Policies

Privacy Policy

How we collect, use, and protect your data

Last updated: August 25, 2026

1Introduction

VerticalFlair ("we," "us," or "our”) is a content scheduling and management platform that enables users to upload, schedule, and manage video content for social media platforms.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, application, and services (collectively, the "Service"). Please read this policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

This policy covers:

  • Personal information we collect from you
  • How we use and share your information
  • Your rights regarding your data
  • How we protect your information
  • How to contact us with questions

This Privacy Policy should be read together with our Terms of Service.

2Information We Collect

We collect information through multiple channels to provide and improve our Service.

2.1 Account Information

When you create an account, we collect:

  • Email address (required for account creation)
  • Password (hashed using industry-standard encryption)
  • Profile information (name, if you choose to provide it)
  • Account preferences and settings

2.2 User Content

When you use our content scheduling features, we collect:

  • Videos and images you upload to the platform
  • Captions and text content you create
  • Hashtags and metadata you add
  • Scheduled post data (dates, times, target platforms)
  • Generated slideshows and AI-assisted content

2.3 Usage and Technical Data

We automatically collect certain technical information when you access our Service:

  • IP address and general location data
  • Browser type and version
  • Device information (operating system, device type)
  • Pages visited and time spent on each page
  • Referring and exit pages
  • Error logs and performance data

2.4 Third-Party Integration Data

When you connect third-party social media accounts:

  • Platform account information (username, display name, avatar)
  • Account connection status
  • Account identifiers needed to schedule and publish your posts

3How We Use Your Information

We use your information for the following purposes:

3.1 Primary Service Purposes

Your data enables us to provide our core services:

  • Provide content scheduling and management services
  • Store and host your uploaded content securely
  • Schedule and post content to connected platforms at specified times
  • Provide customer support and respond to inquiries

3.2 Service Improvement

We analyze data to improve our Service:

  • Analyze usage patterns to identify popular features
  • Debug technical issues and errors
  • Conduct research and development
  • Generate captions, slideshow text, and content suggestions using third-party AI services
  • Understand user behavior to enhance user experience

3.3 Communications

We communicate with you for:

  • Service-related notifications (scheduled posts, account activity)
  • Responding to your inquiries and support requests

3.4 Legal and Security

We use data to protect our Service and users:

  • Detect and prevent fraud and unauthorized access
  • Enforce our Terms of Service
  • Comply with legal obligations
  • Protect our rights, safety, and property

4Social Platform Data Integration

When you connect a social media account to VerticalFlair, we access specific data to enable content scheduling functionality. This section explains exactly what data we access and how we use it.

🔐 Social Media Data Access

What Data We Access

When you connect a social media account, we store and access:

  • Basic profile information (username, display name, avatar)
  • Account connection status
  • Account identifiers needed to schedule and publish your posts
  • We do not store your social platform access tokens in our database; publishing is handled through a secure third-party integration

How We Use Social Media Data

We use social media data to:

  • Identify your connected social media account
  • Post scheduled content on your behalf at specified times
  • Verify account connection status
  • Display your profile information in our dashboard

What We DO NOT Access

We are committed to minimal data access:

  • We do NOT access your direct messages
  • We do NOT read your followers or following lists
  • We do NOT post content without your explicit scheduling
  • We do NOT modify your profile without your explicit permission
  • We do NOT access your liked videos or browsing history

Your Control

You have full control over your social media connections:

  • Connect or disconnect social media accounts anytime from account settings
  • Delete scheduled posts before they publish
  • Review all pending posts before publication
  • Delete your account to remove your connection metadata from our systems

Retention and Deletion

Social media data retention follows these rules:

  • Connection metadata: Retained until you explicitly disconnect or delete your account
  • Connection history: Removed when you disconnect the account
  • Posted content metadata: Retained per our general retention policy
  • Upon account deletion: Your connection metadata is removed from our systems

5Cookies & Tracking Technologies

We use small files called cookies to help VerticalFlair work properly, understand how people use it, and keep it running smoothly. This section explains what cookies do and how you can manage them.

5.1 What Are Cookies

Cookies are small files that websites save on your device to remember things like whether you are logged in or what preferences you have set. They help websites work better and provide a smoother experience.

5.2 How We Use Cookies

We use cookies in a few simple ways:

  • Essential cookies keep you logged in and secure while you use VerticalFlair.
  • Analytics cookies help us understand how people use the site so we can improve it.
  • Performance cookies help us keep the site fast and reliable.

You do not need to know the technical names of these cookies. What matters is that they fall into the groups above and help us run the Service.

5.3 Managing Cookies

You can control or disable cookies through your browser settings:

  • Most browsers let you block or delete cookies from their privacy or security settings.
  • Disabling cookies may affect certain features, such as keeping you logged in.
  • For more help, refer to your browser’s help documentation or visit aboutcookies.org.

5.4 Third-Party Cookies

We use trusted services to keep the Service running and secure. These services may set their own cookies.

  • Supabase Auth sets cookies to keep you logged in securely.
  • Vercel Analytics helps us measure site performance and Core Web Vitals.
  • Stripe handles payment processing and may set cookies during checkout.
  • Postforme handles social account connections and publishing.
  • OpenRouter powers AI generation features.
  • FingerprintJS is used on the contact form and the free tools to limit abuse and prevent spam.

