How Digital Deal Research handles data

Digital Deal Research is operated by Avenlund Group OÜ. As the operator, it decides why and how the processing described on this page happens, and is therefore the data controller for it.

Registry code

17598800

Email

contact@digitaldealresearch.com

For anything on this page — a question, a correction, or a request to exercise the rights set out below — email is the contact point and reaches the controller directly.

This site has no data protection officer. It is not required to appoint one: it carries out no large-scale monitoring and processes no special-category data.

Three features remember something between visits. All three use your browser's own local storage on this site's origin. There is no server-side profile behind them, and the stored values are never uploaded: nothing on this site reads local storage and transmits what it finds there. The same information can still reach the server another way, by travelling in a page address — that is set out in the next section, and it is a real distinction rather than a technicality.

The first-party measurement described under Analytics and measurement below is the one place the site reports anything about these features. It sends a single event at the moment you act — for example that listing 12345 was just watched — or, when the Compare page opens, how many listings it opened with. It never sends your saved Buy Box criteria, your watchlist or your comparison list, and nothing in an event connects it to you or to any other event.

Buy Boxddr-buy-box

The screening criteria you enter on the finder: maximum budget, minimum monthly profit, maximum owner hours per week, and the business model you selected.

Watchlistddr-watchlist

The listing numbers you saved, when you saved each one, and the date of the listing observation each is compared against, so the Watchlist can compare current listing data with that saved baseline.

Compareobi-comparison-listings

The listing numbers currently selected for side-by-side comparison. The key name predates the product being renamed and was deliberately left unchanged.

What this means in practice

• These values live on the device and browser you used. They do not follow you to another browser, another device, or a private window.
• This site sets no cookies, and uses no session storage, no IndexedDB and no browser fingerprinting.
• You can clear them yourself: Clear Buy Box on the finder, Remove on a watchlist card, and deselecting a listing in the comparison tray each delete the corresponding entry. Clearing site data for this domain in your browser removes all three at once.
• They are kept until you delete them. This site sets no expiry on them and has no way to delete them for you, because it cannot reach them.
• If storage is unavailable — a private window, or a browser configured to block it — every one of these features degrades quietly rather than failing. Nothing is stored instead.

Two features put their state into the page address rather than keeping it out of sight. This is worth stating precisely, because it is the one route by which the things you selected can reach a server.

• Compare rewrites the address bar as you go. Adding or removing a listing updates the address of the comparison page so that it carries the listing numbers currently selected. That rewrite happens inside your browser and does not send anything by itself.
• The finder reads criteria from the address. If you arrive on a link that already carries screening criteria, the finder uses them instead of your stored Buy Box. The finder does not write your criteria into the address itself.

Why that matters

A page address is part of the request your browser sends. Whenever such an address is actually requested — you reload or revisit the comparison page, open it from the comparison tray, bookmark it, or follow a link someone shared — the listing numbers or criteria in that address are sent to this site along with the request, and appear in the ordinary hosting records described below. They also appear in the history of whatever browser opened the link, and in any place the link itself is stored or pasted. Requests a page makes back to this same site carry its full address in a Referer header as well.

So the accurate statement is narrower than it might first appear: the values held in your browser's storage are not transmitted from that storage, and this site would say nothing more than that. It would not be accurate to claim that what you select never leaves your browser, because once it is in a page address it travels with the request like any other part of a URL. If you would rather a selection not be carried anywhere, deselect it or trim the query from the address before sharing or bookmarking the link.

Following a link from here to an external site is different. This site sets an explicit Referrer-Policy of strict-origin-when-cross-origin, sent as a response header and repeated inside each page, so a browser that honours it discloses only https://digitaldealresearch.com to an outside destination — the bare origin, without the path and without the query string that would carry your selection. Same-origin requests still carry the full address, which is the case described above.

This site is served from Cloudflare: its pages are static files, and a small Cloudflare Worker on the same domain receives the measurement events described below and answers addresses that have no page. Loading any page means your browser makes an ordinary web request, and — as with any hosted website — that request is handled by infrastructure that processes the technical details every HTTP request contains: your IP address, the URL requested, the referring page if your browser sends one, your user agent, and timing and error information. Cloudflare processes those requests as the hosting and network provider, under its own privacy policy, and its network handles the caching, routing and security filtering that keeps the site available.

In data protection terms Cloudflare is a processor acting for the operator for the hosting of this site, and it is the only such provider involved in serving these pages. Its role is set out in its data processing addendum.

