Privacy policy

DOMS (“we,” “us”) builds AI-assisted direct-message tooling for fitness coaches. This policy explains what data we collect from coaches and their Instagram audiences, what we do with it, and the choices you have. We collect only what we need to operate the service, we don’t sell your data, and you can request deletion at any time.

1. Who this policy covers

This policy applies to coaches who sign up to use DOMS and the public-facing prospects whose Instagram conversations flow through the product. It covers data we process at app.getdoms.co and any subdomain we operate.

2. Data we collect

From coaches who sign up

• Account information. Name, email, password hash, IP address at signup, and Supabase auth identifiers.
• Profile + business settings. Business name, timezone, working hours, voice prompt, tone configuration, and booking calendar metadata that you supply during onboarding.
• Instagram OAuth grant. When you connect your Instagram professional account using Instagram Login, we receive a long-lived Instagram access token, your Instagram account ID and username, and the permissions you authorize: “instagram_business_basic” (your account profile and media), “instagram_business_manage_messages” (read and send Instagram direct messages on your behalf), and “instagram_business_manage_comments” (read comments on your posts and send the comment-triggered reply you configure). We do not request or store a Facebook Page access token. The long-lived access token is stored encrypted at rest (AES-256-GCM, per-environment key) and is deleted when you disconnect.
• Billing data. Subscription status and invoice metadata when paid plans are active. Card data is held by our payment processor; we do not store full card numbers.

From the prospects in your inbox

• Direct-message content sent to or from your connected Instagram business account, including text, attachments, reactions, read receipts, and conversation metadata.
• Voice messages. Where you enable voice understanding, inbound voice notes are converted to text so the assistant can read and reply. Both the audio (relayed to our transcription sub-processor) and the derived transcript are processed; see the sub-processor list below.
• Public profile fields Meta exposes for the conversation participant: handle, display name, avatar URL, follower count, follow relationship, and verified badge.
• AI-derived facts. Structured facts our language models extract from conversation history (interests, goals, objections) to make replies in your voice possible.
• Comment and post metadata on your connected account where the comment thread becomes a DM-routed conversation.

Automatically

• Service logs. Request paths, status codes, durations, error stack traces, and a per-request trace ID. Logs include tenant and trace identifiers so we can debug, but we redact obvious credit card, social security, and phone patterns from message bodies before they enter logs.
• AI inference traces. Every AI reply produces a trace row with the prompt, model identifier, latency, token cost, and guardrail decisions for audit and quality review.
• Cookies. A first-party Supabase session cookie keeps you logged in; a CSRF cookie protects the OAuth handshake. We do not use third-party advertising cookies.

3. How we use it

• Operate the inbox: read, classify, and route incoming conversations.
• Draft AI replies in your configured voice and apply your guardrails before any reply leaves the system.
• Build memory and context so the agent remembers prior conversations with the same prospect.
• Show analytics and reporting to you, scoped to your tenant only — we never aggregate one coach’s data into another coach’s view.
• Operate, secure, and improve the service. Detect abuse, debug issues, and prevent automated misuse.
• Send transactional email about your account: password resets, billing notices, security alerts, and incident postmortems.

We do not sell your data. We do not use your messages or your prospects’ messages to train third-party foundation models. Inference traces stay scoped to your tenant.

4. Google user data (Google Calendar)

DOMS’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access and why

Connecting your Google Calendar is optional. When you connect it, you grant us only the narrow scopes our booking feature needs — we never request full read or write access to your calendar:

• See and create only the events DOMS makes (calendar.events.owned). We use this solely to create the consultation events you book from your inbox — including the meeting time, the prospect as an attendee, and a video-conference link — and to read back those same events we created. We cannot see, edit, or delete any other event on your calendar.
• Read your free/busy availability (calendar.freebusy). We read only busy/free time ranges — timestamps with no titles, descriptions, attendees, or other event content — to propose open slots and to re-check, in the seconds before booking, that the slot is still free so we never double-book you.
• Your Google account email (openid, userinfo.email). We read your email address to confirm which Google account is connected and to display it in your settings.

How this data is processed (including our AI assistant)

Our scheduling feature is powered by an AI assistant. To propose open consultation times in your conversations, your free/busy availability — transmitted as time ranges only, with no event titles, descriptions, or attendees — is sent to our AI sub-processor (Anthropic) at the moment a reply is generated, so the assistant can select genuinely open slots to offer. This transfer happens only to provide the booking feature you enabled. It is never used to train, develop, or improve any AI or machine-learning model, and your free/busy data is not retained by the AI sub-processor beyond what is needed to generate that reply.

How we handle this data (Limited Use)

• We use Google Calendar data only to provide the coach-facing scheduling feature described above.
• We do not sell Google user data, and we do not transfer it to others except (a) to sub-processors who help us operate this feature (such as our AI assistant provider, described above), (b) as needed to comply with applicable law, (c) for security investigations, or (d) as part of a merger or acquisition after we give you notice.
• We do not use Google user data for advertising, retargeting, personalized or interest-based advertising, or for any credit, lending, or eligibility decision.
• We do not use Google user data to train, develop, or improve generalized or foundational AI or machine-learning models.
• No human at DOMS reads your Google Calendar data except where you give explicit consent for support, where it is necessary for security investigations or to comply with applicable law, or where the data has been aggregated and anonymized.

