1. Who is responsible
Vigthoria Operator at operator.vigthoria.io is provided by vSecure Solutions LLC under the Vigthoria brand. We are responsible for the personal information we process to operate accounts, provide the service and manage our relationship with you.
vSecure Solutions LLC8 The Green, Suite B
Dover, DE 19901
United States of America
Privacy contact: privacy@vigthoria.io.
Company contact: contact@vsec.solutions.
Company details: vSecure Solutions legal notice.
If an organization uses Operator to process personal data on its own instructions, its responsibilities and any applicable data-processing agreement also matter. Ask that organization about data it controls. This notice does not replace an agreement required for that processing.
2. Data we handle and its sources
We receive information from you, your authorized workspace activity, your browser, connected services you authorize and the account or billing services used with Operator. Depending on your use, this includes:
- Account and access information: account identifiers, contact and profile details, authentication and session information, permissions, subscription entitlements and recorded approvals.
- Workspace content: prompts, conversations, saved history or memory, research inputs, uploaded documents, images, audio or video, generated outputs and project or job records.
- Publishing information: connected account identifiers and names, granted permissions, connection credentials, captions, media, schedules, approval records, publication links and delivery or error reports.
- Billing and support information: subscription, transaction, credit and usage references, and messages you send us. Payment details entered into a payment provider's checkout are handled by that provider; Operator's billing records are distinct from those payment-entry fields.
- Technical information: IP addresses, browser and request information, timestamps, service logs and diagnostic or security events associated with using the service.
- Optional notifications: when you link Telegram, the identifiers needed to associate your private chat and deliver requested messages or files, together with connection and delivery records.
Do not include passwords, private keys or unnecessary sensitive personal information in prompts, uploads or support messages. Obtain the necessary authority before submitting information about another person.
3. Purposes and legal bases
Where the GDPR or similar law requires a legal basis, we distinguish the following purposes:
- Providing the requested service: account access, AI processing, saved work, authorized publication, support and billing necessary to perform our agreement with you or take steps you request before entering it.
- Security and operation: preventing abuse and fraud, diagnosing failures, enforcing access limits and maintaining service reliability based on our legitimate interests, subject to your rights and the required balancing of interests.
- Legal obligations: records and disclosures required by applicable accounting, tax or other law.
- Consent: optional processing for which consent is required. You may withdraw such consent without affecting processing that was lawful before withdrawal. Authorizing a social connection is not blanket permission for unrelated uses.
Information needed for authentication, billing or executing a requested job is necessary for that feature. If you do not provide it, we may be unable to provide that feature. Optional connections are not required simply to read our public pages.
Google and YouTube API connections
The brand-owner Growth Studio also offers separately enabled X research and Meta owned-content/comment listening. X requires explicit paid-read budget approval; Meta requires provider admission and additional owner consent. These workflows retain bounded public text with email/phone redaction, source links and provider counters, not author profile exports or private inboxes. Text is research evidence for local editorial inference, never instructions or training data. Detailed signals expire after at most 30 days; disabling a listener stops new collection but does not erase approval, budget or publication history. Neither listener posts replies, likes content or sends messages. Missing access is reported, not replaced with invented demand.
The separately opted-in Vigthoria brand-owner Growth research workflow reads public comments and channel analytics to prepare editorial ideas and draft answers, never to train general-purpose models. Bounded, contact-redacted research text is processed by Vigthoria's governed local inference service; it is not sent to paid external generation services. Detailed research signals and reply drafts expire after 30 days. Editorial records retain source references and review decisions. Owner research requests additional analytics and comment permissions; although Google's comment permission includes management, the Growth workflow does not send comments, likes or direct messages. Missing evidence is shown as unavailable, not as zero engagement.
The YouTube publishing integration uses YouTube API Services. After you authorize Google access, Operator uses upload permission to send the video and metadata you approve, and read-only permission to identify your authorized channel and check the resulting video’s processing and visibility. We store your channel ID and name, encrypted access and refresh tokens, and the media reference, approved settings and upload result needed for this feature. We do not receive your Google password or browser cookies.
The publishing workflow uses this API data for your connection, approved uploads, recovery and support, not for sale, credit decisions or training general-purpose AI models. The selected video and its metadata are sent to Google when you approve an upload. The publishing workflow does not send Google/YouTube account data to generative AI providers. The separately opted-in owner research workflow is described below. Vigthoria’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Use “Disconnect and delete local YouTube data” on the YouTube connection page to remove this integration’s local connection and upload records and request Google token revocation. A request that may still be uploading must finish or reach its five-minute safety window first. Deleting an uncertain result removes local recovery information; inspect YouTube Studio before uploading another copy. You may revoke access directly at any time in Google Account permissions. Disconnecting does not delete videos already uploaded to YouTube; manage them in YouTube Studio.
