1. Who we are

Oportunities (“Oportunities,” “we,” “us”) is operated by Anycast Technology Private Limited, an Indian company (GSTIN 06AARCA1577E1ZL), registered at WeWork DLF Two Horizon Centre, 5th Floor, DLF Phase 5, Sector 43, Golf Course Road, Gurugram, Haryana 122002, India. We are the data controller for the personal data described in this policy.

2. What data we access

We access only what Oportunities needs to find opportunities and send the pitches you approve. You grant each connection explicitly, and you can disconnect any of them at any time.

Google — Gmail

When you connect your Gmail, we request exactly three permissions — and nothing broader:

We do not request gmail.modify and we do not request the full-access https://mail.google.com/ scope. Because of this Oportunities technically cannot delete, archive, label, move or draft anything in your mailbox — that is a limit of what we asked for, not a promise about how we behave. It can only read, and send what you approve.

Signing in is a separate permission. Signing in with Google asks for your name and email address, so we can create your account. Signing in with Apple asks for the same two. Neither gives us any access to a mailbox — that is the Gmail connection above, and you grant it separately.

We do not connect to your Google Calendar, Drive or Contacts. We request no permission for any of them, and no part of the running product reads them.

How much we read. The permission we hold covers your whole mailbox, including the messages you have sent. Day to day it reads your inbox, going back up to 90 days from the day you connect, and new mail as it arrives; if you disconnect and connect again later, we look back over the time you were away, up to the same 90 days. While one of your invoices is unpaid, a payment-alert search looks for bank or payment-service credit alerts that match it, going back up to 120 days. Separately, a brand-collaboration search looks for past brand, sponsorship and collaboration conversations going back up to two years, and that search can read mail you sent — your own reply to a brand is often the only evidence the conversation happened at all. The day-to-day read of new mail also looks at mail you send that is about a brand collaboration or is an invoice, quotation, rate card, proposal, media kit or list of deliverables, so a deal you are running yourself is not missed. Oportunities also revisits a thread it has already sent an approved pitch into, to look for the brand’s reply.

In plain words. When you connect Gmail, Oportunities reads both the mail you get and the mail you send. It reads the mail you send only to learn how you work with brands — so it can spot the brands you already talk to and what you have agreed with them. Nothing leaves your account unless you say yes to it first.

WhatsApp and your phone number

Oportunities talks to you on WhatsApp. When you sign up you give us your mobile number, and we send a one-time code to it on WhatsApp to confirm it is yours. After that, WhatsApp is where the business manager tells you what it found, asks before it does anything in your name, and answers when you write to it.

• What we keep. Your phone number, stored encrypted, with a keyed fingerprint of it so an incoming message can be matched to your account. The messages you write to us and the ones we send you, so the manager remembers the conversation — before your text is stored, any email address in it is replaced. The message as WhatsApp delivered it to us, so we can process each one exactly once. A brand’s email you paste into the chat is read by the manager like anything else you send it. Its copy in that message record keeps the text as you sent it, including any email addresses in it, apart from card numbers, one-time codes and similar secrets, which are removed first. It stays while your account exists and is deleted with your account. It is a message from you, not mail we read from your mailbox, and it is not used to read your mailbox. A short running summary of the conversation and the facts you have told the manager, such as your usual rate.
• What it is used for. Only to run the business manager for you: telling you about brands and replies, asking your approval, and answering you. We do not use your number or your messages for advertising, and we do not add you to any list.
• Read by AI. The messages, voice notes and photos you send the business manager on WhatsApp are processed by the AI providers named in §6. Your messages, photos and documents go to Anthropic, and your messages go to OpenAI when it stands in for Anthropic. Your voice notes are turned into text by OpenAI. OpenAI keeps a copy of what we send it for up to 30 days, as §6 explains.
• How long. We have not set an expiry on the conversation yet, so it is kept while your account exists and removed when your account is deleted (§8). We would rather say that than quote a window we do not enforce.
• Meta. WhatsApp messages travel through Meta’s WhatsApp Business Platform. Meta acts on our behalf as a processor, keeps message content for up to 30 days to deliver it, and stores it encrypted (§7).
• Stopping it. You decide whether we message you. To stop, email support@oportunities.ai and we will stop. We are adding the ability to simply write STOP in the chat; until that is live, email is the route that works, and we will update this line when it changes.

