1. Introduction
This policy describes data flows verified in the OfferSpy AI application source and identifies operational details that still need owner confirmation. It applies to the application and its public pages, not to independent third-party sites. It is not a certification of compliance with GDPR, CCPA or any other privacy law.
The legal operator is not yet confirmed. Policy dates and privacy contact details require confirmation before final publication.
2. Information We Collect
Account features process your email address, authentication information, user identifier, profile and purchase-based access status. The authentication service handles account credentials; passwords are not requested in research or support messages.
Saved application records include submitted offer URLs or text, extracted offer facts, analyses, buyer insights, promotional angles, campaigns, edited assets, usage records, automation plans, promotion links and workflow status. Agency features also store submitted client names, companies, contact information, branding, project details, internal notes, reports, deliverables and revisions.
The purchase notification handler accepts WarriorPlus buyer email, product identifiers, transaction ID and action. It stores purchase status and the received notification fields after removing the security-key fields. Additional notification fields depend on the actual payload sent by WarriorPlus. These records support access and refund handling.
Requests and error diagnostics may contain submitted URLs, failure categories and technical request information. Exact hosting log fields, access rules and retention require confirmation.
3. Information Users Submit to AI Features
For analysis, the server retrieves public page text from a submitted URL or processes pasted offer text. Relevant source material is sent to the AI service. Campaign, deployment and agency workflows send relevant offer, buyer, angle, campaign or client context needed for the requested output.
Only submit material you are authorized to process. Avoid passwords, payment-card data, sensitive personal information and confidential client material that you do not have permission to share with service providers. The app does not independently certify the truth or rights associated with submitted material.
4. How Information Is Used
Information is used to authenticate accounts, match purchases to access, provide and save research outputs, generate requested campaign material, organize client workflows, manage revisions and secure review links, and diagnose service errors. Purchase reversals can update product access.
The application source does not implement a newsletter subscription or bulk marketing-email system. Any separate business marketing practices require disclosure if adopted. No claim about all off-platform business practices is made here.
5. AI Providers and Third-Party Processing
The application sends AI requests through the Lovable AI Gateway. The configured model inspected for this draft is supplied by Google; model selection may change. Inputs are processed externally to generate the requested outputs. AI requests can include relevant submitted and saved context.
Source inspection does not establish provider-side retention, model-training use, regional processing, contractual safeguards or deletion behavior. No promise that AI inputs are never retained or used for training is made. The owner must verify the applicable provider terms before finalizing this policy.
6. Cookies and Analytics
Authentication sessions persist in browser local storage and are refreshed by the authentication client. Embedded Lovable previews may use an origin-checked session-storage bridge to the editor. Authenticated application requests use a bearer token. These mechanisms are separate from a marketing cookie.
No dedicated analytics SDK or explicit application-cookie implementation was identified in the inspected source. This does not establish that hosting, third-party checkout, embedded media or sales scripts use no cookies or analytics. WarriorPlus scripts and checkout images load on their matching sales pages. An external demo embed may load when configured; fonts load from Google Fonts.
Third-party services receive requests when their content is loaded and may process technical request data or use tracking under their own policies. A complete deployed cookie inventory, analytics settings and any legally required consent controls remain to be reviewed. Browser settings may restrict storage or tracking, but blocking essential storage can affect sign-in.
7. Payment Processing Through WarriorPlus
Checkout takes place through WarriorPlus. OfferSpy AI's purchase handler receives purchase notifications rather than operating a payment-card entry form. It uses buyer email and transaction/product details to grant or remove purchased access. Review WarriorPlus's privacy information for its payment, fraud-prevention and referral processing.
The inspected code does not intentionally request payment-card numbers. Because notification fields are stored after removing security-key fields, the owner should confirm the exact live notification payload and limit it to information needed for purchase administration.
8. Data Sharing and Service Providers
Verified integrations include: Lovable Cloud (hosting, authentication and saved application data); Lovable AI Gateway (AI requests); WarriorPlus (checkout, purchase notifications and affiliate services); Jina AI Reader (fallback retrieval of submitted public URLs); Google Fonts (font delivery). Other configured demo-video hosting may also receive requests. Google supplies the model currently configured behind the AI gateway.
These services process data for the relevant hosting, authentication, generation, retrieval, payment or display function. When direct page retrieval fails, the submitted public URL is sent to Jina AI Reader for fallback extraction. The source site also receives retrieval requests.
Agency users can create token-based review links that disclose the selected client-facing report or deliverable to anyone possessing a valid link. Protect review links and share them only with intended recipients; they are not client logins to the application.
Provider contractual terms, subprocessors, processing locations and any legal disclosure obligations require owner confirmation. No blanket claim that data is never sold or shared for any other business purpose is made without a verified operational review.
9. Data Storage and Security
Application data is saved in Lovable Cloud. Account-scoped access rules and server-side entitlement checks are implemented for protected records; private credentials are used server-side rather than placed in public form code. Review access uses scoped tokens. No system can guarantee absolute security.
Backup arrangements, encryption guarantees beyond provider documentation, staff access, incident procedures and the live configuration require owner confirmation. Do not interpret source-level controls as an independent security certification.
10. Data Retention
A specific retention schedule has not been confirmed. Saved research, campaign, client and purchase records remain in the service unless removed through applicable operations; no automatic expiry policy for all records is established by this draft. The owner must define retention for account data, purchase records, logs, backups, support messages and AI-provider processing, including any legally required retention.
11. User Privacy Rights
Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction or information about your data. The scope, exceptions and verification requirements depend on the applicable rules. This policy does not claim that every legal right applies in every jurisdiction.
Use the Contact page for current request availability. A verified privacy contact and an operational request-handling process still require owner confirmation. Account ownership may need to be verified before releasing or changing records; do not send your password.
12. International Data Transfers
External hosting, AI, page-retrieval and payment services may process information in locations outside your country. Specific regions, cross-border transfer arrangements and contractual safeguards have not been verified. These details require owner review; no adequacy or transfer-compliance claim is made here.
13. Children's Privacy
OfferSpy AI is a business-oriented research tool and is not designed for children. Users should have the legal capacity required by the applicable terms. The owner must confirm any minimum-age requirement and child-data response procedure; no unsupported statutory age threshold is assumed. If you believe a child has submitted personal data, use the current contact options to raise the issue.
14. Changes to This Privacy Policy
Updates should describe material changes in actual processing and display confirmed effective and last-updated dates. Additional notice or consent may be necessary where applicable law requires it. Review the policy when using new features.
15. Contact Information
support@gt5marketing.com
The contact form currently validates input and checks server-side availability, but it does not store submissions or send messages because delivery is unconfigured. Valid input is transmitted to the server for that check. This disclosure must be updated when delivery is activated.