Privacy Policy

1.Who we are and what this covers

ForgeOS is operated by ZAV (ForgeOS) ("we", "us"), the data controller for the personal information described here. You can reach us about any privacy request at hello@forgedeals.online.

We make software for creators and the people who work with them: finding people, running outreach, agreeing a revenue split and signing it. This policy explains how we handle personal information across everything we run:

• This website, including the Ask Forge chat.
• The ForgeOS app at forgecreators.vercel.app, the outreach workspace.
• The ForgeOS Chrome extension (listed in the Chrome Web Store as "FORGEOS Creator Clipper").
• Deal Rooms at forgedeals.online, including booking pages, Talk to Forge and phone alerts through the Android Forge Alarm app.

Forge Creators, our community, is billed and accessed through Whop, which is covered in section 5.

2.This website

The site does not use advertising or tracking cookies. It stores two small things in your own browser: your light or dark theme choice (in localStorage), and, while the tab is open, your Ask Forge chat history (in sessionStorage, cleared when you close the tab).

Ask Forge chat

Messages you type into the chat are sent to our server function (hosted on Supabase) to generate an answer, using the AI providers in section 6. To prevent abuse we keep a salted, one-way hash of your IP address and a count of requests, never the raw IP. Don't type passwords, sign-in codes, card numbers or other sensitive details into the chat.

Contact form

The contact form on this site does not send anything by itself. When you press the button, it opens your own email app with your message filled in, addressed to hello@forgedeals.online. Nothing is stored by the website. When you send that email, we receive it in our Gmail inbox and use it only to reply to you.

Hosting

Like any website, our hosting provider (Vercel) processes basic technical data such as IP addresses and request logs to deliver and secure the pages.

3.Your account

You sign in with your email address and a one-time code we email you. There are no passwords. To run your account we keep:

• Your email address, and in Deal Rooms your name, username and role (creator, monetized member, scout or admin).
• Your plan and membership status, checked with Whop.
• Your team membership, if an owner invites you to a workspace.
• Usage records for AI credits and audits (counts and dates).

Scouts and monetized members in Deal Rooms may upload a selfie and proof of monetization so they can be verified. Only the admin can see these.

4.What you put into ForgeOS

You enter and store outreach data: creator names, handles, public profile details, notes, message templates, images and tasks. This data is stored in our database, hosted by Supabase, inside your own workspace, so it is available in the app and the extension when you sign in.

Database rules make each workspace readable and writable only by its signed-in owner and the teammates that owner invites. Some preferences and drafts are also kept locally in your browser.

In Deal Rooms, files, chat messages, bookings, split agreements and signed contracts are stored for the members of that room. Each signature records who signed, when, their IP address, their device and a SHA-256 fingerprint of the exact text, and the final PDF includes an audit page.

5.Billing

Subscriptions are handled by Whop. When you subscribe, Whop processes your payment and gives us the minimum we need to verify your subscription: your email address, Whop user ID, membership ID, plan, status, renewal date, and payment IDs for credit-pack purchases.

We do not receive or store your card details. Whop's own privacy policy explains how they handle payments.

6.AI features

When you use an AI feature, the text needed for that task (for example a reply you want sorted, a message you want drafted, or profile details you paste for a scan) is sent through our server function to our AI providers:

• SenseNova, by SenseTime, our primary provider. Its servers may be outside your country, including in China.
• Anthropic (Claude), used as a backup when SenseNova is unavailable.

Your content is sent only to generate that output. It is not used to train their models and not used for advertising. We record a usage count so we can apply your plan's credit limit. Please don't paste sensitive personal data you don't want processed.

Agents run in approve mode, where they draft and you press send, unless you switch a conversation or agent to automatic sending. Money, contract and call questions are always handed back to you.

7.The Shared Replies pool

The ForgeOS app includes Shared Replies, a library of reply patterns visible to every subscriber. When the AI drafts a reply for you, it may add a paraphrased, generic version of the pattern to this pool without a separate approval step, so every operator benefits from replies that work.

What the pool stores: the category (for example "not interested" or "busy"), the message kind (DM, follow-up or email), a paraphrased description of what was said, the reusable reply text, and the email address of the operator whose reply it came from.

What it does not store: the creator's real name, handle, profile link, product names, direct quotes, or anything else that would let someone recognise the original conversation. The AI is instructed to strip these before an entry is added.

If an entry leaks identifying information, tell us and we will hide it. If you would rather your replies never contribute to the pool, email us and we will opt your account out.

8.The Chrome extension

The optional extension reads information from Instagram, TikTok, Whop and Social Blade pages that you actively open (such as a public handle, display name, follower count, bio and profile link) when you use it, so you can save that person to your pipeline. It does not collect your browsing history and does not run in the background collecting data.

You sign in to the extension with your email and a 6-digit code. It keeps your sign-in session and settings in Chrome's extension storage. People you save go to your workspace (section 4). The extension also passes message drafts between the ForgeOS app tab and the page you are on.

Chrome Web Store Limited Use

Our use of information received from the extension follows the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide the extension's features. We do not sell it, do not use or transfer it for advertising, credit-worthiness or lending, and do not let people read it except with your permission, for security, or where the law requires.

9.Instagram, when you connect it

In Deal Rooms you can connect your own Instagram Business or Creator account through Instagram's official login. We ask only for instagram_business_basic and instagram_business_manage_messages.

