Privacy Policy
Operator: vailble gmbh · Last updated: October 2026
This is a courtesy translation. The German version is legally binding.
1. Controller and Contact
Controller under the GDPR (Art. 4(7)): vailble gmbh Ludwig-Lassl-Strasse 2 6112 Wattens, Tyrol, Austria Commercial register: FN 625878i Managing director: Ing. Lorenz Wetscher E-mail (incl. privacy requests): office@vailble.com We are not required to appoint a data protection officer (Art. 37 GDPR); privacy requests are handled at office@vailble.com.
2. Our Role: Controller or Processor
We are controller for your account, billing, support, security and the vailup.app website. For third-party data you process in your workspace – imported contacts, newsletter recipients, leads from VailPage forms or Meta Lead Ads, your clients' content – you are the controller and we act as processor under Art. 28 GDPR based on our DPA (/dpa). Social and advertising platforms are independent controllers for their own processing (display, reach, ad delivery).
3. Data We Process
Account data: name, e-mail, password (hash only) or Google sign-in, language, team role. Brand data: company details, Brand Brain, logos, colours, content imported from your website. Content: uploaded or AI-generated images, videos, texts, drafts, campaigns, calendar entries, approvals. Platform connection data: access tokens, expiry, granted permissions (scopes), account/page IDs, profile name and picture, app-scoped user ID. Metrics: statistics retrieved from platforms for your posts and ads. Contacts and leads: name, e-mail, phone, message, consent text/source, unsubscribe status, notes, tasks, origin (e.g. UTM, Meta form). Usage and log data: IP address, timestamps, device/browser info, error logs (without tokens or passwords). Billing data: plan, credits, vouchers, invoice details.
4. Purposes and Legal Bases
– Providing VAILUP and the features you use (Art. 6(1)(b) GDPR) – Platform connections, publishing, ads, lead import and metrics – only when you initiate them (Art. 6(1)(b)) – Billing and statutory retention (Art. 6(1)(b), (c)) – Security, abuse prevention, rate limits (legitimate interest, Art. 6(1)(f)) – Support and contact requests (Art. 6(1)(b) or (f)) – Product newsletter only with consent (Art. 6(1)(a)), revocable at any time – Processing on behalf of your clients/contacts: on your instructions (Art. 28); you ensure the legal basis towards your contacts.
5. Social, Advertising, Storage and Lead Platforms – General
Connections are only created when you start them in Settings → Integrations. You sign in directly with the platform (OAuth 2.0); we never receive your platform password. The platform's login page shows the requested permissions. We only request permissions needed for the feature and store the permissions actually granted. Token storage: access tokens are kept in a separate database table accessible only to our servers; they are never returned to your browser and are not written to error logs. Expired connections are marked expired and no longer used. Publishing: posts are only sent when you approve/schedule them or choose “Post now”. We transmit text, hashtags, media (via short-lived signed links) and the target account. Ads: VAILUP creates ad plans; campaigns sent to ad platforms are created paused or as drafts and only run after you explicitly activate them. Budget and billing run solely through your own ad account. Brand Brain: when you connect accounts, we copy public profile details (e.g. name, bio, category, website, recent post texts) into your Brand Brain without overwriting your own entries. Disconnect: you can disconnect any platform in Settings → Integrations; we then delete the stored token. You can also revoke access in the platform's settings. The platforms' privacy policies apply additionally.
5.0 ChatGPT app (OpenAI, Model Context Protocol)
Provider of ChatGPT: OpenAI (independent controller for your ChatGPT conversations under its own privacy policy). Connection: only when you add the VAILUP app in ChatGPT and sign in with your VAILUP account (OAuth 2.0 with PKCE). We never receive your OpenAI password; ChatGPT never receives your VAILUP password. Brand selection: when connecting, you choose which brands ChatGPT may access; you can change or revoke this selection in VAILUP at any time. Access additionally follows your existing team and brand permissions; no data of other organisations. Data shared with ChatGPT on request: names of granted brands, Brand Brain, calendar entries, drafts, campaigns, media library metadata, pages/documents, marketing, SEO and analytics summaries, monthly reports, QR codes, booking settings (team, services, locations, absences, availability), booking and review summaries (first names only, no e-mails or phone numbers) and integration status. Leads are shared without contact details by default; a lead's e-mail address and phone number are only shared when you explicitly request them in ChatGPT. Data received from ChatGPT and saved in VAILUP on request: drafts for social posts, newsletters, campaigns, landing pages, link pages/vouchers, documents and graphics (including edits to existing drafts), Brand Brain notes, images for the media library and their organisation. ChatGPT can also edit leads (stage, next step, notes) and create or change booking rules, locations, services, team members and absences. New services are created inactive; changes affecting your public booking page require your explicit confirmation. Nothing is published to social media, no newsletter is sent, no ad is activated, nothing is paid and no VAILUP credits are used through ChatGPT. Storage and deletion: drafts, notes, images and changes remain until you delete them in VAILUP or delete your account. Access tokens are short-lived. Revocation: disconnect VAILUP in ChatGPT settings or sign out of all devices in VAILUP; requests: office@vailble.com.
