Privacy Policy

VioPost is an AI-powered studio that turns an article URL or text you provide into branded social media assets (captions, images, carousels, and narrated videos), in the language you choose, and publishes them to the social accounts you connect. For personal data we process about residents of the European Economic Area (“EEA”) and the United Kingdom, the data controller is Emtsco, LLC, located in Maryland, USA. You can reach us at admin@emtsco.com.

We collect the following categories of personal information:

Information you provide to us

• Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and credentials or third-party sign-in identifiers used to create and secure your account.
• Brand and company settings. Information you enter to brand your output, such as company name, website, contact email, logo, brand colors and typography, and a local save path. If you ask us to build your brand kit automatically, we fetch the website address you give us and read its public pages to detect your colors, fonts, logo, and tagline. You may also upload your own font files, which we store so we can render them into your assets.
• Source content. The article URLs or text you submit for generation, any instructions you give the in-app assistant (including short voice recordings you dictate, which are transcribed to text and not kept; see Section 4), the language you choose for a post, the assistant’s replies, and the assets the Service produces for you.
• Uploaded media. Files you upload to the Service — images or videos you upload as your own posts, and background images you upload to create custom templates — which we store on our servers so we can display them, render them into your assets, and schedule or publish them at your direction.
• Communications. Information you provide when you contact support or correspond with us.
• Newsletter sign-up. If you subscribe to our mailing list, we collect your email address (and confirm it by double opt-in where applicable) to send you the updates you asked for. You can unsubscribe at any time.
• Payment and billing information. When you subscribe to a paid plan or add funds to your wallet, our payment processor (Stripe) collects and processes your payment card or account details on our behalf. We do not receive or store full payment card numbers; we retain billing records such as your wallet balance, transaction and usage history, subscription tier and status, and the amounts charged. When you pay for a wallet deposit, Stripe saves that card so auto-reload can use it if you turn auto-reload on. When you subscribe, we also keep a record of your acceptance of our Terms at checkout: which version of the price and renewal terms you were shown, whether you accepted the Terms in the app, and whether Stripe recorded your acceptance on the payment page. If you use VioTokens, these records also include your token balances and token history (each amount, the action, when it happened, and in an organization the member who took it). They are part of your billing records: included when you download your data and erased with your account, like your wallet history.
• Connected social accounts. When you connect a third-party platform — LinkedIn, Facebook and Instagram (through Meta, or Instagram on its own using an Instagram Professional account), X (Twitter), Google (YouTube and Business Profile), TikTok, Pinterest, Reddit, Bluesky, Threads, Telegram, or Snapchat — we store the access (and, where provided, refresh) tokens it issues, encrypted at rest, together with the account, profile, Page, channel, or business-account identifiers needed to publish on your behalf. For Bluesky you supply an app password, which we exchange for a session token and do not store; for Telegram you supply a bot token, which we store encrypted. Disconnecting the platform deletes these stored credentials.
• Saved and scheduled content. Posts you save to your library and posts you schedule are stored on our servers — including the post data and any rendered video — so you can revisit, edit, publish, or schedule them.
• Studio design edits. If you edit a saved single-image post in Studio, our visual editor, we store the design project — the element positions, sizes, rotation, typography, colors, and text you change, and any text, image, or shape elements you add — linked to that post.
• Team and organization workspaces. If you create or join a shared organization, resources such as your content library, connected accounts, brand settings, prepaid wallet, and — where enabled — post approvals are shared with the other members of that organization, and we record which member performed an action for audit and approval purposes.

Information collected automatically

• Usage and device data. Log data such as IP address, browser type, pages viewed, and timestamps, used to operate and secure the Service.
• Cookies and local storage. We and our providers use cookies and browser local storage (for example, to keep you signed in and to remember your preferences). See “Cookies and local storage” below.
• Sign-up attribution and product milestones. If you accept analytics, we note how you first reached our website: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the name of the referring website, and the first page you visited. When you create an account we attach that to it, and our own servers record when your account reaches a few milestones: signing up, starting a trial, generating and publishing a first post, making a first payment, and cancelling a subscription. We use this only to understand which of our marketing works; it is not shared with anyone, is included in your data download, and is deleted when you close your account.

