Privacy Policy

The short version

We collect what we need to run your workspace and to connect the accounts you choose. Nothing is collected for advertising.
Your data is stored in Microsoft Azure in Sweden Central, in the EU. The AI models that make your drafts can process a request in other Azure regions.
Connection tokens for Meta and Google are encrypted and are never shown to anyone.
AI agents only prepare drafts. Nothing is published until you approve it.
We do not sell your data, and we do not use Google or Meta data to train AI models.
You can disconnect an account, or ask us to delete your data, at any time. See Data deletion.

Who we are

VP Marketing is a service for small businesses. It gives each business a brand strategy, a media plan and content made by AI agents and approved by the owner. It is run by Vy Le (“we”, “us”). We decide why and how personal data is used in the service, which makes us the controller under the EU General Data Protection Regulation (GDPR).

If you use VP Marketing for a business, that business decides what goes into its workspace. We handle that content only to provide the service to you.

You can reach us at privacy@vp-marketing.com, or through the contact form on vyle-ai.com. This policy covers the VP Marketing workspace (app.vp-marketing.com) and this website (vp-marketing.com).

What we collect

Your account

Your name and email address and your Microsoft account identifiers (object and tenant IDs), which we receive from Microsoft Entra when you sign in. We never see your Microsoft password. We also keep your role in each workspace you belong to (owner, admin, editor or viewer), and the email address and role of anyone you invite to a workspace.

Your workspace content

Files you upload (images, video, audio, documents and text), brand information (names, descriptions, logos, colours, fonts, tone of voice and your answers to the brand interview), plans, content and approvals, and your conversations with the assistant.

What our AI agents make

Drafts of brand strategies, media plans, posts, captions, scripts, images, voiceovers and videos made for you, the review notes on them, and which version you approved.

From Meta, if you connect it

The name and app-scoped ID of the person who connected. For each Facebook Page and Instagram professional account you choose: its ID, name, handle and profile picture and, for Pages, the category and your role on it. Numbers about those accounts (reach, views, interactions, followers and profile visits per day) and about their posts (views, reach, likes, comments, shares and saves). The ID and link of the posts we publish for you. Access tokens.

From Google, if you connect it

The Google account's ID and email address, and access and refresh tokens.

YouTube: your channel's ID, name and handle, its subscriber, view and video counts, and the views, likes and comments of your videos.

Search Console: the sites you own and their daily clicks, impressions, click-through rate and average position.

Google Analytics: your properties and their daily active users, sessions, key events and engagement rate.

Payments and plan

If you buy a plan, Stripe collects your payment details and gives us your name, email address, plan and payment status. We never see your card number. We also record how much of your plan's allowance a workspace has used (content credits, campaigns and the cost of the AI work).

Support

What you send us when you ask for help or fill in an enquiry, and the email address you use.

Technical data

Our servers record your IP address, browser type, the time and address of each request, and error reports. We use these logs to keep the service secure and working, and keep them for about 30 days.

We do not collect passwords, precise location or payment card numbers. We do not store information about your followers or the people who comment on your posts: from Meta and Google we read numbers about your accounts and posts, and the list of accounts you can manage. We do not ask for access to your private messages.

Why we use it

Run your account and workspace: To sign you in, keep your files and drafts, and show you what needs your attention. Basis: performing our agreement with you (GDPR Article 6(1)(b)).
Make drafts with AI: To prepare strategies, plans and content from what you give us. Basis: performing our agreement.
Connect, publish and report: To find your accounts, publish what you have approved and show how it performs. Basis: your consent when you connect an account (Article 6(1)(a)) and performing our agreement. You can withdraw your consent at any time by disconnecting the account.
Take payment and keep accounts: Basis: performing our agreement and our legal obligations under Danish bookkeeping law (Article 6(1)(b) and (c)).
Keep the service secure and working: To prevent abuse, find and fix errors and protect your data. Basis: our legitimate interest in running a safe service (Article 6(1)(f)).
Answer you: Basis: our agreement with you, or our legitimate interest in helping people who contact us.

We do not use your data for advertising, we do not sell it, and we do not make decisions about you by automated means that have legal or similarly significant effects.

Where it is stored and who handles it

Your data is stored in Microsoft Azure in Sweden Central, in the EU: the database, the files you upload, the search index, the message queues and the vault that holds encryption keys. Microsoft is our main processor. These Microsoft services handle data for us under Microsoft's data protection terms:

Azure hosting, database, storage and Key Vault.
Microsoft Entra ID, for signing in.
Azure OpenAI in Microsoft Foundry and Azure AI Speech, for the AI work described below.
Azure Monitor and Application Insights, for logs and error reports.

