Privacy Policy

Last updated 16 October 2026

Deal Rooms is part of ForgeOS. It helps scouts and brand members talk to content creators and turn those conversations into deals. This policy explains what we collect, why, and how you can have it deleted.

1. Your account

To sign you in we keep your email address, your name and username, your role, and your membership status (checked with Whop, our billing provider). Scouts and monetized members may upload a selfie and proof of monetization for verification; only the admin can see these.

2. Instagram (when you connect an account)

You can connect your own Instagram Business or Creator account through Instagram's official login. We ask only for instagram_business_basic and instagram_business_manage_messages.

• What we receive: your account's ID, username, name and account type; an access token (stored encrypted); and the direct messages sent to and from that account — the text, the sender's Instagram ID, username and name, the time, and links to any media.
• Why: so replies from creators appear in your Deal Rooms inbox, so you can answer them from Deal Rooms, and so you get notified about them. If you turn it on, an AI assistant drafts replies for you to approve.
• Who can see it: only you, signed in to your own account. Other members and the admin cannot read your messages.
• AI: message text may be sent to our AI providers (SenseNova, with Anthropic as a backup) only to sort replies and draft answers. It is not used to train their models and not used for advertising.
• What we never do: sell Instagram data, use it for ads, post on your behalf, or message people who haven't written to you within Instagram's 24-hour reply window. We follow Meta's Platform Terms and Developer Policies.

3. Gmail (when you connect an account)

We ask Google only for permission to send email for you (gmail.send) and to see your email address (openid, userinfo.email). We cannot read, search or delete anything in your inbox.

• What we receive: your Gmail address and an access token (stored encrypted). We keep a copy of the emails you send through Deal Rooms and the replies creators send back to them, so the conversation shows on the creator's profile.
• Why: only so the emails you write or approve in Deal Rooms are sent from your own Gmail address.
• Limited Use: Deal Rooms' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't sell Google user data, use it for advertising, let people read it (except with your permission, for security, or when the law requires), or use it to train AI models.

4. Service providers

We use Supabase (database and server functions), Vercel (hosting), Whop (billing), Resend (email), Meta and Google (only for the accounts you connect), SenseNova and Anthropic (AI), and, only if you turn on phone alerts, Vapi and Twilio (the call reads a creator's message and the suggested reply to you). Each gets only what it needs to do its part, under its own privacy terms.

5. Security

Data travels over HTTPS. Instagram and Gmail access tokens are encrypted on our servers and never sent to your browser. Each member can only read their own conversations; our logs never contain access tokens or full message text.

6. Keeping and deleting data

• Access tokens: deleted right away when you disconnect Instagram or Gmail in Deal Rooms. Removing ForgeOS in your Instagram or Google settings also stops our access.
• Messages, drafts, alerts and call summaries: kept while your account is active so you keep your conversation history. Deleted within 30 days after you ask us to delete your data or your account is closed.
• Creators who messaged a Deal Rooms member: you can also ask us to delete your messages (email us with your Instagram username or email address). People who ask to stop are kept only on a do-not-contact list so they are never messaged again.

See how to delete your data.

7. Who can use Deal Rooms

Deal Rooms is for people aged 18 or over. We don't knowingly collect data from children.

8. Contact

Questions or requests: getforgeos@gmail.com. We answer within 7 days. If this policy changes in a way that affects how we use your data, we tell you in the app before the change applies.