We do not send you text messages (SMS). The sign-up code arrives on WhatsApp.

Instagram (optional)

If you connect Instagram, we read your own account through Meta's official Instagram API, with your separate consent on Instagram's own screen. We never scrape Instagram.

What we read

• Your profile: username, account type, follower count, post count and profile picture.
• Your posts and reels: the caption, the link, the type (photo, carousel, video or reel) and the date.
• How your posts do: the numbers Meta gives you in Instagram's own insights, such as reach, views, likes, comments, shares, saves and, for reels, average watch time.
• Your account totals: for example how many accounts you reached and how many views and interactions you had over the last month.
• Your audience, in groups only: the share of your followers by age group, gender, city and country, and the same for people who engaged with you. Meta only gives this for accounts with at least 100 followers, and only as totals. We never see who your followers are.

What we do not read

We do not read your messages, your follower list or who follows you, who you follow, your stories, other people's posts or anyone's private data. We do not look at your photos or videos themselves; we read only the text and numbers above.

What it is used for

Only to run the business manager for you: writing pitches that show brands your audience and how your posts perform, finding brands whose customers match your audience, advising you on what to charge, and understanding what you post about, so the manager knows you better. Your audience figures and post numbers may appear in a pitch to a brand. A pitch is only sent with your approval, so you see exactly what a brand will see first.

Read by AI

These details are processed by the AI providers named in the providers table below, in the same way as your messages to the manager. We do not use them for advertising.

How often and how long

While you are connected we read your account regularly so the numbers stay current. We keep what we read while your account exists.

Stopping and deleting

• Disconnect: remove Oportunities in Instagram’s own settings, as in the next point. We stop reading your Instagram at once. What we already read stays in your account, so reconnecting later does not lose your history, until you ask us to delete it.
• Delete your Instagram data: in Instagram, go to Settings, then Apps and websites, remove Oportunities and choose to delete your data. We delete everything we read from your Instagram and your connection to it, and Instagram shows you a confirmation code you can quote to us at support@oportunities.ai.
• Delete your account: removes everything, including all Instagram data.

Account & usage data

Your name, email, profile details you enter, and behavioral product analytics (which pages you open, which pitches you approve). Analytics are behavioral only — they never contain the content of your emails.

When your manager starts a conversation. For each message your manager sends you that you did not ask for, we keep a record of when it went out and whether you answered. The record holds identifiers and codes only, never the words of the message. If you ask us for your data (§9), this record is included.

Your deals and money

When the business manager handles a deal for you, it keeps what it needs to invoice the brand, chase the payment and track what you have been paid:

• Your invoicing details, as you give them to the manager: your legal name, postal address and country, your tax numbers (GSTIN, PAN, or a VAT or sales-tax number elsewhere), and where you want to be paid (a bank account with its IFSC or SWIFT code, or a UPI ID). They are stored encrypted.
• Invoices issued for your deals: the number, amount, currency, tax lines, dates, the brand it is addressed to, and the invoice PDF, stored encrypted.
• Payments on your deals: the amount, currency and date, which invoice it paid, how we learned of it, your confirmation, and any TDS the brand deducted (the amount and the rate).
• Payment reminders to the brand: which invoice, when each reminder was due and sent, on whose permission, and the address of the brand’s finance contact, stored encrypted.
• Expenses you tell the manager about: the amount, currency, date, category, your note, and the brand or deal it belongs to.

We use these only to run your deals for you. The same deletion and access rights apply to all of it (§8, §9).