When you submit a URL, we fetch and process the content of that public web page to generate your assets. Please do not submit content you are not authorized to use, and avoid including sensitive personal information in your inputs.

We use personal information to:

• Provide, operate, and maintain the Service and generate the assets you request;
• Create and authenticate your account and keep it secure;
• Process payments, manage your subscription and prepaid wallet, and prevent payment fraud;
• Personalize output with your brand settings;
• Respond to your requests and provide customer support;
• Monitor, debug, and improve the Service and develop new features;
• Detect, prevent, and address fraud, abuse, and security incidents;
• Send you newsletters and product updates where you have opted in, which you can unsubscribe from at any time; and
• Comply with legal obligations and enforce our terms.

To generate assets, the source content and instructions you provide are sent to our third-party AI provider, Google (the Gemini API, including its image-generation, speech-to-text and text-to-speech models), acting as our processor, together with the language you ask us to write in. Your inputs and outputs are processed to return results to you.

We do not use the content you submit, or the assets generated for you, to train AI models. We use Google’s paid Gemini API. Under Google’s terms for that paid service, Google does not use our prompts or its responses to improve its products, but it keeps them for a limited period (currently up to 55 days) to detect and prevent abuse of its service and for legally required disclosures, and they may be stored or processed in any country where Google operates.

Voice dictation. When you dictate to the in-app assistant, we first use your browser’s built-in speech recognition, which your browser provider may process under its own terms. If your browser does not offer it, the recording (up to 60 seconds) is sent to Google’s Gemini API to be transcribed. We use only the resulting text and do not keep the recording, and we do not use voice data to identify anyone.

If you are in the EEA or UK, we rely on the following legal bases under the GDPR:

• Performance of a contract — to provide the Service you request and manage your account;
• Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights;
• Consent — where required, for example for certain cookies or optional communications (you may withdraw consent at any time); and
• Legal obligation — to comply with applicable law.

We do not sell your personal information. We share it only as described below:

• Service providers (processors). Vendors who process data on our behalf under contract, including Clerk (authentication), Google (AI generation, and Google Analytics for site and app usage measurement, only if you allow analytics cookies), Stripe (payment processing), Brevo (email delivery), Cloudflare R2 (object storage for generated media, uploaded images, videos, and templates), Railway (application hosting and our database), and Sentry (error monitoring; we remove email addresses, payment identifiers, access tokens, and similar identifiers from error reports before they are sent). Some providers, such as Stripe and Clerk, may also use data as independent controllers for their own fraud-prevention and security purposes, under their own privacy policies.
• Members of your organization. If you work in a shared organization workspace, the content, connected accounts, wallet, and activity records in that workspace are visible to its other members, and its administrators can export or erase them (see our Terms, Section 1).
• Legal and safety. When required by law, legal process, or to protect the rights, property, or safety of VioPost, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your direction. When you choose to export, save, publish, or schedule content to a destination you select — for example, when you publish or schedule a post to a connected platform such as LinkedIn, Facebook, Instagram, X (Twitter), Bluesky, Threads, or Telegram — we transmit that content and any media to that platform at your direction, subject to its own terms and privacy practices. Some platforms — including Instagram, Threads, TikTok, and Google Business Profile — do not accept media uploaded directly and instead fetch it from a link. For those, we make the post’s image or video available at an unguessable temporary public URL, which anyone holding the link could open while it exists. For most of these networks we delete our temporary copy as soon as publishing finishes, whether it succeeded or failed. For networks that fetch the media later (such as TikTok), deleting it immediately would break the post, so an automatic cleanup removes copies more than 30 minutes old; it runs at least hourly, so these copies normally disappear within about 90 minutes. The destination platform keeps its own copy under its terms.

We use strictly necessary cookies and browser local storage to run the Service (for example, to maintain your session and store preferences). These are always on because the Service cannot work without them.

Analytics cookies (optional). If you choose “Accept analytics”, we load Google Analytics, provided by Google, to measure how the website and app are used (for example, which pages are visited and which features are used) so we can improve them. Google Analytics sets its own cookies (named _ga and _ga_…) and receives information such as the pages you visit, your browser and device type, and your approximate location derived from your IP address. Google Analytics does not load, and sets no cookies, unless you accept. Your choice is stored in your browser’s local storage.