5.1 Meta – Facebook, Instagram
Provider: Meta Platforms Ireland Ltd., Dublin, Ireland (transfers to Meta Platforms Inc., USA possible). Login: Facebook Login for Business or Instagram Login (Business/Creator accounts only). Data: token, granted permissions, Page and Instagram account IDs, name, picture, app-scoped user ID. Purposes: selecting your Page/Instagram account, publishing posts, reels, stories and carousels, retrieving insights. Meta Ads: reading ad accounts, Pages, pixels and lead forms, audience estimates, creating paused campaigns/ads, retrieving metrics. Meta Lead Ads: if you subscribe lead forms, we receive responses (e.g. name, e-mail, phone, answers) via signed webhook or pull and store them in VailLead in your workspace (as your processor). Consent is never inferred. Deletion: if you remove VAILUP in your Facebook settings, Meta calls our callback URLs; we delete the affected connections and tokens and keep only a hash of the user ID and a confirmation code. Status: vailup.app/meta/data-deletion-status.
5.2 Meta – Threads
Separate Threads login. Data: token, permissions, Threads profile ID, name, picture. Purposes: publishing Threads posts and retrieving insights. Threads is not used for ads. Deletion requests are handled automatically; status: vailup.app/threads/data-deletion-status.
5.3 LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Dublin, Ireland. Permissions: depending on the feature w_member_social, openid, profile; for Pages r_organization_admin, w_organization_social, r_organization_social; for ads r_ads, rw_ads; for leads and conversions the Lead Sync and Conversions permissions. Data: token (expires after about 60 days), member and organisation IDs, name, picture, campaign and lead data. Purposes: posts on your profile and company pages, insights, LinkedIn Ads campaigns (created as drafts), lead import into VailLead and conversion reporting. The LinkedIn click ID (li_fat_id) is only stored with marketing cookie consent and deleted after 90 days.
5.4 Pinterest
Provider: Pinterest Europe Ltd., Dublin, Ireland. Permissions: user_accounts:read, boards:read, boards:write, pins:read, pins:write; for ads user_accounts:read, ads:read. Data: token, account ID, name, boards, ad accounts. Purposes: image pins into a board you select, insights, listing your ad accounts.
5.5 TikTok and TikTok Ads
Provider: TikTok Technology Ltd., Dublin, Ireland. Data: token, profile information and statistics (user.info.basic, user.info.profile, user.info.stats), video list (video.list), ad account, identity and pixel IDs. Purposes: publishing videos and photos or sending them as drafts, post insights, TikTok Ads campaigns (created paused), metrics. Webhooks inform us about publishing status and deauthorisation.
5.6 Snapchat
Provider: Snap B.V., Amsterdam, Netherlands. Data: token, organisation, ad account and Public Profile IDs, metrics. Purposes: Snapchat Ads campaigns (created paused) and metrics, organic publishing as Public Story, Spotlight and Saved Story.
5.7 Google – Drive, YouTube, Google Ads, Business Profile
Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (transfers to Google LLC, USA possible). Google Drive: via “Import from Google Drive” you can connect your Google account (permission: drive.file – only for the files you actively pick in the Google picker – plus userinfo.email/userinfo.profile to show which account is connected). We only read file names, thumbnails and metadata to show your files for selection, and download only the files you actively select. These are copied into your media library. We never modify, delete or share anything in your Drive. The connection applies per VAILUP login; access keys are stored encrypted and server-side only. Alternatively you can import publicly shared Drive links without signing in. YouTube: data: token, channel ID, channel name, picture. Purposes: uploading and scheduling videos and Shorts (title, description, thumbnail, visibility) and retrieving channel and video statistics. Google Ads (incl. YouTube ads): data: token, customer IDs of your ad accounts, campaign, ad group and ad data, metrics. Purposes: selecting the ad account, creating paused Search, Display and YouTube campaigns, status sync and metrics. Google Business Profile: data: token, location IDs, posts, reviews. Purposes: publishing posts, showing and replying to reviews. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it and do not use it to train general AI models. Revoke access anytime at myaccount.google.com/permissions. Sign in with Google: separately, when you sign in to VAILUP with Google we only receive name, e-mail address and profile picture.
5.8 Entered Ad Account and Pixel IDs
If you manually enter ad account or pixel IDs, we store only these IDs and their status. This does not create a connection to the provider.