The forms on this website

This website has two forms of its own — the brand waitlist and the creator application — and they are separate from your Oportunities account. If you fill one in, we keep what you typed (your email address, plus a brand’s web address, or your social handle and the short description you write) together with your IP address, the identification string your browser sends (which names your browser and device) and, on the waitlist form, the page you arrived from. That record is held in a database run by Cloudflare, who also serve this site, and a copy of it is emailed to our own team through Resend. That record does not sit in the AWS region named in §7 — it sits on Cloudflare’s network, and we have not restricted that database to a single region. Filling in either form gives us no access to any mailbox and creates no account.

3. Google user data & Limited Use

In plain language, that means:

• We use Google user data only to provide and improve the user-facing features you signed up for (noticing what brands would want to know about you, and sending the pitches you approve).
• Some things derived from Gmail are shared between creators. The addresses brands email from — a department mailbox like partnerships@thebrand.com, or a named person at the brand — go into a contact book creators draw on, so the pitch you approve reaches someone (§4, §6, §7). What is kept is the address, the brand, a person’s first name where the sender is a person, and which creator’s inbox it came from. No message, subject, snippet or attachment is kept for this. Two smaller things are also common to everyone rather than yours alone, and §6 names both: the shared lists of habit, wish and plan categories that Oportunities keeps, which grow a new entry when Oportunities meets a category they did not have — usually a category word, sometimes one carrying a place or a brand, never linked to you; and a processing cache that stops us paying to read the same email twice. Brands can see what I notice about you, once you confirm it. They cannot see anything you have not confirmed or have dismissed, and never the emails behind it. Brands use it to find creators and reach out with deals. You can remove anything you confirmed at any time.
• We do not use Gmail data for advertising of any kind.
• We do not sell or transfer Google user data to third parties, except as needed to provide the service (the subprocessors in §7), to comply with law, or as part of a merger you are notified of.
• We do not use your Google data to train generalised AI models. Our AI provider’s business terms state that data submitted through their business API is not used to train their models.
• Your mail is read by software, not by people — see §5. We do not allow humans to read Google user data unless we have your affirmative consent for a specific message, it is necessary for security/abuse investigation or to comply with law, or the data has been aggregated and anonymised.

4. How we use your data

• Notice things about you — Oportunities reads your inbox to detect upcoming plans, recurring habits, and wishes that brands would want to sponsor.
• Match brands — it matches what I notice about you to brands with the budget and the right contact, and scores the fit.
• Learn how to reach a brand — when a brand’s email arrives in your inbox, Oportunities keeps the address it was sent from and adds it to our brand contact book. That is either a department mailbox (partnerships@thebrand.com) or a named person at the brand, kept with their first name. The contact book is shared across creators on Oportunities, and we record which creator’s inbox each address came from. See §6 for what is taken and what is refused.
• Write pitches in your voice — it drafts outreach informed by what I notice about you that you confirmed, your profile and your niche.
• Send what you approve — no pitch is ever sent until you approve it. Oportunities then sends from your Gmail and follows up at most once; follow-ups and payment reminders also wait for your approval unless you have told your business manager it may send them for you. We keep a copy of every pitch we send on your behalf. Each one is blind-copied to our own mailbox (tracking@oportunities.ai). Why: Oportunities is writing to real companies in your name, and this is how we can see a badly-written pitch and fix it before a brand complains — which matters most now, while the product is new and few pitches have ever gone out. It also lets us confirm a pitch actually left and match a brand’s reply back to it. The copy contains the pitch exactly as sent: your name and sending address, the brand contact’s address, the subject and the body. The brand cannot see it — a blind copy is invisible to them. It is not a copy of your mailbox; only of the outreach you personally approved. Being straight about the limits of it: that mailbox is read by our team, we have not set it to delete copies after any period, and we have not restricted it to particular people. If we change either, we will say so here.
• Track results — it classifies brand replies so you can see when an opportunity is created.
• Spot payments — while one of your invoices is still unpaid, it looks for bank or payment-service credit alerts in your mail (up to 120 days back) that match it, and asks you whether that money was the brand’s payment. Nothing counts as paid until you say yes.
• Spot affiliate statements — it recognises statement and payout emails from a fixed list of affiliate networks (for example Amazon Associates, Impact, CJ, Awin, Cuelinks, EarnKaro, ShareASale, LTK) and asks you once whether to note the amount. Nothing is recorded as your income until you say yes.
• Keep your business records — expenses and affiliate income you tell your business manager about are kept so it can show them in your money summary.
• Spot payout statements — if your Gmail holds payout statements from platforms or affiliate networks, Oportunities reads only the sender, the subject and the short preview line of a mail to recognise it, and keeps a yes-or-no note that the message was one. It never keeps the text of the mail.
• Run your account — authentication, support, and security.

