Privacy Policy

1. What data we collect

• Account data: name, email, password (encrypted, never in plain text).
• Billing data: tax ID, billing address, the organization's legal name — used only for billing, never for any other purpose.
• Operational data you enter into the platform: clients, posts, campaigns, CRM deals, tasks, and your organization's financial information.
• Social media handles (Instagram/Facebook), when you manually type them into the organization's profile — plain text you type, never obtained from Meta; used only for identification, never for advertising/remarketing without separately given marketing consent. This is different from the Meta Publishing integration described below, which uses real OAuth authorization.
• Technical data: IP address and browser user agent, only for security (e.g. abuse detection) and consent logging.

2. Facebook and Instagram integration (Meta Publishing)

VectusUp includes an optional feature (Meta Publishing) that lets you connect your Facebook Pages and Instagram Professional accounts, through Meta's official login (Facebook Login for Business), to schedule and publish, directly on them, the content you create inside VectusUp. Only an Administrator of your organization can start this connection, and Meta always asks you, on Meta's own screen, to explicitly choose and confirm which Pages/accounts to authorize.

When you connect this integration, we store only:

• The access token issued by Meta for your authorization, and the access token for each Page you authorize — both encrypted at rest (AES-256-GCM), never returned to any screen of the application nor visible to other users.
• The scopes/permissions Meta actually granted in that authorization.
• Your Meta user identifier (not a credential — used only for diagnostics).
• The identifier and name of each Facebook Page you authorize, and the identifier/username of the associated Instagram Professional account, when one exists.

We use this data exclusively to publish, on the Pages/accounts you authorized, the content (text and media) you created yourself in VectusUp — never for any other purpose, never shared with third parties, and never to access data about followers or other people on those Pages/accounts. You can disconnect this integration at any time in Settings; from that point VectusUp can no longer publish on your behalf. See Data deletion for how to request deletion of this information.

3. What we use the data for

• Providing the service you signed up for (the application itself).
• Processing payments through the payment provider (Stripe).
• Publishing, on the Meta accounts you connect and authorize, the content you create in VectusUp (see section 2).
• Sending operational emails (verification, billing, invites, account alerts).
• Sending marketing communications — only if you give explicit, separate consent for that; you can withdraw it at any time under Settings → Privacy.

4. Who we share data with

We share only what is strictly necessary with service providers that support the platform's operations: payment processing (Stripe) and email delivery (SMTP). If you connect the Meta Publishing integration, we communicate with Meta (Facebook/Instagram) strictly to publish the content you authorize (section 2). We do not sell data to third parties.

5. How long we keep data

Your organization's data is kept while the subscription is active. If an account is left without a paid subscription, we notify you by email before taking any action on the data; tax/billing records required by law are never deleted early. Meta Publishing tokens are kept only while the connection is active; once you disconnect it or delete your account, they are no longer used.

6. Your rights (GDPR)

• Access your data and export it (Settings → Profile → Export data).
• Correct inaccurate data directly in the application.
• Withdraw marketing consent at any time.
• Request account deletion — see Data deletion —, subject to legal retention obligations (e.g. tax records).

7. Cookies

We use strictly necessary cookies (always active) and, only with your explicit consent, analytics cookies (Google Analytics) and marketing cookies (Meta Pixel and Meta Conversions API) to understand how VectusUp is used and measure campaign effectiveness. You can accept, reject, or customize this choice at any time.

Manage cookie preferences

8. Contact, data protection officer and complaints

For any question about your data or this policy, write to vectusup@scaleads.pt.

[TO BE DEFINED BY LEGAL COUNSEL — data protection officer (DPO), if applicable, and the competent supervisory authority]