6Data Storage & Security

We take reasonable measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

6.1 Where Your Data is Stored

Your data is stored on secure infrastructure:

  • Primary database: Supabase (PostgreSQL on AWS infrastructure)
  • Application hosting: Vercel
  • Data is currently stored in the region configured for the Supabase project

6.2 Security Measures

We use the following security practices:

  • Supabase Auth handles authentication and password hashing
  • HTTPS/TLS encryption for data sent between your browser and our servers
  • Row Level Security (RLS) policies in the database to restrict data access
  • Rate limiting to protect against abuse and brute-force login attempts
  • Login lockout after repeated failed attempts
  • CSRF protection on selected API actions
  • Application logging to help diagnose issues

No system is perfectly secure. We follow reasonable industry practices for a project of our size, but we cannot guarantee absolute security.

6.3 Data Breach Procedures

If we discover a data breach that affects your personal information, we will notify affected users as required by applicable law. We will also take reasonable steps to investigate and remediate the issue.

7Data Retention & Deletion

We believe in transparency about how long we keep your data and how you can request deletion.

🗑️ Your Data, Your Control

7.1 Active Accounts

For users with active accounts, we retain all data indefinitely until you delete your account:

  • Account credentials and profile information
  • Uploaded videos and images
  • Generated captions and content
  • Scheduling history
  • Usage data and analytics
  • Connected platform metadata

This allows you to access and reuse your content whenever you want.

7.2 Deleted Accounts

When you delete your account, we remove your personal data from our systems:

  • Uploaded content is deleted from our storage
  • Account credentials are removed from our systems
  • Connection metadata is removed
  • Usage history associated with your account is removed
  • We delete the personal data we can identify

We process deletion requests as soon as possible. Some data may remain in automated backups for a short period before being purged. Third-party services we use (such as our publishing provider, analytics, and payment processor) may retain data under their own policies.

7.3 Anonymized Data

After account deletion, we may retain anonymized data that cannot identify you:

  • Aggregated posting patterns (e.g., "posts at 2pm perform 23% better")
  • Anonymized engagement metrics
  • Feature usage statistics
  • Platform trends

This data cannot identify individual users and is used solely to improve our service. This retention has no time limit.

7.4 How to Delete Your Account

To delete your account:

  • Use the contact form and include "Account Deletion" in your message
  • We will process your request as soon as possible and confirm once completed

8Your Rights

You have specific rights regarding your personal data. This section outlines your rights under GDPR (EU users) and CCPA (California users).

8.1 GDPR Rights (EU Users)

Under the General Data Protection Regulation, you have the right to:

  • Access - Request a copy of your personal data
  • Rectification - Correct inaccurate data
  • Erasure - Request deletion ("right to be forgotten")
  • Restrict Processing - Limit how we use your data
  • Object - Object to processing based on legitimate interests
  • Withdraw Consent - For consent-based processing at any time

To exercise these rights, contact us through the contact form.
Response time: We will respond as soon as possible

8.2 CCPA Rights (California Users)

Under the California Consumer Privacy Act, you have the right to:

  • Know - Request what personal information we collect
  • Delete - Request deletion of your personal information
  • Opt-Out - Opt-out of sale/sharing of personal information
  • Non-Discrimination - Not be discriminated against for exercising rights
  • Correct - Request correction of inaccurate information
  • Limit Use - Limit use of "sensitive personal information"

We do NOT sell your personal information.

8.3 How to Exercise Your Rights

To exercise any of these rights:

  1. Contact: use the contact form on our website
  2. Subject: "[Right Name] Request (e.g., Data Deletion Request)
  3. Include: Full name, email address, and specific request
  4. Verification: We may ask to verify your identity
  5. Response: We will respond as soon as possible

9International Data Transfers

Your data may be transferred and processed in countries other than your country of residence. This section explains how we protect your data during international transfers.

9.1 Data Location

  • Primary storage: United States
  • Application hosting: Global (Vercel edge network)
  • Some third-party services may process data in various global locations

9.2 Legal Basis for Transfer

For EU users, please note the following about international data transfers:

  • Data is stored in the United States where our infrastructure providers (Supabase and Vercel) operate.
  • Third-party providers such as Stripe, Postforme, and OpenRouter may process data in their own regions.
  • We use encryption and access controls to help protect your data.

9.3 Your Rights

Regarding international transfers, you have the right to:

  • Withdraw consent for optional processing
  • Request information about safeguards in place
  • File a complaint with your local supervisory authority

10Children's Privacy

Our Service is not intended for, and we do not knowingly collect data from, children under 18 years of age.

If you believe we have collected information from a child under 18:

  • Contact us immediately
  • We will delete the information as soon as possible
  • No questions asked

Parents or guardians who believe we have collected information from a minor can contact us to request deletion.

11Changes & Contact

11.1 Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the "Last modified" date at the top

Your continued use of the Service after any such changes constitutes acceptance of the new policy.

11.2 Contact Information

If you have questions about this Privacy Policy, please contact us:

Company: VerticalFlair

Contact: contact form

Privacy Inquiries: contact form

Privacy Officer: VerticalFlair Team

Response Time: We respond to all inquiries as soon as possible.

11.3 Data Protection Authority

If you are located in the EU or UK, you have the right to file a complaint with your local data protection authority:

  • EU: Contact your national data protection authority
  • UK: Information Commissioner's Office (ICO)
  • Ireland: Data Protection Commission

Important Notice: This Privacy Policy is provided for informational purposes and does not constitute legal advice. We recommend consulting with a qualified attorney to ensure this policy adequately complies with applicable laws in your jurisdiction.