What we do with what the manager learns. The manager pools what it learns about brands across creators, never anything that identifies you. Your secure vault is encrypted and no one on the team reads it. Your private messages and personal details are not what a brand sees. We may offer aggregated insights to brands in future, and we will say so first.

5. No human reads your mail

The only narrow exceptions are: where you give us explicit permission for a specific item (for example, you send us a message while getting support); where it is strictly necessary to investigate abuse or a security incident, or to comply with applicable law; or where the data has been aggregated/anonymised so it is no longer about you. We never browse inboxes for any other reason.

Being precise about the edge, because a policy that claims perfection is not credible: our engineers can query the databases that hold the derived records described in §6 — under access controls, for debugging and support. A few of those records contain text taken from a message (a subject line, and the full text of a brand’s reply, which is held on both the reply record and the deal record — see §6). So the accurate statement is that nobody reads your mailbox, not that no employee could ever see any string that came from an email.

Your chats are different from your mail. A small review team can read the chats between you and your manager, to check that the manager is working and to fix it. Chats are masked when they are read (names, numbers, contact details and links are hidden), and every time one is opened it is logged. A message that raises a safety concern or a complaint may be read by the team so that we can act on it. If you do not want our team to read your chats, write to support@oportunities.ai. The Terms set this out.

The same precision applies to outgoing mail, and it is the bigger of the two: as §4 says, every pitch you approve is blind-copied to our tracking mailbox, and that is a real mailbox our team can open. So a pitch you sent is a message an employee could read. That is a copy of your own outbound message, which you approved before it went — never anything a brand sent you, and never anything else in your inbox. We would rather you knew that than discover it from a mail header.

There is a second edge, and it is not about our staff at all: once we switch on the second AI provider named in §6, a person at that provider may be able to see text that came from your mail. Not by browsing your mailbox — nobody outside Oportunities can reach it — but because that provider keeps a copy of what we send it for a period, and may have a person look at it when their own systems flag something. §6 sets out exactly what is kept, for how long, and why. We are putting it here as well because the heading above this section is a promise, and a promise that quietly depends on which supplier we happen to be using is not one.

6. AI processing

Oportunities uses AI models to notice things about you, classify replies, and write pitches. The AI providers that handle this work are Anthropic and OpenAI. Either may handle any given piece of it. We may add other AI providers. Any provider we use is listed in §9 before it handles anything, with what it keeps and whether a person there may see it — and whichever provider handles your data, the bound below is the same and does not change. We do not list the individual models. Moving to a newer or faster model from a provider already listed changes nothing in this section and is not announced. Every one of them is called through its business API. What we send is bounded: a message’s sender, its subject, a short snippet, and a limited portion of its text — enough to judge whether it is a brand-worthy moment and to pull out the structured facts. Where a message carries a PDF that the text alone does not explain (a ticket or a booking confirmation, for example), that PDF may also be sent for the same purpose. We do not send your whole mailbox and we do not send your contacts. Your WhatsApp conversation with the business manager is different: what you send there goes to the AI as you sent it, not cut down to a snippet (§2).