Cloudflare also sends a standard network error logging header on responses, which asks browsers that support it to report failed requests to Cloudflare's reporting endpoint. It is a platform default that reports connection failures, not page content or anything you typed.

Digital Deal Research does not state retention periods or an exact field list for these infrastructure records, because they are produced and governed by the hosting provider rather than defined by this site. How long they are kept is determined by Cloudflare under the policy linked above; the operator does not extend it and does not build any separate log of its own.

Everything this site does with data, why it does it, and the legal basis under the GDPR for each. There are only six entries because the site only does six things.

Serving these pagesLegitimate interests — Article 6(1)(f)

Handling the web request your browser makes, which necessarily involves your IP address, the URL requested, your user agent, any referring page and timing information. The purpose is to deliver the page you asked for and keep the site available, fast and correct. The legitimate interest is running a working website; it cannot be done without processing these request details.

Keeping the site up and unabusedLegitimate interests — Article 6(1)(f)

The same request details are processed by the hosting network for caching, routing, rate limiting and security filtering. The purpose is to keep the site available and to resist attack and abuse. The legitimate interest is the security and integrity of the service.

Answering an email you sendLegitimate interests — Article 6(1)(f)

If you write to contact@digitaldealresearch.com, your address, your message and anything you chose to put in it are processed in order to read it, reply to it, and keep the correspondence as a business record. The purposes are dealing with the enquiry you initiated and keeping a record of what was asked and answered. The legitimate interest is responding to people who contact the site and being able to show what was said; you can object at any time.

Counting use of core featuresLegitimate interests — Article 6(1)(f)

Recording an anonymous count each time the Finder screens a Buy Box, a Business Brief is opened, a listing is watched or unwatched, a listing is added to Compare, or the Compare page is opened. The purpose is to understand, in aggregate, which parts of the product are used, so that effort goes where it is useful. The legitimate interest is improving the service; the event carries no identifier, so no event can be linked to a person or to another event. A browser sending Global Privacy Control or Do Not Track sends none of these events, and you can also object by email.

Counting arrivals from distribution linksLegitimate interests — Article 6(1)(f)

Recording an anonymous count when a page is opened through one of Digital Deal Research's own controlled distribution links, carrying only the campaign labels from that link. The purpose is to learn, in aggregate, which places and formats in which Digital Deal Research publishes its research bring readers to the site. The legitimate interest is deciding where publishing effort is useful; the event carries no identifier, so no event can be linked to a person or to another event. The same Global Privacy Control and Do Not Track rules apply, and you can also object by email.

Buy Box, Watchlist and CompareNo consent required — storage strictly necessary for a feature you asked for

These write to storage on your own device rather than to a server. Storing them is strictly necessary to provide the specific function you explicitly requested by using the feature, which is the exemption that means this site shows no cookie or storage banner. The stored values are not uploaded, so no personal data reaches the operator through them. The measurement described below may report that the Finder ran a screen and how many businesses exactly matched it, that a listing was watched, unwatched or added to Compare, or how many listings the Compare page opened with, but never your saved criteria or the stored lists themselves.

None of this processing is automated decision-making or profiling that produces legal or similarly significant effects. Fit Scores and percentiles are calculated from marketplace listing data against criteria you typed; they are a calculation about businesses for sale, not an evaluation of you.

Nothing here is provided under a statutory or contractual obligation. You are not required to give anything, and the only reason to send anything at all is if you choose to write to the address above.

• Buy Box, Watchlist and Compare storage — until you delete it. It sits on your device, under your control, and is not kept anywhere else.
• Aggregate measurement and attribution events — for the retention period Cloudflare applies to its Workers Analytics Engine, in which they are stored. The operator does not extend it and keeps no copy of individual events; it keeps only aggregate totals derived from them, which describe feature use and link arrivals and nobody in particular.
• Hosting and security records — for the period Cloudflare applies to them as the hosting provider. The operator does not set that period, does not extend it, and keeps no copy after it.
• Email correspondence — retained for as long as reasonably necessary to respond to the enquiry, maintain relevant business records, resolve disputes, or meet applicable legal obligations. No fixed filing period is stated here because none has been set; the criterion is a continuing reason to keep the message, and correspondence is deleted once none applies.

Digital Deal Research uses a small first-party event counter to understand aggregate use of core product features. No third-party analytics script or tracking pixel is loaded, and there is no advertising tag, no Google Analytics, no tag manager, no session recording and no third-party behavioural tracking anywhere in its pages.

