Privacy Policy

1. Information We Collect

Personal Information

We collect information you provide directly to us, including:

• Name, email address, and contact information
• Account credentials and authentication data
• Business information and preferences
• Communication records and support inquiries

Advertising Platform Data

When you connect your advertising accounts (Google Ads, Facebook Ads), we access:

• Campaign performance metrics and statistics
• Ad spend, impressions, clicks, and conversion data
• Account structure and campaign organization
• Audience insights and demographic information (aggregated)

Automatically Collected Information

• Usage patterns, session duration, and feature utilization
• Device characteristics, browser type, and operating system
• IP address, geographic location (general), and time zone
• Referral sources and navigation paths

Data We Process on Behalf of Our Customers (Lead and Visitor Data)

DealOracle is a marketing-attribution platform used by businesses ("Customers"). To provide the service, our Customers connect their advertising accounts, their CRM systems, and their landing pages, and they may install our tracking SDK on their websites. Through these connections we collect and process personal information about our Customers' own leads, contacts, and website visitors ("Lead Data"). For Lead Data, the Customer is the data controller and DealOracle acts as a data processor (or service provider) that processes Lead Data only on the Customer's documented instructions.

Lead Data may include: name, email address, phone number, postal address, city, state, ZIP or postal code, country, and, where the Customer provides them, date of birth and gender. From website visitors we may also collect an anonymous visitor identifier, session identifier, IP address, browser user agent, page URL and referrer, device and timezone signals, advertising click identifiers (such as Google gclid, Meta fbclid, and equivalents for TikTok, Microsoft, Snapchat, Pinterest, LinkedIn, Reddit, and X), Meta browser cookies (_fbp and _fbc), and UTM campaign parameters.

We connect to the following lead and CRM sources on a Customer's behalf: GoHighLevel (LeadConnector), HubSpot, Salesforce, Pipedrive, Podio, Unbounce, and Heyflow.

If you are a lead or visitor and wish to exercise your privacy rights, please contact the business you interacted with, who is the controller of your data. We will assist that business in responding to your request. You may also contact us at [email protected] and we will route your request to the relevant Customer.

2. How We Use Your Information

Service Provision

• Authenticate access and maintain account security
• Process and analyze advertising performance data
• Generate reports, insights, and recommendations
• Facilitate data synchronization across platforms
• Provide customer support and technical assistance

Business Operations

• Improve service functionality and user experience
• Conduct research and development activities
• Prevent fraud, abuse, and security vulnerabilities
• Comply with legal obligations and industry standards
• Process payments and manage subscriptions

3. Information Sharing and Disclosure

We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information to third parties for monetary consideration.

Limited Sharing Circumstances

• Service Providers: Trusted vendors who assist in service delivery under strict confidentiality agreements
• Legal Requirements: When required by law, court order, or regulatory authority
• Business Protection: To protect our rights, property, and safety, or that of our users
• Business Transfers: In connection with mergers, acquisitions, or asset transfers (with prior notice)
• Consent: When you explicitly authorize specific disclosures

Sub-Processors

We rely on the following third-party processors to operate our service. Each processes personal data only as needed for its function and under its own data-processing terms:

• Supabase: application database, authentication, and storage
• Vercel: website hosting and performance analytics
• Stripe: payment processing and affiliate payouts
• Google (Analytics and Ads): usage analytics and advertising conversion measurement
• Meta (Facebook): advertising and conversion measurement
• TikTok: advertising conversion measurement
• Microsoft (Advertising and Clarity): advertising conversion measurement and anonymized usability analytics
• Snapchat: advertising conversion measurement
• Pinterest: advertising conversion measurement
• OpenAI: advertising conversion measurement

When a Customer connects a lead source, we also process Lead Data through that Customer's chosen CRM or landing-page provider, which may include GoHighLevel (LeadConnector), HubSpot, Salesforce, Pipedrive, Podio, Unbounce, or Heyflow. These act as the Customer's own integrations rather than as our sub-processors, and the Customer's agreement with each provider governs that processing.

"Sharing" for Advertising (California)

While we do not sell personal information for monetary consideration, our use of advertising and analytics cookies may constitute "sharing" for cross-context behavioral advertising under the California Privacy Rights Act (CPRA). You can opt out at any time using "Your Privacy Choices" or "Manage cookies" in our website footer.