Anthropic’s business API terms state that data submitted through it is not used to train their models. OpenAI’s API terms state the same: data submitted through their API is not used to train their models by default. We will not add an AI provider whose terms permit training on your data.

On OpenAI, stated plainly rather than buried. From your mail, OpenAI receives the same bounded material described above and nothing more — never your whole mailbox, never your contacts. It also turns your WhatsApp voice notes into text, and handles your WhatsApp messages when it stands in for Anthropic (§2). We name every provider here before it handles anything rather than after, because that is what this policy promises in §7, so a provider appearing in this policy does not by itself tell you it is carrying your data at this moment. If you want to know which provider handled your data at a given moment, ask us at support@oportunities.ai and we will tell you.

OpenAI keeps a copy of what we send them for up to 30 days. This is the part of the change we would least like to be true, so it is stated here rather than left for you to find. OpenAI’s published policy is that content sent to their API is written to abuse-monitoring logs and kept for up to 30 days — and for longer where the law requires it, or where OpenAI reasonably needs it to protect their service or someone else from harm. So “up to 30 days” is their normal case, not a hard ceiling, and we would rather quote it that way than round it into a promise they have not made. Those logs can contain the prompts we send and the answers that come back. What we send is drawn from your mailbox — a sender, a subject, a snippet, a limited portion of a message’s text, and sometimes an attached PDF — and from your WhatsApp conversation: your voice notes, and your messages when OpenAI stands in for Anthropic. Where OpenAI handles it, that material sits on OpenAI’s systems for that period as well as passing through ours. It is used to detect misuse of their API, and OpenAI’s terms state it is not used to train their models.

And a person at OpenAI may read it. OpenAI states that content held in those logs can be reviewed by people — authorised OpenAI staff, and specialist contractors under confidentiality obligations — where their automated checks flag something as possibly breaking their usage rules, or where the law requires it. That is a much narrower thing than someone opening your mailbox, and it is nobody at Oportunities. But it is a human being able to see text that came from your mail, and §5 would not be honest without it.

There is a setting that switches this retention off, and we do not have it. OpenAI offers zero data retention, under which they keep nothing. It is not something a customer can simply turn on: OpenAI has to approve it, and they have not approved it for us. We are going ahead without it. We would rather tell you that plainly than describe a protection we do not hold. If we obtain it, this page will say so. Note also that §7 says no provider may use your data for their own purposes — this abuse monitoring is the one exception, it is OpenAI’s own safety obligation rather than anything we ask for or gain from, and none of it changes what we send: the bound described at the top of this section is the same for both providers.

What we keep, and what we do not

We do not keep a copy of your mailbox. This is about the mail we read from your connected mailbox; an email you paste into the WhatsApp chat is a message you send, and what we keep of it is described in §2. Mail read from Gmail is fetched from Gmail, held in memory while the software processes it, and discarded when processing finishes. What we keep from it is only what is listed in this section: for example the replies brands send to pitches you sent (their subject line and their full text), the facts the manager learns, and the short structured results described below. The rest of a message, its other text and its attachments, is not written to our database, not written to files, and not written to our logs. Where we cache something about a message so we do not pay to process it twice, the message is looked up by a one-way cryptographic fingerprint — the cache never stores the message itself. What is stored against that fingerprint is the same short structured result described below (for example the product and brand the email was about). The cached result is keyed by the message, not by you, so two creators who receive the same email share one row. Alongside it we keep an index of which creators’ mail produced each row. That index holds a creator id and the message fingerprint — no name, no address, no message text. Deleting your account deletes that index and the cached results your mail produced. A cached result stops being used after 30 days. It is not deleted at that point: the job that removes expired rows is built and is not switched on.

What we do keep is the derived, structured intelligence Oportunities needs — for example “travels to Goa in July” or “works with skincare brands” — plus your confirmations, the matches and pitch drafts, a record of which brand contact was emailed and when, and a content-free thread index so we do not re-read the same mail.