• What we receive: your account's ID, username, name and account type; an access token (stored encrypted); and the direct messages sent to and from that account: the text, the sender's Instagram ID, username and name, the time, and links to any media.
• Why: so replies from creators appear in your inbox, so you can answer them from Deal Rooms, and so you get notified. If you turn it on, the AI drafts replies for you to approve.
• Who can see it: only you, signed in to your own account. Other members and the admin cannot read your messages.
• What we never do: sell Instagram data, use it for ads, post on your behalf, or message people who haven't written to you within Instagram's 24-hour reply window. We follow Meta's Platform Terms and Developer Policies.

10.Gmail, when you connect it

Scouts and monetized members can connect their own Gmail so outreach emails and follow-ups go out from their own address. We ask Google only for permission to send email for you (gmail.send) and to see your email address (openid, userinfo.email). We do not request, and cannot use, any permission to read, search, label or delete the emails in your inbox.

• What we store: an access and refresh token from Google, encrypted (AES-256-GCM); the Gmail address it belongs to; your time zone; and the emails we sent for you (recipient, subject, text, whether you or the AI wrote it, and when it was sent).
• Replies: each email carries a Reply-To address on our reply domain, so a creator's reply reaches ForgeOS through our email provider, Resend, not through your Gmail. We store the reply and the original email so the conversation shows in Mails and on the creator's profile.
• Who can see it: your outreach emails and replies are private to you. The admin sees only counts per scout (for example how many emails were sent and how many replies came back), never the content.
• AI: reply text may be sent to our AI providers (section 6) to sort it and, if you ask, to draft or polish an answer. AI-written replies go out only when you ask for it or switch on autopilot for that conversation. Autopilot is off until you turn it on.
• Stopping: disconnect Gmail at any time in Mails (we revoke the token with Google and delete it), or remove ForgeOS at myaccount.google.com/permissions. Every email can be stopped with the unsubscribe button in the recipient's email app, or by replying "stop". People who unsubscribe are never emailed again.

Google API Services Limited Use

ForgeOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail access only to send the emails you or your automation ask us to send. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your permission, for security, to comply with the law, or where it is aggregated and anonymised for internal operations.

11.Booking pages and Zoom

When someone books a call on a Deal Rooms booking page (for example forgedeals.online/book/zav), we collect the name and email address they enter and the time slot they pick. A 40-minute Zoom meeting is then created automatically.

To create it, we send Zoom the meeting title (which includes the booker's name), the start time and the duration. The join link is shown on the booking page and sent to both sides. If a booking is cancelled, we delete the meeting in Zoom. Zoom's own privacy policy covers what happens during the call.

12.Phone alerts, Forge Alarm and Talk to Forge

Phone alerts are off unless you turn them on. If you do, we store the phone number you save, and when a hot lead replies an automated voice call, placed through Vapi and Twilio, reads the creator's message and the suggested reply to you. You can switch calls off in Settings at any time. Push notifications go to the devices you allow.

Forge Alarm, the Android app downloaded from inside Deal Rooms, rings your phone like a call from "Forge" and reads out who replied, even when the phone is locked. It uses your Deal Rooms sign-in and the alerts described above.

Talk to Forge is a voice conversation with the AI in your browser. Your voice and the conversation are processed by Vapi to run the call, and the AI can look at the conversations you ask it about. It uses your microphone only while a call is open.

We keep short call summaries with your conversation history (section 16).

13.Technical data

We collect basic technical information needed to run and secure the services, such as server logs, error reports and request counts. Our logs never contain access tokens or full message text.

14.Who processes data for us

We rely on these providers. Each gets only what it needs to do its part, under its own privacy terms.

15.Sharing

We do not sell your personal information, and we do not share it for advertising. Inside Deal Rooms, what you post in a room (chat messages, files, the split and the contract) is visible to the members of that room. We may disclose information if the law requires it, or to protect the safety and security of our users and services.

16.Keeping and deleting data

• Access tokens for Instagram and Gmail are deleted right away when you disconnect. Removing ForgeOS in your Instagram or Google settings also stops our access.
• Workspace data, messages, drafts, alerts and call summaries are kept while your account is active, so you keep your history. They are deleted within 30 days of a deletion request, or after your account is closed.
• Signed contracts and subscription records are kept as long as needed for the agreement, billing and legal obligations.
• Data in your browser stays until you clear it, sign out or uninstall the extension.
• Creators who messaged a member can ask us to delete their messages: email us with your Instagram username or email address. People who ask to stop are kept only on a do-not-contact list, so they are never messaged again.

To delete everything: email hello@forgedeals.online from the address you sign in with, subject "Delete my data". We reply within 7 days, delete your account, connected-account tokens, messages, drafts and uploads within 30 days of the request, and email you when it's done.

17.Security

Data travels over HTTPS. API keys stay on our servers and never ship in the app. Instagram and Gmail tokens are encrypted on our servers and never sent to your browser. Database rules limit each member to their own workspace and conversations. No method is perfectly secure, but we work to protect what you trust us with.

18.Your choices and rights

You can edit or delete the people and records in your workspace at any time, disconnect connected accounts, turn off phone alerts and autopilot, and remove the extension's data by signing out or uninstalling it.

Depending on where you live, you may have the right to access, correct, export or delete the personal data we hold about you, or to object to how we use it. Email us and we will help. We answer within 7 days.

19.Children

ForgeOS and Deal Rooms are for people aged 18 or over. We do not knowingly collect data from children.

20.Changes and contact

We may update this policy. Changes are posted here with a new date, and if a change affects how we use your data, we tell you in the app before it applies.

Questions or requests for ZAV (ForgeOS), the data controller: hello@forgedeals.online. We answer privacy requests within 7 days and delete account data within 30 days of a deletion request.