Privacy

What we collect

When you sign up, we store your email address and a Stripe customer ID if you upgrade. That's the entirety of the identity data we keep on you.

When you run an agent, we store the input you submitted, the output the model produced, the token counts, and the cost — so you can read the memo again later and so we can show you your monthly usage. These are in your private account; they are not visible to other users unless you explicitly publish a memo to the public gallery. Tearsheet operators may access them only as described below.

What we do with your inputs

Your inputs (CIMs, listings, broker packages, buyer criteria) are sent to Anthropic's Claude API to generate the memo. They are not used to train Anthropic's models— Anthropic's API terms explicitly prohibit that. We do not use your inputs to train any model either. We do not sell them. We do not share them with third parties except as described below.

If you paste a URL in an input field, we send that URL to Firecrawl to scrape its contents — same content the URL would return to your browser. The scraped text is sent to Anthropic alongside your input.

If you buy a Deal Desk Sprint and upload materials, those files are stored in a private Supabase Storage bucket. Tearsheet's automated systems may extract text excerpts and source-labeled candidate facts from uploaded PDFs, spreadsheets, CSVs, Word documents, text files, and similar deal materials so the delivery can cite what came from your materials versus what remains unverified.

Deal Desk may also use public-source enrichment for diligence leads: Exa search, Firecrawl page extraction, and Google Places directory signals. Public-source cards are not treated as proof of seller revenue, SDE, add-backs, ownership, licensing, legal status, valuation, tax/accounting quality, or lender approval.

Who can see your data

• You, in your own dashboard.
• Tearsheet operators, when needed to run or fulfill a Deal Desk Sprint, investigate support issues, or keep the service reliable. We do not publish your submitted deal materials without your explicit action or permission.
• Anthropic, when we make API calls to Claude on your behalf. Their data-handling terms are at anthropic.com/legal/privacy.
• Stripe, for billing and Checkout. Stripe sees your email, payment information, and any optional context you type into Checkout, such as a public listing URL, deadline, or decision context. Do not paste confidential CIM content into Stripe custom fields; use the private post-payment upload page for confidential materials.
• Supabase and Vercel, which host our database and infrastructure. They are subprocessors with standard SaaS data-handling terms.
• Firecrawl, when we scrape a URL you supplied or a public page used for Deal Desk public-source enrichment.
• Exa, when Deal Desk uses web search to find public diligence leads.
• Google Places, when Deal Desk checks public directory signals such as business presence, ratings, or location context.
• Resend, when we send login links, buyer instructions, operator alerts, or delivery emails.
• Sentry and PostHog, for crash reporting and product analytics. We do not intentionally send these your memo content. Operational logs and analytics may include page views, button clicks, order or session IDs, account email domains or redacted email addresses, URL hostnames, and stack traces needed to keep the service reliable. Private Deal Desk status-page access tokens are not intentionally sent in analytics pageview URLs.

Public memos

If you click Publish on a memo, it becomes accessible at a public URL like /m/[slug]. Only the memo content, agent type, redacted public title, optional redacted public summary, and publish date are shown publicly. Your raw input, email, user ID, cost of the run, errors, and any rating you gave the memo are never displayed publicly. You can unpublish at any time.

Your API key (free tier)

If you use your own Anthropic API key on the free tier, it is encrypted with AES-256-GCM at rest using a key we manage. We decrypt it at request time to make the API call. We do not log it, we do not display it, and you can delete it at any time from Settings.

Cookies + session

We use cookies only for authentication (keeping you signed in). We do not run ad-network trackers. We do not embed third-party social pixels.

Export and deletion

Email hello@usetearsheet.com from your account address and we'll export everything we have on you, or delete it. We aim to fulfill these requests within 7 days.

Changes

If we materially change how we handle data, we'll update this page and email users on file before the change takes effect.

Contact

Privacy questions: hello@usetearsheet.com. Privacy requests are reviewed for support, safety, legal, or account administration purposes.