What creators learn together. Deals closed on Oportunities teach the business manager what brands tend to pay and how they behave. That knowledge is shared between creators as anonymous figures only, never as any creator’s own numbers, and only when at least five creators stand behind a figure. Your rates, your fees and your deals are never shown to another creator.

One thing that comes out of this is common to everyone: Oportunities keeps shared lists of habit, wish and plan categories, and when it meets a category those lists do not yet have, it adds an entry so the next creator can be matched on it too. Most are ordinary category words — “Coffee”, “Pizza”, “Groceries”. Some are more specific and can carry a place or a brand, because the entry is built from the label Oportunities worked out — “Mussoorie Getaway”, for example. They are never a sentence from your mail, and none of them is linked to you: a reader of that list cannot tell which creator it came from. Your own entries stay yours and are deleted with your account. The shared lists are not.

Seven narrow exceptions:

• Subject lines. Where a message reaches us through Gmail’s live notification rather than a scan, we keep the first 60 characters of its subject as the label your manager shows you for it. On the scan path we do not keep the subject: that label is a sentence written from the thing noticed itself.
• Brand replies. When a brand replies to a pitch you sent, we keep what the brand wrote back: the reply’s subject line and its full text (the brand’s own words, with quoted earlier mail and the signature cut, and postal addresses, personal email addresses and phone numbers replaced), kept in full until you delete your account, so your manager can show it to you, and so the software can tell an interested reply from a bounce or an out-of-office. When a reply turns into a live conversation, that reply is also kept on the deal record for that conversation, so it exists in two places rather than one. We also keep the address the reply came from, so we can tell which conversation is which. The address itself is stored encrypted, and only its domain is held in plain text.
• The address a brand emails from. When an email in your inbox comes from a brand we already track, we keep the address it was sent from and add it to a brand contact book that creators share. We do not keep that message, its subject or its contents. A department mailbox — partnerships@, collabs@, influencers@, press@ and similar — is kept as an address. A named person at the brand is kept as an address and a first name, taken from the From: line. What is refused: any personal mail provider (Gmail, Yahoo, Outlook and the like), your own address, automated senders (no-reply@), transactional mailboxes (orders@, billing@), and any address we cannot tie to exactly one brand we already track. We store the address encrypted and show it to you masked. We record which creator’s inbox each address came from. That record is the address, the brand, the creator and the date; it holds no message, subject, snippet or attachment. It is deleted when you delete your account. The address itself is not — see §8.
• What the manager guesses from your mail. When your mail suggests something about you, for example that you work with a certain kind of brand, we keep it as a guess, not as a fact. A guess stays in use while it keeps coming up, and it is not used after six months of silence. We say “not used” and not “deleted”: it stays in our records until your account is deleted, as §8 sets out.
• A person a brand names in a reply. When a brand replies to a pitch you sent and names someone else to contact — “talk to Priya instead” — we keep that person’s first name and work address and add them to the brand contact book. The address has to be on the brand’s own domain. That contact is shared with every creator. We do not keep the sentence it came from.
• A payment alert that matches your invoice. When a bank or payment-service credit alert matches an invoice of yours, we keep only the amount, the currency, the date and a one-way fingerprint of that message so it is never counted twice. We never keep your balance, the rest of the alert, or anything from alerts that do not match an invoice.
• An affiliate statement from a known network. When an email from one of the affiliate networks above reports your earnings or a payout, we keep only the network, the period, the amount, the currency, whether it read as a payout, and a one-way fingerprint of that message so it is never asked about twice. We never keep the sender, the subject or any of its text. It is deleted with the rest of your data.
• What you asked for, from your own sent mail. When you send mail whose subject names an invoice, a quotation (or your rates, charges, commercials or pricing), a rate card, a proposal, a media kit or a list of deliverables, we note what kind of mail it was and the day you sent it, and, if it carries a figure, the amount and the currency. We do this for any such mail you send, not only mail to a brand: the part of the mail we read does not say who it went to. If that email thread is already a brand conversation on your record, it goes on that conversation as your ask (and as the fee, if none is known yet), with the message’s id so it is never counted twice, and we note what the mail tells us, for example that an invoice means paid work. If not, we hold it against that thread: when the brand’s side appears we move it onto the conversation, and if the thread turns out not to be a brand’s we stop using it. We never keep the mail’s text, its subject or its attachments.

