Privacy Policy

Customer authentication currently uses a short-lived access token together with a refresh token. The frontend stores both values in localStorage.

To let Next.js middleware protect customer routes before the app hydrates, the frontend also mirrors the current access token into a first-party vi_access_token cookie.

Internal operations tooling uses a separate internal authentication flow. sessionStorage holds a separate internal authentication value for internal operations tooling.

VI Engine connects social accounts through official OAuth 2.0 authorization-code flows. We do not ask you to type your social platform passwords into the VI Engine app.

Platform credentials returned by those flows are stored on the backend in encrypted form using AES-256-GCM and are used only for the actions you authorize, such as publishing, analytics sync, or account status checks.

When you connect a Facebook Page or an Instagram professional account, VI Engine receives, with your permission:

• the Page's and account's ID, name, username and profile picture, and public profile details such as category, description, website, bio, and follower and post counts;
• an access token that lets VI Engine act for the Page or account only when you ask it to;
• the posts you publish through VI Engine and their reactions, comments, shares and insights (views, reach, clicks, saves), plus daily account insights such as followers, reach and profile views;
• comments other people leave on those posts, including the commenter's name or username.

We use this data only to provide VI Engine's features to you: connecting your accounts, publishing and scheduling your posts, showing engagement and analytics, collecting comments in your Inbox and sending the replies you approve, and tailoring AI-written suggestions to your business. We do not sell it, use it for advertising, or share it with other customers.

When Meta sends a signed data-deletion request, VI Engine verifies it against the matching Facebook publishing, Meta Login, or Instagram app identity. For an identity we can map unambiguously, we remove the connected Meta credentials and account, Meta profile enrichment and history, comments, engagement and account-insight records, and webhook events linked to that connection. Your VI Engine sign-in, workspace membership, other workspace data, and campaign content you created in VI Engine remain. If the identifier cannot be mapped unambiguously, we record the request for operator review and do not delete a VI Engine account or workspace.

When you connect LinkedIn, VI Engine receives your member ID, name and profile picture, and an access token that lets it publish the posts you approve. VI Engine does not read your LinkedIn feed, connections or messages, and it does not read engagement on LinkedIn posts.

These providers process data on our behalf, only to run VI Engine:

• Supabase: database (Singapore).
• Google Cloud: hosting, media storage and logs (India), and Gemini AI text and image generation.
• DeepSeek: AI text generation (China). Drafts, briefs, your business context, and the comment text you ask VI Engine to suggest a reply to are sent to it to write the suggestion.
• Resend: transactional email (United States).
• Cloudflare: web firewall and network protection. Traffic to our websites and app passes through it on the way to our servers.
• Sentry: error monitoring (United States). Error reports are scrubbed of emails, tokens, cookies and request bodies before they are sent.
• Google Analytics: website analytics for viengine.social (Google). Loaded only after you accept analytics cookies on this website; it receives page views and approximate location, not your name, email or connected social accounts.
• New Relic: browser performance monitoring for viengine.social (page load timings, page views and client errors). Loaded only after you accept analytics cookies on this website; it does not receive your name, email, form contents or connected social accounts.
• PostHog: product analytics for the VI Engine app. Your browser sends page views, and our server records a few account milestones, such as connecting a social account and publishing your first post. Both are keyed to an internal user ID, never your name, email or social media content. Session replay hides all on-screen text and is switched off on the connections and inbox pages.
• Razorpay and Dodo Payments: payments. Card details go to them directly, never to VI Engine.

Data is shared with third-party services only when the feature requires it — for example, when you use an official social-platform connection, complete billing checkout, or invoke an AI provider through the product.

Different providers apply their own terms and privacy notices while you are on their domains or using their APIs.