows you have exported (used for export limits).
- Searches — the searches and AI web searches you run.
- Contributions — companies you add, edits you suggest, logos you upload, and a record of who submitted what.
- Technical data — IP address, browser type and server logs.
- Site statistics (our own) — the pages you open and their titles, how long a page is visible and how far you scroll, the links and buttons you click (their labels), the searches and filters you run on the site, the site and campaign tags you came from, device type, browser, operating system, language, window size, page load time and script errors. From your IP address we derive the country, region, city and network (internet provider or organisation, and whether it is a data centre or VPN) using the DB-IP Lite database (db-ip.com, CC BY 4.0) and a daily visitor code (a one-way hash of the IP address and browser with a random key that is replaced every 24 hours). We do not store your IP address for statistics. Without analytics consent nothing is stored on your device. With analytics consent we also keep a random visitor ID in your browser's local storage to recognise return visits. If you are signed in, your visits are linked to your account. See the Cookie Policy.
- Google Analytics — data about how pages are used, collected only if you accept analytics cookies. See the Cookie Policy.
- Donation records — amount, date and payment reference, received from Stripe. We never see your card number.
- Messages to us — what you write in the request form or in emails you send us.
3. Company Profiles (Notice under Article 14 GDPR)
Company profiles describe businesses, not people. A profile can include: company name, website, country, city, industry, products and services, employee range, revenue range (estimates), founding year, LinkedIn company page URL, logo, and a short summary written by AI. We do not show personal contact details of employees.
Some company information can still relate to an individual — for example a sole trader or a business named after its owner. Because we did not collect this information from you directly, this section is our notice under Article 14 GDPR.
- Sources: company websites, business-data providers, public web search results (Serper / Google), LinkedIn company pages (companies only, never people), logos from logo.dev, Clearbit or Google favicons or uploaded by users (reviewed before publishing), and contributions from users.
- Purpose: making basic, publicly available business information searchable so that businesses can find suppliers, partners and customers.
- Legal basis: our legitimate interests and those of our users in business discovery (Article 6(1)(f) GDPR).
- Recipients: anyone who visits the site, and the service providers listed in section 6.
- Retention: as long as the company profile is in the database, or until it is corrected or removed.
- Your choices: you can object, or ask us to correct or remove information, at any time — use "Suggest an edit" on the company page or the request form at /request.
4. Purposes & Legal Bases
| Purpose | Legal Basis (GDPR) |
|---|
| Your account, projects, exports and AI web search | Performance of a contract (our Terms) |
| Security, abuse prevention and usage limits (including server logs) | Legitimate interests |
| Company profiles | Legitimate interests (Art. 6(1)(f)) |
| Reviewing and publishing contributions, and keeping a record of who submitted what | Performance of a contract and legitimate interests (keeping the database accurate, handling disputes) |
| Our own site statistics without consent (nothing stored on your device, IP address not stored), and linking the visits of signed-in users to their account | Legitimate interests (understanding how the site is used and improving it) |
| Analytics with consent: Google Analytics cookies, and the visitor ID in our own statistics | Consent |
| Donation accounting | Legal obligation |
| Answering your requests and messages | Legal obligation (privacy rights requests) and legitimate interests |
5. AI and Automated Processing
We use open AI models (gpt-oss, Llama) run by DeepInfra in the USA. AI writes company summaries, tags industries and products, checks contributions against the company website, and runs AI web search. When you use AI web search, your question is sent to DeepInfra and the resulting search terms to Serper.dev to get Google results. Please do not put personal or confidential information in your questions.
When AI checks a contribution, clear matches are published right away, doubtful ones go to a person, and junk is rejected. We do not make decisions that have legal or similarly significant effects on you solely by automated means. If you think a contribution was rejected wrongly, you can ask for a person to review it through
/request. More details are on the
AI & Sources page.
6. Who Receives Data (Service Providers)
- Siamdata Communication (Thailand) — hosts our servers (VPS).
- DeepInfra (USA) — runs the AI models.
- Serper.dev — returns Google search results for AI web search and data collection.
- Stripe — processes donations. We never see card numbers.
- Google — Analytics (only with your consent), Google sign-in (if you choose it), and sending our emails.
- logo.dev, Clearbit and Google favicons — receive only company domains to return logos, no personal data.
We also disclose data when the law requires it. If GlobalDeal is ever reorganised or transferred, the data may pass to the new operator, who must keep to this notice.
We do not sell personal data. We do not share it for cross-context behavioural advertising and we use no advertising cookies. Our own site statistics stay on our servers and are not shared or sold.
7. International Transfers
Our servers are in Thailand and some providers are in the USA. When personal data leaves the EU or UK for a country without an adequacy decision, we rely on Standard Contractual Clauses or, where the provider is certified, the EU-US Data Privacy Framework.
8. How Long We Keep Data
- Account data and projects: until you delete your account.
- Searches and AI web searches: 12 months.
- IP addresses, browser data and server logs: up to 90 days.
- Contributions: published contributions stay part of the company profile; the record of who submitted them is kept as long as needed to handle disputes and abuse.
- Our own site statistics: 13 months, then deleted automatically. The visitor ID in your browser stays until you withdraw consent or clear browser storage.
- Analytics cookies: up to 2 years, and only if you consented.
- Donation records: as long as tax law requires.
- Messages to us: as long as needed to deal with your request and any follow-up.
9. Your Rights
Depending on where you live, you have the right to:
- Access — get a copy of your personal data.
- Correction — fix inaccurate or incomplete data.
- Deletion — have your data erased, including deleting your account.
- Restriction — limit how we use your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests, including company profiles.
- Withdraw consent — for example to analytics cookies and the statistics visitor ID, at any time, through "Cookie settings."
- Complain — to a data protection authority, for example in the country where you live or work.
To use these rights, or to delete your account, send a request through
/request. We may confirm your identity by email. We reply within one month under the GDPR (we can extend this by two more months for complex requests and will tell you if we do), or within 45 days under US state privacy laws. US residents can find more on our
Do Not Sell/Share page.
10. Age Limit
You must be 18 or older to create an account. The site is not directed at children and we do not knowingly collect their data. If we learn that we have, we will delete it.
11. Security
See our
Security page for what we do to protect data.
12. Changes to This Notice
We will post any changes on this page and update the date at the top. If a change is significant, we will make that clear on the site.