What is counted

Six things: the Finder screening a Buy Box, a Business Brief being opened, a listing being watched or unwatched, a listing being added to Compare, and the Compare page being opened. When one happens, the page sends one small event to this site's own address — a same-origin request to https://digitaldealresearch.com, never to anyone else.

What the measurement dataset contains

• the event type, such as listing watched;
• the part of the site it happened on — Finder, Brief, Watchlist or Compare;
• the listing number, when the event is about one listing;
• one number, when the event has one: how many businesses matched a screen, or how many listings the Compare page opened with;
• the time the event was recorded, added on the server side.

What it does not contain

• no visitor, device or session identifier of any kind;
• no IP address;
• no user agent;
• no referrer;
• no full URL;
• no location.

No cookie, localStorage or sessionStorage entry is created for measurement, so nothing links one event to another or to a later visit. The events are counted to see how the product is used; they are not used for advertising or profiling, and they are not shared or sold.

Global Privacy Control and Do Not Track are honoured. If your browser sends either signal, Digital Deal Research does not send these measurement events at all. Automated browsers do not send them either.

The events travel as ordinary web requests to this site, so the hosting layer described above handles them like any other request, including your IP address at the network level. What this site controls is what it keeps: the code that receives an event writes only the fields listed above into the measurement dataset, and does not write your IP address, user agent, referrer or location into it. The dataset is Cloudflare's Workers Analytics Engine, operated by Cloudflare as the hosting provider.

Other aggregate traffic and performance information available to the operator comes from the hosting provider's own view of the requests described above, and from search-engine webmaster tools such as Google Search Console. Search Console reports on how a site appears in search results using the search engine's own data; it is not a script running in your browser and it places nothing on this site.

Digital Deal Research shares links to its own research by hand — for example in a LinkedIn post or a Reddit comment. Those controlled distribution links carry a few campaign labels in the address: where the link was placed, what kind of post it sat in, optionally the theme, and which market pulse it came from. When you arrive through one of those links, Digital Deal Research may record a small first-party aggregate attribution event, sent to this site's own address like the measurement events above and stored in a separate dataset.

What the attribution dataset contains

• the event type: a supported page was opened from a distribution link, or the Finder was opened from one;
• the page it happened on — the market pulse, Methodology or the Finder;
• the campaign labels from the link: channel, format, theme when the link has one, and pulse;
• the time the event was recorded, added on the server side.

Only values from Digital Deal Research's own fixed campaign vocabulary are accepted. Any other parameter in an address is not attribution data and is not recorded.

What it does not contain

• no name or email address;
• no user, visitor, session or device identifier, and no fingerprint;
• no cookie, and no identifier from localStorage or sessionStorage;
• no IP address, user agent or referrer;
• no location;
• no full URL, page path or other query string;
• no listing number;
• no marketplace or referral identifier, including the Empire Flippers referral code.

No persistent attribution identifier is created. Campaign labels are carried from page to page only in the addresses of this site's own links; no cookie, localStorage or sessionStorage entry and no generated visitor or session identifier is used to remember where you came from, and there is no fingerprinting. Nothing builds an attribution profile of you. The same Global Privacy Control, Do Not Track and automated browser rules as the measurement above apply.

These events travel as ordinary web requests, so the hosting layer handles them like any other request, including your IP address at the network level, and the campaign labels are part of the page address like anything else in a URL. What this site controls is what it keeps: the code that receives an attribution event writes only the fields listed above into the attribution dataset, and does not write your IP address or any of the other excluded fields into it.

This is separate from the Empire Flippers referral programme, described under External requests and links below. Digital Deal Research's distribution-link attribution counts arrivals on this site; referral attribution by Empire Flippers happens on its own site, under its own policies, and nothing from it is written into this dataset.

No third-party resources

Viewing a page on this site makes requests to this site only. Its pages embed no external resource of any kind: no third-party script, no hosted stylesheet, no remotely served font, no image or media loaded from anywhere else. Typography is rendered entirely from fonts already present on your own device, so no font provider or content delivery network is contacted on this site's behalf, and browsing here discloses nothing to any third party.

Listing data on this site

Listing data is fetched from the Empire Flippers public marketplace API at build time, not from your browser. The listing and history files a page requests while you use it — the current inventory, and a watched listing's public observation history — are served from this site's own domain. Requesting them is an ordinary request to this site and is covered by the hosting section above; those files are public and identical for everyone.

Links to other sites

Where a page links to somewhere else — a cited source in a research article, a marketplace — following that link takes you onto a site Digital Deal Research does not control. Those destinations have their own privacy practices, their own cookies and their own tracking, none of which this policy covers.