The first two relate to mail that is already being shown to you, and both are removed when we action a deletion request (§8). Neither has a fixed expiry date of its own — we keep them for as long as we keep the item or the conversation they belong to. The brand addresses in the third and fourth are not deleted when you delete your account. The record of which creator’s inbox an address came from is deleted, with the rest of your data. §8 says what that leaves behind. The fifth is part of your invoice record and is deleted with the rest of your data. The sixth is deleted with the rest of your data. In the seventh, a figure held against a thread is deleted after 12 months while your Gmail stays connected; if you disconnect Gmail, it stays until you delete your data. One moved onto a brand conversation is part of that conversation’s record. Both are deleted with the rest of your data. Apart from these, we do not retain the text of your messages.

7. Subprocessors

We use the service providers below to run Oportunities. This list names every provider our software is built to reach — including ones we have set up but are not relying on yet, because we would rather name a provider before it handles anything than after. None of them may use your data for their own purposes.

Providers that handle your data

Providers that handle brand data, not yours

These help us find and reach the right person at a brand. They never receive your identity, your address, or anything from a message — no sender, subject, snippet, body or attachment ever reaches them. What they do receive is a company name, a company’s web domain, or the name of a person who works there.

Two things to be exact about. To find brands worth pitching you, we send Apollo a short category phrase Oportunities has worked out from what I notice about you and you confirmed — something like “travel-size skincare brands” or “filter coffee beans”. It describes a kind of company, it is inferred rather than quoted, and it carries no name, address, account or message text. It is still derived from your inbox, so “nothing from your inbox reaches them” would not be true. We also send Apollo a brand’s own web domain when we are looking for who to contact there. That is company data and carries nothing about you.

Our brand contact book is built from four sources: these paid providers, brands’ own published contact pages, and — as §4 and §6 describe — the addresses brands email from, noticed in connected creators’ inboxes, and people a brand names in a reply. Why the last two exist: bought contact data is frequently wrong, and an address that has delivered a real email is the one most likely to work.

We will update this list before introducing any new subprocessor that processes personal data.

8. Retention & deletion

One request deletes your data: an explicit deletion request that you send us. Nothing else does — not going quiet, not disconnecting Gmail. We would rather say that plainly here than let you assume something is being deleted that is not.

• While you’re active — we keep what I notice about you and your account data to run the service.
• If you cancel — we stop sending outreach, and we keep your derived data so you can resume where you left off if you come back. Cancelling is not a deletion request and does not start a deletion clock. That is deliberate: we will not destroy the inbox history of someone who cancels for a month and returns. If you want your data gone, ask us — see the next line.
• If you delete your account — send us a deletion request by email from the address on your account (the steps are on our support page). It records the request and closes your account. Signing back in within 30 days of the request cancels it. The erasure is then carried out on request — the automatic job that will do it is built and is not switched on yet. Going quiet or disconnecting does not delete anything — only the request does.
• Disconnecting Google revokes our access immediately — we call Google’s revoke endpoint and delete the stored token. If that call to Google fails, the token is kept, encrypted, so the revoke can be retried, and it stays until it is. You can also remove our access yourself at any time at myaccount.google.com/permissions.
• Pitches Oportunities has already sent live in your own Gmail Sent folder and are unaffected by deletion on our side.

Some records outlive a deletion, and we would rather name them than imply otherwise. Where the law requires us to keep something we keep it — for example our own record that your deletion request was made and honoured, which cannot itself be deleted by the deletion. A small number of records are kept with the link to you removed instead of being deleted, because deleting them would harm someone else: a brand contact’s request never to be emailed again, and an unsubscribe link already sent to them, both have to keep working after your account is gone.