Other providers are involved only in particular cases:

Stripe, if you buy a plan.
Meta (Facebook and Instagram) and Google (YouTube, Search Console and Analytics), if you connect them. They are independent controllers of the data they hold on their own services.

Some of these providers can process data outside the EU and the EEA. The Azure OpenAI models we use are “global” deployments: when you ask for a draft, Microsoft may process that request in any Azure region where the model runs, including outside the EU. Stripe, Meta and Google operate worldwide. Where data leaves the EU and the EEA, the transfer relies on the EU–US Data Privacy Framework or on EU standard contractual clauses. What we store stays in Sweden Central; database backups are also copied to a second Azure region in the EU.

How AI is used

AI agents prepare drafts for you: brand strategies, media plans, posts, scripts, images, voiceovers and videos. They only create drafts and requests. Nothing is published, scheduled or sent until an owner or admin of the workspace approves it in VP Marketing.

To do this, we send parts of your workspace to AI models run by Microsoft (Azure OpenAI in Microsoft Foundry, and Azure AI Speech for voices): the text of your request, the relevant brand information and plans and, for search and captions, text and short descriptions of the files you upload. An image may be sent to a model so that it can be described. The assistant in your workspace can also see the names and handles of your connected accounts, their state, and the numbers shown on your dashboard, so that it can answer your questions.

Microsoft states that it does not use the prompts and content sent to Azure OpenAI to train or improve its models, and that it does not make them available to other customers or to OpenAI (Data, privacy and security for Azure OpenAI). We do not use your content, or data we receive from Meta or Google, to train any AI model.

AI can make mistakes. Read what it makes before you approve it.

Web search and reading pages. If you ask the assistant to search the web, the words of the search are sent to Microsoft’s Grounding with Bing service. Microsoft handles that data as an independent controller under the Microsoft Privacy Statement, not under the data protection terms that apply to the rest of our service, and it may leave the EU. The assistant is told not to put your private details in a search. When you ask it to open or look over a page, our servers fetch the page (and, for pages built by scripts, show it in a browser on our servers); we do not keep its text after the reply, except what you choose to save as your brand information.

How connections are protected

Access tokens from Meta and Google are encrypted before they are stored, with AES-256-GCM. Each token has its own data key, and that key is itself encrypted by a key held in Azure Key Vault, which never leaves the vault. A stored token is bound to your workspace and to the provider, so it cannot be used for anything else.
Tokens are never shown in the app, never written to logs and never sent to your browser. Our servers open them in memory only when they need to talk to Meta or Google for something you asked for, such as publishing a post you approved.
The secrets that identify VP Marketing to Meta and Google are kept in Key Vault, not in our code.
Everything travels over encrypted connections (HTTPS) and is encrypted at rest by Azure. Each workspace is kept apart from the others in the database, and our own access is limited to what is needed to run and support the service.

Facebook and Instagram (Meta)

When you connect Facebook or Instagram, you sign in with Meta and choose what to share. VP Marketing receives only what these permissions allow:

pages_show_list pages_read_engagement: Find the Facebook Pages you manage and the Instagram accounts linked to them, and read their basic details.
pages_manage_posts publish_video: Publish the posts, photos, reels, stories and videos you have approved to your Page.
instagram_basic instagram_content_publish: Find your Instagram professional account and publish the posts, carousels, reels and stories you have approved.
instagram_manage_insights read_insights: Read numbers about your Instagram account, your Page and their posts, such as reach, views and interactions, so that we can show how your content performs.
business_management: Only to list the Pages you reach through a business portfolio. Read only.
ads_read: Only if Meta requires it for a Page managed through a business portfolio. VP Marketing does not read or manage your ads.
instagram_business_basic instagram_business_content_publish instagram_business_manage_insights: The same three uses for an Instagram professional account that is connected through Instagram Login instead of a Facebook Page.

Meta Platform Terms and how we use Meta data

VP Marketing uses the Meta Platform under the Meta Platform Terms and the Meta Developer Policies. In practice:

We use data from Meta only to provide the features you asked for in VP Marketing: finding your accounts, publishing what you approve and showing results.
We do not sell it, license it or pass it to data brokers, and we do not use it for advertising, profiling, surveillance or building audiences. We do not use it to train AI models. We share it only with our service providers, as described above.
We keep it secure, as described above, and only for as long as these features need it.
We delete it when you ask, when you disconnect, or when Meta tells us that you removed the app or asked Meta to delete your data. This policy is the privacy policy we give Meta for the app.
If you remove VP Marketing in your Facebook settings (or in your Instagram settings, if you connected through Instagram Login), Meta tells us and we delete your access tokens and end the connection straight away. If you ask Meta to delete your data, Meta tells us, we delete the data we received from Meta about you, and you get a confirmation code to follow your request. See Data deletion.

