Privacy Policy

CARMAboard™ is an anonymous market. Your name is not shown to anyone until you personally choose to reveal it.

Last updated: 18 August 2026 · Operator: DealDoctor® PLLC (“we”, “us”) · Contact: privacy@dealdoctor.pro

1. The short version

CARMAboard™ is an anonymous market. Your name is not shown to anyone until you personally choose to reveal it, and the parts of the product that other members can see are built from queries that never touch the table your name is stored in. We do not sell personal data, and we do not show advertising.

2. What we collect

When you create an account

• Email address — used to sign you in and to verify the account. Verification is mandatory before you can post or start a conversation.
• A handle you choose — this is what the market sees. It is pseudonymous.
• Your legal name — stored separately, in a sealed record, and disclosed only through the reveal process described in section 4.
• A password, stored only as an Argon2id hash. We cannot read it.

When you use the market

• The searches and offers you post: a free-text line and the dropdown values you select (participant type, who you want to reach, geography, industry, experience, engagement basis, and type-specific criteria).
• The matches the engine computes between your posts and other members’ posts.
• Approaches you send or receive, and messages inside sealed conversation rooms.
• Companies you have blocked (stored as text patterns you supply).

Automatically

• An audit record of consequential actions (account created, post created, approach sent or declined, reveal completed) with timestamps, for security and dispute resolution.
• Standard server logs.

Payments

• Card details are handled entirely by Stripe and never reach our servers. We store a Stripe customer identifier and a mirror of your subscription state.

3. What the market can see about you

A market card contains: the side (looking for / offering), your participant type, who you want to reach, the need, your free-text line, your selected dropdown values, your handle, and — if we have issued you one — a CARMA™ Specialist certification badge.

A market card never contains your legal name, email, or any contact detail. This is enforced structurally: the endpoints that build market cards, matches and approaches do not query the table your identity is stored in.

4. Revealing your identity

Identities are disclosed only when both sides of a conversation choose to reveal. One side revealing alone changes nothing — the room stays sealed and neither name is shown. Where an organization initiated the approach, the organization must reveal first.

Until a reveal completes, messages containing email addresses, phone numbers, links, or references to other messaging platforms are rejected by the system, so contact details cannot leak early.

5. Blocking

You can block companies. Blocked organizations are excluded before a market card is ever built for you, are excluded from matching in both directions, and cannot send you an approach. The patterns you enter are matched server-side only and are never disclosed to the company concerned.

6. Declining

If you decline an approach, the sender is not told that you declined. The decline is not shown to them.

7. Legal bases (UK/EU members)

• Contract — operating your account, posting, matching, messaging, billing.
• Legitimate interests — security, abuse prevention, audit records, and service improvement, balanced against your privacy.
• Consent — any marketing email, which you may withdraw at any time.
• Legal obligation — tax and accounting records.

8. Sharing

We share personal data only with:

• Stripe — payments.
• Our email provider — verification and notification emails.
• Our hosting provider — infrastructure.
• Authorities — where legally required.

We do not sell personal data. We do not share it with advertisers.

9. Retention

• Account data — for as long as your account exists.
• After deletion — your account is immediately deactivated and hidden from the market, then purged and anonymized. Audit records of consequential actions are retained in anonymized form for security and dispute purposes.
• Billing records — retained as long as tax law requires.

10. Your rights

Access, correction, deletion, portability, restriction, objection, and complaint to your supervisory authority (in the UK, the ICO).

Deleting your account — you can delete it yourself, from inside the app under Me → Delete account, or from the public page at carmaboard.com/delete-account without installing anything. No email to support is required.

11. Security

Passwords are hashed with Argon2id. Access tokens are signed. Identity data lives in a separate table that the market, matching and approach paths never query. Contact details are filtered inside sealed rooms. Verification is required before posting or messaging.

No system is perfectly secure, and we do not claim otherwise.

12. International transfers

Our infrastructure is hosted in the United States. Where members are in the UK or EU, transfers rely on appropriate safeguards under applicable data protection law.

13. Children

CARMAboard™ is not for anyone under 18. We do not knowingly collect data from children.

14. Changes

We will post changes here and, for material changes, notify you by email.

15. Governing law and disputes

This policy is governed by the laws of the District of Columbia, and a dispute about it is handled the way section 16 of the Terms of Service sets out: tell us first, then arbitration seated in Washington, D.C., with the small-claims and injunctive-relief carve-outs and the thirty-day opt-out described there.

That does not touch your data-protection rights. If you are in the United Kingdom or the European Economic Area, you keep the right to complain to your supervisory authority and to bring proceedings where you live, and nothing here asks you to give that up.

16. Contact

privacy@dealdoctor.pro
DealDoctor® PLLC, 1717 N Street NW, Suite 1, Washington, DC 20036