4. Third-Party Platform Integration

Google Ads API Integration

• We access Google Ads data solely for performance reporting and analysis
• Data is processed in accordance with Google API Services User Data Policy
• We do not modify your Google Ads campaigns or settings
• You can revoke access at any time through your Google Account settings

Facebook Marketing API Integration

• We access Facebook Ads data for reporting and optimization insights
• Compliance with Facebook Platform Policy and Terms of Service
• Data usage limited to authorized business purposes
• Access can be revoked through your Facebook Business Manager

5. Data Security and Protection

Security Measures

• Industry-standard encryption for data transmission and storage
• Multi-factor authentication and access controls
• Regular security audits and vulnerability assessments
• Employee training on data protection protocols
• Incident response procedures and breach notification systems

Hashing of Personal Identifiers

Before we transmit personal identifiers to advertising platforms for conversion measurement, we apply one-way SHA-256 hashing to email addresses, phone numbers, names, and, where used, postal fields, date of birth, and gender. Hashing is performed after normalization (for example, lowercasing and trimming) so that the advertising platform receives an irreversible token rather than the raw value. Certain technical match signals that the advertising platforms require in plain form, such as advertising click identifiers, the IP address, and the browser user agent, are transmitted as provided, in line with each platform's published specification. Customers may suppress demographic fields (such as date of birth and gender) from this transmission.

Data Retention

We retain personal information only as long as necessary for:

• Providing ongoing services and support
• Meeting legal and regulatory requirements
• Resolving disputes and enforcing agreements
• Legitimate business purposes (typically 7 years maximum)

6. Your Privacy Rights and Choices

Access and Control

• Access: Request copies of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal data (subject to legal requirements)
• Portability: Receive your data in a structured, machine-readable format
• Restriction: Limit processing of your information
• Objection: Object to processing based on legitimate interests

Communication Preferences

• Unsubscribe from marketing communications at any time
• Manage notification settings within your account
• Choose data sharing preferences for analytics

Your Rights in the EEA, the UK, and Switzerland (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and equivalent laws: the right to access your personal data, to rectify inaccurate data, to erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority.

Where DealOracle is the controller (for example, account, billing, and marketing data about our own users), our legal bases for processing are: performance of our contract with you, your consent, compliance with legal obligations, and our legitimate interests in operating and securing the service. Where DealOracle processes Lead Data on behalf of a Customer, the Customer is the controller and is responsible for establishing a legal basis, and we process that data only under our data-processing agreement with the Customer.

7. Cookies and Tracking Technologies

Types of Cookies

• Essential: Required for basic site functionality
• Performance: Help us understand site usage patterns
• Functional: Remember your preferences and settings
• Analytics: Measure and improve site performance

Managing Cookies

You can control cookies through your browser settings, though this may affect site functionality.

8. International Data Transfers

Your information may be processed in countries other than your residence. We ensure appropriate safeguards are in place, including:

• Adequacy decisions by relevant authorities
• Standard contractual clauses approved by regulatory bodies
• Certification schemes and codes of conduct
• Binding corporate rules for intra-group transfers

9. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware of such collection, we will take immediate steps to delete the information.

10. Affiliate Program & SMS Communications

If you apply to or participate in our affiliate program, we collect the information you provide in the application — including your phone number, your social media accounts (such as Instagram or YouTube handles), any message you send us, and technical details such as your IP address and browser — as well as records of our communications with you.

How We Use It

• To review and verify affiliate applications and decide whether to admit you
• To contact you about your application and to administer the affiliate program
• To set up and process commission payouts through our payment provider (Stripe)
• To detect and prevent fraud, abuse, and policy violations

SMS / Text Message Consent

By providing your phone number and submitting an affiliate application, you consent to receive calls and SMS/text messages from us regarding the affiliate program, including onboarding and ongoing communication. Message and data rates may apply, and message frequency varies. Consent is not a condition of any purchase. You can opt out of text messages at any time by replying STOP, or contact us at [email protected]. We do not sell your phone number, and we do not share it with third parties for their own marketing.

Retention

We retain affiliate application and communication records for as long as needed to administer the program and as required for legal, tax, and recordkeeping purposes.

11. Email Marketing Communications

We may send promotional and marketing emails — such as product updates, tips, offers, and newsletters — to people who have a relationship with us, including account holders, trial users, demo requesters, affiliates, and individuals who have otherwise provided their email address to us or engaged with our services.

Legal Basis & Consent

• We send marketing email on the basis of your consent and/or our legitimate interest in promoting our services to existing and prospective customers.
• Where required by law, we obtain your consent before sending marketing communications.
• Marketing emails are separate from transactional and service messages (such as security, billing, and account notifications), which you cannot opt out of while you hold an account.

Your Choices

• Every marketing email includes a one-click unsubscribe link and a list-unsubscribe header.
• You can opt out at any time, and we honor unsubscribe requests promptly. Once unsubscribed, you will no longer receive marketing email from us.
• You may also contact us at [email protected] to update your communication preferences.
• We do not sell your email address or share it with third parties for their own marketing.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will:

• Post the updated policy on our website
• Update the "Last Modified" date
• Notify users of material changes via email or account notification
• Provide a 30-day notice period for significant changes

13. Contact Information

For questions about this Privacy Policy or our data practices, please contact us:

DealOracle (Supreme Score LLC)

Email: [email protected]

Address: 1944 Whitley Ave, Los Angeles, CA 90068

We will respond to inquiries within 30 days and provide assistance in your preferred language where possible.