5.9 Shopify
Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, Ireland (transfers to Shopify Inc., Canada/USA possible). Permissions: read_products, write_products, read_discounts, read_content, write_content. Data: shop domain, shop name, currency, access token (encrypted, server-side only), products (title, description, images, variants, prices, links), collections, discount codes and online store pages. Purpose: selecting products for posts, ads, campaigns and newsletters, product-level marketing statistics, updating a product's SEO title/meta description on explicit request and creating unpublished page drafts. We do not read or store orders, customer or payment data of shop buyers. Mandatory webhooks (customers/data_request, customers/redact, shop/redact) are honoured; when the app is uninstalled we delete the token immediately and the remaining shop data after Shopify's deletion request (shop/redact, about 48 hours later). Legal basis: Art. 6(1)(b) GDPR.
6. AI Processing
For texts, images, videos and analyses we send the required inputs (prompts, Brand Brain, selected media) via the Lovable AI Gateway to models from Google (Gemini) and OpenAI, only on your request and under the providers' API business terms. Please do not enter sensitive third-party data into AI prompts.
7. Recipients and Processors
– Lovable Cloud (Supabase infrastructure): database, auth, file storage, server functions – Cloudflare: delivery and attack protection – Lovable AI Gateway, Google, OpenAI: AI features – Lovable email infrastructure (notify.vailup.app): system e-mails and newsletters; your provider if you use your own SMTP – Platforms in section 5: only when connected, as independent controllers – Stripe Payments Europe Ltd. (Dublin, Ireland): payment processing for subscriptions and credits; Stripe processes name, e-mail, payment and invoice data, we do not receive full card or account data (Art. 6(1)(b),(c) GDPR). DPAs under Art. 28 GDPR are in place with all processors. Current list: /subprocessors.
8. International Transfers
Some providers (e.g. Meta, Google, OpenAI, Cloudflare, Lovable/Supabase) are based or host outside the EU, notably in the USA. Transfers rely, where available, on the EU-US Data Privacy Framework (Art. 45 GDPR) or Standard Contractual Clauses (Art. 46).
9. Retention and Deletion
– Account data and content: while you use VAILUP; removed within a reasonable period after account deletion unless retention is required – Platform tokens: until disconnect, revocation at the platform or account deletion – Pending Meta account selection during login: max. 15 minutes – Meta/Threads deletion requests: only user-ID hash and confirmation code as proof – Contacts and leads: until you delete them or your account – Error logs: sanitised, without tokens/passwords, deleted after 90 days – Invoice data: 7 years (Austrian BAO §132) Data export and account deletion: Settings → Privacy.
11. Landing Pages, Forms and Newsletters
Data collected via VailPage forms and newsletters you send are processed by us as your processor. For abuse protection we store a truncated hash of the IP address. Unsubscribes are honoured automatically. You are responsible for your contacts' consent. LinkedIn click IDs: if a visitor reaches a VailPage page via a LinkedIn ad, the link contains a LinkedIn click ID (li_fat_id). It is only captured if the visitor has first consented to marketing cookies (Art. 6(1)(a) GDPR, § 165(3) Austrian TKG 2021) and is stored with the lead when a form is submitted. If the page owner has enabled LinkedIn conversions, we transmit the click ID with the conversion event (e.g. new lead, appointment, deal won) server-side via the LinkedIn Conversions API to LinkedIn Ireland Unlimited Company so LinkedIn can attribute the conversion to the ad. Without consent no click ID is stored or transmitted. Consent can be withdrawn at any time with future effect via the page's cookie settings; stored click IDs are deleted together with the lead.
12. Contact Form
Contact form data (name, e-mail, optional company, topic, message) is used only to handle your request (Art. 6(1)(b) or (f) GDPR).
13. Your Rights
You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21). You may withdraw consent at any time with future effect (Art. 7(3)). Contact office@vailble.com or use Settings → Privacy. If you are a contact or lead of a VAILUP customer, please contact that customer first; we forward requests. Complaints: Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at
14. How to Remove Connections and Data
1. Disconnect: in VAILUP Settings → Integrations → “Disconnect” at the platform. The token is deleted. 2. Revoke at the platform: Facebook → Settings → Business integrations / Apps and websites; Instagram → Settings → Apps and websites; Threads → Settings → Account → Website permissions; LinkedIn → Settings → Data privacy → Permitted services; Pinterest → Settings → Security → Apps. 3. Delete account and all data: Settings → Privacy, or e-mail office@vailble.com.
15. Obligation to Provide Data, Automated Decisions
Account data is required to use VAILUP; platform connections are optional. No automated decision with legal effect (Art. 22) takes place; the VailLead score is only an aid for you.
16. Security
TLS-encrypted transfer, role-based database access rules (team and brand rights), server-only tokens, signed webhooks, rate limits, sanitised error logs. No provider can guarantee absolute security.
17. Changes
We update this policy when features, providers or the law change – in particular when integrations change.