The shared brand contact book. An address first noticed in your inbox (§6) is not deleted when you delete your account, and by then it may be in use for other creators. What is deleted is the record that it came from your inbox. Deleting your account removes your data; the address stays in the contact book.

Your chats, drafts and the files you share are kept until you delete your account. That includes the messages between you and your manager, the drafts it writes for you, the topics and moments it keeps track of, and any file you send it, so it can pick up where you left off. Deleting your account removes all of it (§8 below says what stays).

Shared knowledge stays; everything about you goes. What the manager has learned in general — how brands behave, what deals look like, what works — is shared knowledge that makes the manager better for every creator, and it is not deleted when you delete your account, because it is not about you (it never identifies you). Everything specific to you is deleted: your profile, your chats, your mail-derived records, your deals, your memories and your settings. Disconnecting Gmail stops any new address being taken from your inbox. You can also write to support@oportunities.ai.

If you are the brand. If your company mailbox is in our contact book and you want it removed or never emailed, write to support@oportunities.ai or use our email preferences page. You do not need an Oportunities account, and you do not need to have received anything from us yet.

9. Your rights & controls

Subject to applicable law (including India’s DPDP Act and the GDPR where it applies), you can access, correct, export, or delete your personal data, and withdraw consent at any time.

If you are in the EU, the UK or the US. We serve creators everywhere, on the same terms. For creators in the EU and UK: we run the service for you under our contract with you (these terms and this policy, which you accept when you sign up); we read your connected mailbox on the consent you give on Google’s connect screen, which you can withdraw at any time by disconnecting Gmail or deleting your account; and we keep the shared knowledge described in §8 on our legitimate interest in making the manager better for every creator, which you can object to by writing to us. You have the rights listed below, and you can complain to your local data-protection authority. For creators in the US: the same rights apply, and we do not sell your personal data.

• Disconnect Gmail — anytime, on the settings page of the Oportunities web page (under your mailboxes), or by removing Oportunities in your Google account. Disconnect Instagram — by removing Oportunities in Instagram (removing Oportunities in Instagram (§3)sect;2).
• Stop WhatsApp messages — email support@oportunities.ai (§2). Your WhatsApp number and conversation are deleted with your account.
• Delete your account & data — write to support@oportunities.ai from the address on your account, or follow the steps on our support page. It records the request and closes your account; signing back in within 30 days and choosing “Restore my account” cancels it. The erasure is then carried out on request.
• Export your data — email grievance@oportunities.ai; we respond within 30 days. Exports are prepared by hand today, not generated on demand.

To exercise any right, contact us at support@oportunities.ai. Our Grievance Officer (for India DPDP requests) is reachable at grievance@oportunities.ai.

10. Security

Connections use OAuth — we never see or store your Google password. Your Google access tokens are encrypted at rest with AES-256-GCM. The main service refuses to start in production without that encryption key configured. One background worker does not. Data is encrypted in transit, hosting-level encryption at rest is applied by AWS, and access to production systems is restricted and logged.

Raw message content is kept out of our logs by automated redaction plus an automated check that runs against our own source code on every change.

Our use of Google user data has been assessed under Google’s independent security review (CASA) for restricted scopes, and the assessment was completed in September 2026.

11. Age requirement

Oportunities is for creators 18 and older. We do not knowingly collect data from anyone under 18. If we learn an account belongs to a minor we close it and delete the data we hold, through the same team-actioned process described in §8.

12. Changes

If we make a material change to this policy, we will update the date above and notify you by email or on WhatsApp before it takes effect.

13. Contact

Questions or requests: support@oportunities.ai.
Grievance Officer (India DPDP): grievance@oportunities.ai.
Anycast Technology Private Limited, WeWork DLF Two Horizon Centre, 5th Floor, DLF Phase 5, Sector 43, Golf Course Road, Gurugram, Haryana 122002, India.