Privacy Policy

What Goated collects, why we need it, who sees it, and what you can do about it. We don’t sell your data, and we don’t use advertising trackers.

Last updated October 30, 2026

On this page

1. Who we are
2. What we collect
3. How we use it
4. AI processing
5. Who we share it with
6. Messages and calls
7. Cookies and analytics
8. Where it is stored
9. How long we keep it
10. Your rights and choices
11. Children
12. Changes to this policy
13. Contact

1. Who we are

Goated is a marketplace where brands book creators on X for product launches. It is run by Goated Media LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States, which is responsible for your personal data under this policy. Questions go to hello@goated.so.

This policy covers goated.so, the brand and creator dashboards, and our emails. It sits alongside our Terms of Service.

2. What we collect

2.1 What you give us

Account: your email, name, password (stored hashed, never in plain text) or Google sign-in, and your role.
Brands: your company, website, the answers you give about your launch, briefs, invitations, offers and draft reviews.
Creators: your X handle, topics, countries, rates, the audience screenshots you upload, drafts and post links.
Creators’ bank details: account holder name and address, bank, and account and routing numbers, so we can pay you. These are kept apart from the rest of your account and only Goated’s admins can see them; you see them masked.
Messages and calls between brands and creators, and emails you send us (see section 6).
Payments: what you bought or paid, when, and the amount. Bank transfers you send us show your name and amount from our bank.

2.2 Public information we read

Creators’ public X data: profile, follower counts and recent public posts, to build and keep your page up to date.
People who reply to a creator: to describe a creator’s audience, we read the public profiles (handle, name, bio, location, follower count, picture) of people who replied to the creator’s recent public posts, and keep a summary of who they are.
Brands’ public websites and their competitors’ sites, to describe your market.

2.3 Collected automatically

Pages you open, buttons you press, errors you run into, your device, browser and approximate location from your IP address.
Session recordings of how pages are used, with everything you type masked. None are made in the admin panel.
Whether our emails were delivered, bounced or marked as spam.

2.4 What we don’t collect

Card numbers: they go straight to Dodo Payments.
Your X password or access to your X account: we only read what is public.
Recordings of voice calls.

3. How we use it

To run the marketplace: show creator pages, match brands with creators, price bookings, deliver invitations, drafts and messages, send the go-live email, check posts and move money. (Needed to provide the service you signed up for.)
To send the emails you need: sign-in codes, booking updates, receipts and payouts. Creators can unsubscribe from Goated email at any time.
To keep Goated safe and fair: prevent fraud and impersonation, keep deals on the platform, and resolve disputes. (Our legitimate interest in a safe marketplace.)
To improve Goated: see what is used, what breaks, and fix it. (Our legitimate interest in a working product.)
To meet legal duties: keep payment and tax records and answer lawful requests.

We do not sell personal data, share it for cross-site advertising, or use it to make decisions that have legal effects on you without a person involved.

4. AI processing

Some features use AI models, reached through OpenRouter. We send only what each task needs:

a creator’s public X profile and posts, to draft their page and describe their audience;
audience screenshots a creator uploads, to read the numbers in them;
public profiles of people who replied to a creator, in batches, to describe that audience;
a brand’s website and launch answers, to describe its market and suggest creators and prices;
brief details, to help write post drafts in a creator’s voice;
a chat message, with a few lines before it, when our filter can’t tell on its own whether it is talking about price outside the offer button;
questions visitors type to Goatie on the home page.

The AI provider processes what we send to return a result to us. On our side we keep a record of which task ran and what it cost, not the text that was sent. AI output is a suggestion: you can edit anything it writes before it is used.

5.1 Between brands and creators

A creator’s Goated page is public. Brands see a creator’s page, rates and what the creator sends them. Creators see the brand, the brief and what the brand sends them. Neither side sees the other’s email, bank details or billing details.

5.2 Service providers

These companies handle data for us, only to provide their service to Goated:

Provider	What for	What they handle
Convex	Database, file storage and backend	Everything in your account
Cloudflare	Website hosting, and relaying voice calls	Page requests, IP address; call audio passes through encrypted
Amazon Web Services (SES)	Sending and receiving email	Email address, the email itself, replies you send us
Dodo Payments	Card payments for plans, as merchant of record	Name, email, billing address, card details, purchase
Mercury	Goated’s bank: receiving booking payments and paying creators	Sender name and amount of transfers; creators’ bank details when paid
OpenRouter, with models from Google, Anthropic and DeepSeek	The AI features in section 4	Only the text or image each task needs
PostHog	Product analytics, error tracking and session replay	Pages, clicks, errors, device; your email once signed in
Google	Sign in with Google, if you choose it	Your Google account name and email
FxTwitter and twitterapi.io	Reading public X profiles, posts and replies	Public X handles and posts
Jina AI Reader	Reading public websites that block automated requests	The public web address being read
Unavatar	Showing public profile pictures	Public X handles

5.3 Other cases

The law: when we must, to answer a valid legal request, or to protect people from harm or fraud.
A sale or merger: if Goated is sold or merged, your data moves with it under this policy, and we tell you first.
With your say-so: anywhere else, only if you ask us to.

6. Messages and calls

Messages, offers and drafts between brands and creators are stored on our servers. Goated’s team can read them to run bookings, handle support and disputes, and keep the platform safe.
Messages are checked, by rules and sometimes by AI, for price talk outside the offer button, which is held back.
Voice calls connect browser to browser, relayed through Cloudflare when needed. We don’t record them. We keep who called whom, when, and for how long.
Replies to our emails reach Goated’s inbox and are stored with your account.

7. Cookies and analytics

Staying signed in: your browser’s local storage keeps your sign-in token. Without it, you would be signed out on every page.
Small preferences: local storage also remembers things like a dismissed notice, a folded menu or tours you have finished.
Analytics: PostHog sets a cookie and uses local storage to tell visits apart. Its traffic goes through goated.so, and inputs are masked in session recordings.

We don’t use advertising cookies or third-party trackers. You can clear cookies and local storage in your browser at any time; you will be signed out.

8. Where it is stored

Goated’s data is stored in the United States. If you use Goated from elsewhere, your data is transferred to and processed in the US and in the countries our providers work from. We rely on our providers’ contractual safeguards, such as Standard Contractual Clauses, for these transfers.

We protect data with encrypted connections (HTTPS), access limited to the people who need it, emailed codes for admin sign-in, and bank details kept in a separate, admin-only store. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. How long we keep it

Account data: while your account is open. When you ask us to close it, we delete or anonymise it within 30 days, except what we must keep.
Payment, payout and tax records: as long as tax and accounting law requires, usually up to 7 years.
Messages and booking history: while either side’s account is open, so both can refer back to past launches, and as needed to settle disputes.
Analytics and session recordings: no longer than PostHog’s retention period, at most a year.

10. Your rights and choices

10.1 What you can do yourself

Edit your profile, rates and bank details, or take your creator page down, from your dashboard.
Unsubscribe from Goated emails with the link at the bottom of them.
Cancel All Access from Billing.

10.2 What you can ask us

Depending on where you live (for example under the GDPR in the EU and UK, or state laws such as California’s CCPA), you can ask us to:

tell you what data we hold about you and give you a copy;
correct it, or delete it and close your account;
stop or limit a use, or object to one based on our legitimate interests;
send it to you in a format you can take elsewhere.

Write to hello@goated.so from your account email. We reply within 30 days and won’t treat you differently for asking. If you are in the EU or UK, you can also complain to your data protection authority.

10.3 People who aren’t on Goated

If your public X profile was read because you replied to a creator, and you want it out of our records, write to hello@goated.so with your handle and we will remove it.