The "View on Empire Flippers" link on a Business Brief can be a referral-tagged URL. When it is, Digital Deal Research's referral code travels as a parameter in the link itself, so Empire Flippers can attribute the visit under its own referral programme. Once you leave this site, Empire Flippers may set its own referral cookie or use other tracking, under its own policies. Digital Deal Research does not set, read or store that cookie, and no referral code, cookie or Empire Flippers identifier is written into this site's measurement dataset. Nor is any written into the attribution dataset: that referral attribution is a system run by Empire Flippers, separate from the distribution-link attribution described above.

contact@digitaldealresearch.com is a working mailbox, and it is the only place on this site where you can hand over personal data deliberately. Nothing asks you to write; if you do, what you send is your choice.

The mailbox is provided by Zoho Mail. Email therefore does not stay inside the web hosting described above: a message you send is delivered, stored and read through Zoho Mail's email infrastructure, which acts as a processor for the correspondence. What is processed is whatever the message contains — your address, your subject line, the body, any attachment, and the routing information every email carries.

Depending on where that infrastructure is operated, handling a message may involve processing outside the EEA. Where it does, the transfer safeguards in the provider's own data processing terms — including the standard contractual clauses where those apply — are what the transfer relies on. This page does not name a data centre, a sub-processor list or a certification, because those are the provider's to state and are subject to change.

Email is not a secure channel and this site cannot make it one. Please do not send confidential documents, financial records, identity documents or anything covered by an NDA to this address. If you need to reach the controller without sending personal detail, write with the question alone and leave the specifics out.

Cloudflare runs a global network, and a request is answered by whichever of its locations is nearest to you. A visitor in the EEA is normally served from within it, but requests and the security processing attached to them can be handled outside the EEA, including in the United States. Cloudflare's transfer arrangements for its customers, including the standard contractual clauses it relies on, are set out in its data processing addendum and its privacy policy.

Email is the other route, and it is covered in the section above: the mailbox provider's infrastructure may process correspondence outside the EEA, under that provider's own transfer safeguards.

Beyond those two, Digital Deal Research transfers nothing anywhere. The aggregate measurement and attribution events described above are held by Cloudflare as part of the same hosting. There is no user database, no customer records and no mailing list, so there is nothing else to export.

Where the GDPR applies to processing described on this page, you have the right to:

• Access — ask whether personal data about you is processed, and get a copy of it.
• Rectification — have inaccurate data corrected, or incomplete data completed.
• Erasure — ask for data to be deleted where the grounds for it apply.
• Restriction — ask that processing be limited while a dispute about it is resolved.
• Object — object at any time, on grounds relating to your situation, to processing based on legitimate interests. Every legitimate-interests entry in the table above is open to objection.
• Portability — receive data you provided in a machine-readable form, where that right applies. In practice the Buy Box, Watchlist and Compare data is already entirely in your own hands.

How to exercise them

Write to contact@digitaldealresearch.com and say what you want. No particular form of words is needed. There is no charge, and you will get an answer within one month; if a request is genuinely complex that can be extended, and you will be told if it is.

One honest limitation: this site keeps no account and no identifier for you, so for hosting and security records it usually cannot tell which entries relate to you without additional information from you that would itself be more data than it holds now. Where the operator cannot identify you from what it holds, it is not required to obtain extra data purely to do so, and will say so plainly rather than ask for it. Email you have sent is different — that is identifiable by the address you sent it from, and access, deletion and correction requests about it can be answered directly.

Please raise it with the operator first — most things on a page like this are a misunderstanding or a mistake that can simply be fixed, and there is no process to go through.

You do not have to, and you keep the right to lodge a complaint with a data protection supervisory authority regardless.

The operator is established in Estonia, so the supervisory authority for this site is the Andmekaitse Inspektsioon — the Estonian Data Protection Inspectorate. If you are in the EU or EEA you may equally complain to the authority in the country where you live, where you work, or where you believe the problem occurred; you are not obliged to use the Estonian one.

No postal address or web address is printed here for any authority, deliberately: those details change, and a wrong one on a complaints route is worse than none. The European Data Protection Board publishes current contact details for every national authority, Andmekaitse Inspektsioonincluded.

If something here is unclear, or you believe this page does not match what the site actually does, write to us and say so.

contact@digitaldealresearch.com

If you email us, we hold that email in order to reply to it. Email is not a secure channel — please do not send confidential or sensitive information to this address. Last updated: September 22, 2026.