Original pilot connections expire after 28 days. If you explicitly select ongoing scheduled API access, we retain encrypted authorization tokens until you disconnect or access is revoked, with periodic provider verification and automatic token renewal. This does not approve any content. If verification cannot succeed for 28 days, the connection stops and daily cleanup removes its credentials. API-derived channel metadata is refreshed during verification; standalone upload records retain their 28-day cleanup limit. Reconnection may still be required by Google. Underlying Creative Studio assets are separate; use the deletion process below for those assets, backups or other account data.
Google processes data under the Google Privacy Policy. Using the YouTube integration also requires agreement to the YouTube Terms of Service. Before uploading, you explicitly choose an available visibility: private, unlisted or public. Public videos are accessible to everyone; unlisted videos are accessible to anyone with the link.
X API connections
X publishing uses X authorization, not your password or browser cookies. We store your account ID, username and display name, encrypted access and refresh tokens, and the exact content and receipt of posts you approve. The integration requests account identification, post read/write and offline access; video publishing additionally requires media upload permission. It does not request direct-message or email access, or send X account data to generative AI providers.
Posting requires previewing and explicitly approving the exact text for the connected account. Posts follow that account’s audience settings and may be public. Disconnecting removes the local connection, pending authorization and previews, and attempts token revocation. You can also revoke access in X’s Connected apps settings. Disconnecting does not delete posts already on X or their local delivery receipts.
Original pilot connections expire after 28 days. With explicit ongoing scheduled API consent, encrypted tokens are retained until disconnection or revocation, automatically renewed where supported, and periodically verified. If verification fails for 28 days, the connection stops and daily cleanup removes credentials. Settled standalone receipts retain their 28-day cleanup limit; uncertain delivery evidence remains for reconciliation to avoid duplicates. Scheduled delivery requires separate exact-content approval and a qualified worker; it never migrates old browser jobs. Contact privacy@vigthoria.io for deletion of remaining records or backups. X processes information under its privacy policy.
5. AI and creative processing
To answer a request or generate content, Operator processes the prompt, relevant conversation or workspace context, selected files and technical information needed for the job. Depending on the selected feature and route, this is handled by Vigthoria-operated services or external AI and media providers.
Do not assume that all processing is local to your computer or that every model runs on our infrastructure. External processing can involve sending content to the chosen provider. Its applicable terms, retention practices and data-use settings depend on the provider and service; we do not make a blanket zero-retention or no-training promise for every available integration.
Saved conversations, memory and generated assets support continuity and recovery where those features are used. Review the content and context you submit, and avoid sending material you are not authorized to disclose. Contact us before using a workflow with data subject to special confidentiality or regulatory requirements.
6. Recipients and sharing
Information is made available as needed to operate the feature or fulfill the purpose described above, including:
- Authorized personnel and infrastructure, hosting, storage and security service providers supporting Operator.
- Vigthoria account and billing services, including User Hub, and payment providers involved in your transaction.
- The AI or media provider selected for a processing request and the social platform selected for an authorized connection or publication.
- Telegram when you enable bot delivery, and recipients or collaborators you choose when using sharing features.
- Professional advisers or competent authorities where necessary for legal obligations, lawful requests or establishing, exercising or defending legal claims.
Third-party platforms and payment providers may act as independent controllers for their own services. Their notices apply to that processing. Contact our privacy address for recipient information relevant to your particular account or workflow.
8. International processing
Our provider is a United States company. Infrastructure and connected services may process information in countries other than yours, including the United States. The destinations depend on the service and providers involved; different countries can have different privacy protections.
Transfers subject to GDPR restrictions require an applicable legal transfer basis and safeguards where required. This notice does not by itself create those safeguards or certify a particular provider's arrangements. Contact privacy@vigthoria.io for the destinations and applicable safeguards for your intended workflow, including how to obtain relevant safeguard information.
9. Retention
Retention depends on the record and its purpose rather than one fixed period for all data. Account and workspace information is retained to provide active service, saved history and recovery. Job records and publication receipts support status reporting, reconciliation and investigation of uncertain outcomes. Technical records are retained according to security and operational needs; billing or legal records may need to be kept for applicable statutory periods or claims.
When information is no longer needed for its purpose or an applicable legal requirement, it should be deleted or anonymized under the relevant retention process. Deletion from an active service does not necessarily remove every backup copy immediately. Copies held independently by a destination platform or another recipient remain subject to that recipient's controls and obligations.
You may ask for the retention information applicable to your data. See the next sections for deletion and other rights; we will explain any relevant reason that prevents immediate deletion.