YouTube, Search Console and Analytics (Google)

When you connect Google, you sign in with Google and choose what to share. VP Marketing asks for these permissions:

openid email: Identify the Google account that connected.
youtube.upload: Upload the videos you have approved to your YouTube channel. Videos are uploaded as private unless you choose otherwise.
youtube.readonly: Read your channel's details and statistics, and those of your videos.
webmasters.readonly: Read the Search Console sites you own and their search numbers.
analytics.readonly: Read your Google Analytics properties and their numbers.

VP Marketing's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What that means in practice

We use Google user data only to provide and improve the features you can see in VP Marketing: uploading the videos you approve and showing results for your channel, search and analytics.
We do not transfer it to others, except to our service providers to run those features, to comply with the law, or as part of a merger or sale after telling you.
We do not use it for advertising, including retargeting or interest-based ads.
Nobody at VP Marketing reads it unless you ask us for help and agree, it is necessary for security or to investigate abuse, or the law requires it. Otherwise only software handles it.
We do not use it to develop, improve or train generalized AI or machine-learning models.

By connecting your YouTube channel you also agree to be bound by the YouTube Terms of Service and the Google Privacy Policy. You can remove VP Marketing's access at any time in the third-party connections of your Google Account, and ask us to delete what we hold (see Data deletion).

How long we keep it

Account and workspace content: While your workspace is open. When you ask us to close it or to delete your data, we delete it within 30 days.
Access tokens: Deleted straight away when you disconnect an account in VP Marketing, or when Meta tells us you removed the app. If you remove VP Marketing in your Google Account, the token stops working at once; we delete the stored token when you disconnect the account in VP Marketing or ask us to.
Names, numbers and statistics from Meta and Google: Kept in your workspace as history until you ask us to delete them. A deletion request through Meta deletes the Meta data straight away; other requests are completed within 30 days.
Logs and error reports: About 30 days.
Backups: Encrypted database backups are kept for up to 14 days, in Sweden Central and in a second Azure region in the EU. Deleted data can stay in a backup until it expires.
Payment and invoice records: Five years, as required by Danish bookkeeping law.
Records of deletion requests: We keep a record that a request was made, its confirmation code and what it deleted. It holds no personal data and is our proof that we honoured the request.

To have data deleted, see Data deletion.

Your rights

Under the GDPR you have the right to:

see the personal data we hold about you and get a copy of it (access);
have it corrected (rectification);
have it deleted (erasure);
restrict how we use it (restriction), or object to it (objection);
receive the data you gave us in a common format (portability);
withdraw your consent at any time, for example by disconnecting an account. This does not affect what happened before.

To use these rights, email privacy@vp-marketing.com. We answer within one month. If we have reason to doubt who you are, we may ask you to show it.

You can complain to the Danish Data Protection Agency, Datatilsynet, or to the data protection authority in your own country. We would appreciate the chance to put things right first.

Cookies and similar technologies

This website does not use cookies, analytics or advertising trackers, and it does not load anything from other companies. If you choose a language, your choice is saved in your browser's local storage on your device, and nowhere else.

The VP Marketing workspace does not set cookies of its own either. Your browser's session storage keeps you signed in, and its local storage remembers small settings such as the workspace and brand you chose, and form drafts you have not sent. These stay on your device. If you use the hosted video Studio, a technical cookie may keep your session on the same server; it holds no personal data and is not used for tracking. Microsoft sets its own cookies on its sign-in pages, under Microsoft's privacy statement.

Because we use no advertising or tracking cookies, there is no cookie banner.

Children

VP Marketing is for business owners and their teams. It is not meant for anyone under 18, and we do not knowingly collect data from children.

Changes to this policy

We may update this policy as the service changes. The date at the top says when the current version took effect. If a change matters to you, we will tell the owners of workspaces by email or in the app before it takes effect.

Contact

Questions, requests or complaints about your data: email privacy@vp-marketing.com or use the contact form on vyle-ai.com. Please do not send passwords or access tokens by email.

Operator and controller: Vy Le.