Attribution cookie (optional). With the same “Accept analytics” choice, we set one first-party cookie, vp_attr, holding the campaign tags, referring website and first page described in “Information collected automatically”. It lasts 90 days, is read only by our own servers when you create an account, and is never set unless you accept analytics.

You can change your choice at any time: Cookie settings. If you withdraw consent, we stop loading Google Analytics and remove its cookies, and the attribution cookie, from your browser. We honor opt-out preference signals, including the Global Privacy Control (“GPC”): when your browser sends GPC, Google Analytics is not loaded. You can also control cookies through your browser settings, though some features may not function without the strictly necessary ones.

We retain personal information for as long as needed to provide the Service, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. You may delete your data yourself at any time, or ask us to, as described under “Your privacy rights.”

Posts you create are saved to your library and are automatically deleted after 30 days unless you keep or schedule them (posts in a campaign, and in an organization posts waiting for review or approved for publishing, are not deleted this way). Posts you keep or schedule, and any media stored to publish them — including images or videos you upload as your own posts — are retained until you delete them or close your account. Background images you upload for a custom template are retained until you delete that template or close your account. Tokens for a connected social account are retained until you disconnect that platform. If you edit a post in Studio, our visual editor, the design project is retained together with that post and is deleted when you delete the post or close your account. Publishing or scheduling from Studio also creates a render snapshot — an immutable, point-in-time copy of the design used to produce that specific render — which is short-lived: it stops being usable about 15 minutes after it is created, and is deleted automatically shortly afterwards. Replies from the in-app assistant are kept with your account until you clear your data or close your account.

Billing records. Your wallet and transaction history, any amount you owe us after a refund (a receivable), and your checkout acceptance records are kept while your account is open and are erased when you close your account, or when you clear your data (which is not available while money is involved; see Section 11). Our payment processor, Stripe, keeps its own records of your payments under its own policies.

Backups and logs. When data is deleted, it is removed from our active database at once, but it can remain in our database backups until those backups expire or are deleted. Server logs and error reports are kept by our hosting and error-monitoring providers for their retention periods.

Generated media and uploaded files are stored with a third-party object-storage provider (Cloudflare R2). Narrated videos are retained for a plan-specific window: videos made while your account has no active paid subscription (during the free trial or when you use only a pay-as-you-go wallet) are kept for 3 days, and each paid plan (Starter, Pro, and Enterprise, and Lite for any existing Lite subscriber) keeps them progressively longer, as set out on our pricing page. After the applicable window, video files may be permanently deleted. We encourage you to download any content you wish to keep before the retention period expires.

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, or misuse, including encryption in transit, access controls, and encryption of the access tokens for your connected platforms (AES-256-GCM) before they are stored. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We and our providers may process and store personal information in the United States and other countries that may have different data-protection laws than your jurisdiction. Where we transfer personal data out of the EEA or UK, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or other lawful transfer mechanisms.

EEA and UK residents

Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; and to withdraw consent. You may also lodge a complaint with your local supervisory authority.

California residents (CCPA/CPRA)

In the preceding 12 months we may have collected the following categories of personal information: identifiers (e.g., name, email, IP address), customer records, commercial information, internet or network activity, and the content you submit. We collect this information for the business purposes described above and disclose it to the service providers listed above. You have the right to:

• Know and access the personal information we have collected about you;
• Delete personal information, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information — note that we do not sell or share personal information as those terms are defined under the CCPA/CPRA;
• Limit the use of sensitive personal information (we do not use sensitive personal information for purposes that require an opt-out); and
• Not receive discriminatory treatment for exercising your rights.

Other U.S. state residents

Residents of states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, or certain profiling. We do not sell personal data or use it for targeted advertising.

