Privacy Policy

We may collect account and contact details, authentication identifiers, campaign inputs, content and communication history, billing metadata, and technical diagnostics needed to operate and secure the service.

The exact information depends on the VibeVO features a person chooses to use and the permissions they grant.

When a person signs in with Facebook or connects or communicates with VibeVO through a Meta service, we may receive identifiers, profile name and picture, and an email address if the person grants that permission and Meta provides it.

For connected Facebook Pages, Instagram professional accounts and WhatsApp Business accounts, we may process account identifiers, messages, postbacks, delivery status and related metadata needed to provide the requested automation, support or account-linking feature.

Creators may connect a social media account to VibeVO through that platform's own authorisation flow. Connecting is voluntary, VibeVO never receives a social media password, and the access we request is read-only: we cannot publish, comment, send messages, or change any setting in a connected account.

From a connected YouTube channel we receive the channel identifier and title, subscriber count as reported by YouTube, total view count, number of videos, and aggregated audience statistics: the share of views by country and the share of viewers by age group and gender. From a connected Instagram professional account we receive the account identifier and username, follower and media counts, and, where Instagram provides it, aggregated audience demographics by country, city, age and gender. From a connected TikTok account we receive account identifiers, display name, username, profile description and link, verified status, and follower, following, likes and video counts; TikTok does not provide audience demographics through this integration and VibeVO does not request access to individual videos or their metrics.

We use this information to confirm that the account belongs to the creator, to calculate campaign rates and payouts, to audit placements, and to detect and prevent fraud.

VibeVO uses YouTube API Services. By connecting a YouTube channel a creator also agrees to the YouTube Terms of Service at https://www.youtube.com/t/terms, and Google handles information as described in the Google Privacy Policy at https://policies.google.com/privacy. While a channel stays connected, we confirm at least once every 30 days that authorisation has not been revoked.

A creator can disconnect an account at any time in the VibeVO cabinet, which revokes the access token immediately. Access can also be revoked on the platform itself: for Google and YouTube at https://security.google.com/settings/security/permissions, for Instagram under Settings, "Your app and media", Website permissions, Apps and Websites, and for TikTok in the TikTok app under Settings and privacy, Security and permissions, Apps and services permissions.

Data received through the YouTube API is deleted within 7 days when a channel is disconnected in VibeVO or when a creator asks us to delete it, and within 30 days when access is revoked on the Google permissions page. Data received from Instagram and TikTok is deleted when the VibeVO account is deleted or on request. Deleting data from VibeVO does not delete anything from the social media platform itself.

Data we receive from Google through YouTube API Services, and from Instagram and TikTok, is transmitted only over encrypted connections (HTTPS/TLS), both between VibeVO and the platform and between VibeVO and the creator's browser.

The access and refresh tokens issued by Google and the other platforms are encrypted at rest with AES-256-GCM before they are stored. The encryption key is kept in our hosting provider's secret storage, separately from the database. Tokens are never shown in the VibeVO interface, never returned by our API, never written to logs, and never shared with advertisers or any other third party.

Channel and audience statistics are stored in an access-controlled production database that is not reachable by other VibeVO customers. Inside VibeVO, access is limited to the creator who connected the account and to authorised VibeVO staff who need it to moderate accounts, support campaigns and prevent fraud. Staff access is role-based, and administrative actions are recorded in an audit log.

We request the narrowest read-only permissions that the feature needs, we do not sell Google user data, and we do not transfer it to third parties except to service providers that host and operate VibeVO on our behalf under confidentiality obligations, or where the law requires it.

When a creator disconnects an account, the stored tokens are erased immediately and the data received through the API is deleted within the periods described above. If you believe your connected account data has been accessed without authorisation, contact us at the address below and we will investigate and respond.

We use personal data to create and authenticate accounts, link selected channels, deliver and measure campaign workflows, process messages and requests, provide support, troubleshoot issues, prevent abuse, and communicate important service or account updates.

We may also use aggregated or de-identified information to understand and improve service performance.

We may share data with Meta and other connected platforms when required to provide a feature selected by the user. Those platforms process data under their own terms and privacy policies.

We may also use hosting, security, analytics, communications and payment providers that process information for service operation, or disclose information where required by law or necessary to protect users and the platform.

We retain personal data only while it is needed to provide the service, meet security, support, accounting or legal obligations, and resolve disputes. Retention periods vary by data type and applicable requirements.

A person may disconnect a linked platform, revoke permissions in the relevant platform settings, or ask us to access, correct or delete personal data. Our data deletion page explains the request process and the limited circumstances in which records may need to be retained.

For privacy questions or requests, email [email protected]. Include enough information for us to identify the relevant VibeVO account safely, but never send a password, access token or payment card details.