10. Your rights and objections
Depending on the law that applies to you, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy of eligible data. You may withdraw consent for processing based on consent. These rights have conditions and exceptions, and withdrawal does not affect the lawfulness of earlier processing.
Right to object: where processing relies on legitimate interests, you may object based on your particular situation. You can also object to processing for direct marketing. Tell us which processing you wish to challenge so we can assess and respond to your request.
Send requests to privacy@vigthoria.io. We may need proportionate information to verify your identity or authority. We respond within the time required by applicable law and will explain any lawful limitation or extension.
You may complain to a competent data-protection authority, including the authority for your habitual residence, place of work or the alleged infringement where GDPR applies. You do not need to contact us first to exercise that right.
11. Disconnection and deletion requests
Use Operator's disconnect controls where provided and revoke authorization in the connected platform's account settings. For API connections, Operator's disconnect operation clears the stored connection credential and marks the connection revoked. Review outstanding work: a request already submitted to a platform may still complete or require reconciliation.
Disconnecting is not the same as deleting your Operator account or all historical job records. It also does not delete posts already published; use the destination platform's controls for those posts. Uninstalling the extension does not cancel a subscription or remove server-side data.
To request account closure or deletion of personal data, email privacy@vigthoria.io, preferably from the address associated with your account. Identify the Operator account and, where relevant, the connected platform or data concerned. We will verify authority as necessary and explain the scope, completion or any lawful retention exception. Never send passwords, API secrets or access tokens with a request.
Conversation or memory deletion controls, where available, apply to the selected records; they are not a substitute for a broader account deletion request. Manage paid subscriptions separately through the applicable billing controls.
12. Security
Operator uses access controls, owner-bound data checks and protected service communications. Official social connection tokens are stored encrypted. These measures do not mean that every record is end-to-end encrypted or that no authorized service can process your content.
No service can guarantee absolute security. Protect your account and device, review granted permissions and report suspected unauthorized access through Operator contact. Do not place credentials in public posts, chat transcripts or support attachments.
13. Children
Operator accounts are intended for people aged 18 or over, as described in our Terms of Service. If you believe a child has provided personal data to us inappropriately, contact our privacy address so we can investigate and take appropriate action.
14. Updates and contact
We may update this notice when features, processing or legal requirements change. The date and version above identify this notice. Material changes will be communicated as required, and consent will be requested where the law requires it; publishing an update is not itself your consent.
For privacy questions and requests, contact privacy@vigthoria.io or write to vSecure Solutions LLC at the address in section 1. General company inquiries can be sent to contact@vsec.solutions.
4. Connected social accounts
Connect only accounts you own or are authorized to manage. An official API connection, where available, uses the platform's authorization flow and granted permissions. Operator stores connection metadata and encrypted access or refresh tokens needed to perform authorized operations. Permissions and account eligibility determine which operations are available.
With Vigthoria Social Companion, platform passwords and cookies stay in your browser; they are not sent to Operator by the extension. The extension stores pairing and account-binding information locally and exchanges job instructions, account-identification information, publication results and diagnostics with Operator. Content and job records needed for scheduling and reporting can still be stored on our servers.
Approved publication sends the selected caption, media and settings to the destination platform. Public posts can be seen, copied or retained by others under that platform's rules. A platform processes information under its own privacy notice as well as the permissions you grant.
Only enabled features are covered by your connection. This notice does not mean that official API or hosted-browser publishing is available for every platform. See section 11 for disconnection and deletion.
Facebook and Instagram API connections
The limited Meta API release uses Facebook authorization to identify the Pages you permit and, for Instagram publishing, their linked professional Instagram accounts. If you select business-portfolio discovery, it additionally requests business access to discover the selected portfolio's eligible Pages; this integration does not change your portfolio, manage advertising or read messages. It stores your app-scoped Meta user ID, selected Page/account IDs and names, encrypted Page access tokens, approved captions and owned-media references, and delivery receipts. It does not receive your Facebook password or browser cookies. Connection data is not sent to generative AI providers by this integration.
Approved posts send the selected content to Meta. Instagram image delivery uses a short-lived, unguessable media link bound to the approved job; it is not a public library link. The current release supports Page text/JPEG posts and Instagram JPEG posts, not Reels, Stories or automatic schedules. Platform permissions and review gates still apply.
Disconnect removes saved Meta credentials and pending authorization/previews. Requests already handed to Meta may complete; disconnect does not delete published posts or local delivery history. Revoke platform authorization in Facebook's Business Integrations settings. Meta's signed deauthorization/data-deletion callback removes matching local connection and delivery records. You can also request deletion through the contact below. Local credentials expire no later than 28 days; settled receipts are subject to the same retention period. Uncertain delivery records remain for manual reconciliation unless deletion is requested. Underlying Studio assets and backups use the separate deletion process in section 11.