How to exercise your rights

If you have an account, you can exercise your access, portability, and deletion rights yourself — immediately and without contacting us. Open the account menu, choose Manage account, then Privacy & Data, where you can:

• Download my data — a machine-readable JSON copy of the records we hold for your account, including your posts, templates, brand kit, Studio designs, campaigns, scheduled posts, wallet and usage history, connected accounts (excluding the access tokens themselves), and profile. Media files (uploaded images and videos, rendered videos, logos, and fonts) are not included in the file; you can download them from the app, or ask us for a copy. This serves both your right of access and your right to data portability.
• Clear my data — erases your posts, wallet history, connections, brand kit, and scheduled posts while leaving your login active, so you keep the account but none of its content. It is not available, and nothing is erased, while your wallet holds a balance, an active subscription can still bill, or you owe us an outstanding amount after a refund of credit you had already used; for an outstanding amount, contact support to resolve it. Clearing never refunds, cancels, or settles anything by itself.
• Delete my account — permanently closes your account. It turns off auto-reload, refunds your unused paid wallet balance to the card that paid for it (promotional credit is not refunded), cancels any active subscription immediately so no further charges are made, erases your data from our active systems, and deletes your login. Data can remain in backups until they expire (Section 8), and Stripe keeps its own payment records. This cannot be undone.

If you administer an organization, the same page additionally lets you download the organization’s data and erase the organization’s shared posts, wallet, connections, and settings. Content you contributed to an organization’s workspace belongs to the organization and stays with it when you leave or delete your own account.

For corrections, for objections to or restriction of processing, for withdrawal of consent, or for any request you cannot complete in the app — including requests made by an authorized agent, or by someone without an account — email admin@emtsco.com or use our contact page. We will verify your request and respond within the timeframe required by applicable law. You may use an authorized agent where permitted. If we deny your request, you may appeal by replying to our response.

You can disconnect any social account from Connections in the app at any time. Disconnecting deletes the access and refresh tokens we hold for that platform, along with the account, Page, channel, board, or business-account identifiers we stored to publish on your behalf. It does not delete posts you already published — those live on the platform and are governed by its own terms — and it does not delete the posts saved in your VioPost library, which you control from the Library and the Privacy & Data page. Disconnecting does not cancel posts already scheduled for that platform: unless you reconnect or cancel them, they fail when they are due and are marked as failed in the app. Your history of past publishing attempts is kept with your account.

Facebook, Instagram, and Threads users

If you remove VioPost from your Facebook, Instagram, or Threads account, or submit a data deletion request through Meta, Meta notifies us automatically and we immediately delete the stored connection for that account: its access tokens, account identifier, and display name. Pages or accounts you had chosen as publishing destinations stay listed in your settings, and your publishing history stays with your account, until you remove them or erase your data. You can also request deletion directly:

• From the platform. In Facebook, open Settings & privacy → Settings → Apps and Websites, select VioPost, and choose Remove; in Instagram or Threads, open Settings → Website permissions → Apps and websites and remove VioPost. In Instagram you may also choose Request data deletion.
• From VioPost. Open Connections and disconnect the account, or use Manage account → Privacy & Data to erase all of your data at once.
• By email. Write to admin@emtsco.com and we will confirm deletion.

YouTube and Google Business Profile users

VioPost’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. When you connect a YouTube channel, VioPost asks for permission to upload videos to it and to read which channel the connection belongs to (the youtube.upload and youtube.readonly scopes). When you connect a Google Business Profile, VioPost asks for permission to manage that business’s profile so it can list your locations and publish posts to them (the business.manage scope). We use this access only to publish what you choose to publish.

YouTube connections use YouTube API Services: by connecting YouTube you agree to the YouTube Terms of Service, and the Google Privacy Policy applies. You can revoke VioPost’s access at any time from your Google security settings, as well as by disconnecting in Connections.

This page is the deletion status page referenced in our response to Meta’s data deletion callback: we delete the stored credentials as soon as the request arrives, so by the time you are directed here we can no longer access your account on that platform. To remove the remaining destination settings and history, use the options above.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16 (or under 13 where COPPA applies). If you believe a child has provided us personal information, contact us and we will delete it.

The Service may link to or process third-party websites (for example, an article URL you submit). We are not responsible for the privacy practices of those third parties, and this Policy does not apply to them.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, where required, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions about this Policy or our privacy practices, contact us at admin@emtsco.com or Emtsco, LLC, Maryland, USA. You can also reach us through our contact page.