Storage, retention, and revoking access

• We store your Google refresh token encrypted at rest (AES-256-GCM, per-environment key) together with your connected Google email and the calendar identifier. Availability and event data is fetched on demand to complete a booking and is not retained beyond what is needed to provide the feature.
• You can disconnect at any time: sign in → /settings/calendar → Disconnect calendar, which deletes the stored token and connection. You can also revoke our access directly at myaccount.google.com/permissions. Closing your account deletes the connection along with your tenant data within 30 days.

5. Sub-processors we share data with

We use a small number of vendors to operate the service. Each gets only the data needed for its job. The current list:

• Supabase (US/EU regions) — Postgres database, authentication, file storage.
• Vercel (US) — application hosting, serverless compute, edge network.
• Anthropic (US) — language models for draft generation, classification, and fact extraction. When you use the optional Google Calendar booking feature, your free/busy availability (time ranges only — no event titles, descriptions, or attendees) is sent to Anthropic at reply time so the assistant can propose open slots. Per Anthropic’s commercial terms our prompts are not used to train their models.
• Meta Platforms, Inc. — Instagram messaging APIs for read and send.
• Zernio (transitional) — Meta API gateway during the migration to direct Meta integration. This vendor is being decommissioned per our migration roadmap.
• Voyage AI (US) — vector embeddings for semantic memory.
• OpenAI (US) — speech-to-text transcription of inbound Instagram voice messages, where you enable it. When a prospect sends a voice note, the audio file is relayed and its text transcript is generated so the assistant can read and reply in text (we do not send voice replies). Per OpenAI’s API terms this data is not used to train their models.
• Google (US) — Google Calendar API for the optional booking feature. We request only narrow, least-privilege calendar scopes; see the “Google user data” section above for full details and our Limited Use commitment.

We disclose data to law enforcement only when compelled by valid legal process, and only to the extent the request requires.

6. How long we keep your data

• Account data is retained for the life of your account plus 30 days after closure.
• Conversation messages are retained for the life of your account. You can delete a thread or the whole inbox at any time from settings.
• AI inference traces are retained for 90 days in hot storage, then archived to cold storage for up to 12 months for audit, then permanently deleted.
• Webhook event logs are retained for 14 days for debugging and replay-protection.
• Backups follow our database provider’s schedule (typically rolling 7-30 days) and are deleted on that cycle.

7. Your rights

You have the right to access, correct, export, or delete the data we hold about you. The fastest paths:

• Settings and account closure. Sign in → /settings → Disconnect Instagram removes the OAuth grant and the connected account. Email us to delete opens a pre-addressed privacy request for full account closure. After ownership verification, we disable automation and delete your tenant, conversations, and traces within 30 days.
• Email request. Send a deletion or access request to privacy@getdoms.co from the email address tied to your account. We respond within 30 days.
• Meta-initiated deletion. When someone removes the app from their Instagram settings or requests deletion, Meta sends us a signed notice (deauthorization or data-deletion request); we verify it and automatically purge the affected user’s data — conversations, messages, comments, and derived records — within 30 days. The full instructions live at /data-deletion.

California, EU, and UK residents have additional rights under CCPA and UK/EU GDPR — including the right to lodge a complaint with a supervisory authority. Contact us first; we’d rather hear about it directly.

8. Security

All traffic uses TLS in transit. Secrets at rest are encrypted by our database provider. Access tokens for connected accounts are encrypted with a per-environment key. Application access is gated behind Supabase auth with HttpOnly session cookies and CSRF state for OAuth flows. We log every administrative action and we run automated tests on every change.

9. International transfers

Our infrastructure is primarily hosted in the United States. If you access the service from outside the US your data is transferred to the US. We rely on standard contractual clauses with our sub-processors to protect transfers from the EU and UK.

10. Children

The service is not directed to children under 13 (or the equivalent minimum age in your country). We do not knowingly collect data from children. If you believe a child has provided us data, contact privacy@getdoms.co and we’ll delete it.

11. AI disclosure

DOMS drafts and may automatically send replies on a coach’s behalf using AI. Some jurisdictions (including California under AB 2905, and Texas) require disclosing automated agents to consumers. We support a configurable first-reply disclosure that coaches can enable per tenant. Operating the service in jurisdictions that mandate disclosure without enabling it is the operating coach’s responsibility.

12. Changes to this policy

We will update this page when our practices change. Material changes will be announced inside the product and to the email tied to your account at least 14 days before they take effect. The effective date at the top of this page is the binding date.

13. Contact

For privacy questions, deletion requests, or to exercise any of the rights described above, email privacy@getdoms.co. For Meta App Review and platform-related questions, reference the data-deletion callback documented at /data-deletion.