Privacy Policy

The short version

Who we are

VistaraWave is an AI marketing platform that helps businesses plan, create, approve and publish their own social content, with built-in compliance review for regulated fields like healthcare. In this policy, "we", "us" and "our" mean the team that runs VistaraWave. You can reach us at hello@vistarawave.com or through our contact page.

This policy covers the VistaraWave website and the VistaraWave app. It applies to people who use VistaraWave as members of a business's workspace, and to people whose information reaches us through VistaraWave, such as visitors who click a tracked link.

A business that uses VistaraWave decides what goes into its workspace and what gets published. For that content, we act on the business's behalf and follow its instructions. For account and billing details and for running our own service, we are responsible for the information ourselves.

What we collect and why

We do not collect payment card numbers in VistaraWave. We do not buy information about you from data brokers.

Connected social accounts

When you connect a social account, you sign in on the network's own page and see the permissions VistaraWave is asking for. We never see your password. The network then gives VistaraWave:

• an access token, and on some networks a refresh token, which let VistaraWave act for that account within the permissions you approved;
• the ID, name, username and profile picture of the accounts you can choose from, such as your Facebook Pages, your YouTube channel or your LinkedIn Company Pages;
• details the network requires us to show you before you post, such as your TikTok privacy options or your list of Pinterest boards;
• for each post VistaraWave publishes, the post's ID, web address and publishing status;
• numbers for those posts and accounts, such as views, likes, comments, shares, saves, clicks and follower counts.

How we use it

We use information from your connected accounts only to:

1. publish the posts that a person on your team approved, to the accounts and at the times they chose;
2. show your team the numbers for your own accounts and posts, in VistaraWave and in the reports it prepares for you;
3. keep the connection working, for example by refreshing tokens, and tell you when an account needs to be reconnected.

What we never do

• Read, send or reply to private messages.
• Comment, like, follow or react on your behalf.
• Publish anything a person has not approved.
• Access accounts you did not choose to connect.
• Sell this data, share it with advertisers or data brokers, or use it for advertising.
• Combine it with other customers' data or use it to build profiles of people.
• Use it to train AI models.

Access tokens are encrypted (AES-256) before they are stored, and are only ever sent back to the network that issued them. When you disconnect an account in VistaraWave, we ask the network to cancel the token where the network allows it, and we delete the token from our database straight away.

What each network gives us

Google user data (YouTube and Google Business Profile)

VistaraWave uses Google APIs for two features: publishing to YouTube and reading statistics for your channel and videos, and publishing to Google Business Profile. When you connect, Google shows you the exact permissions we request. We ask only for the narrowest permissions those features need.

VistaraWave's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

That includes any transfer of that information to another app or service. In practice:

• We use Google user data only to provide the features you see in VistaraWave: publishing what you approved and showing you your own numbers.
• We transfer it only when needed to provide those features (for example, sending your video and its details to YouTube, or sending your post numbers to our AI provider to write the summary in a report you asked for), for security purposes, to comply with the law, or as part of a merger, acquisition or sale of assets after asking for your consent.
• We never use or transfer it to serve advertising, including retargeting, personalized or interest-based ads. We never sell it, and never use it to judge credit-worthiness or for lending.
• No person at VistaraWave reads it unless you agree to that for specific data (for example in a support request), it is needed for security or to comply with the law, or it has been aggregated and anonymized for our internal operations.
• We do not use it to develop, improve or train generalized AI or machine learning models.

YouTube

VistaraWave uses YouTube API Services to upload videos to your YouTube channel and to show you statistics for your channel and videos. By connecting a YouTube channel, you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

What we access, store and use

• Your channel's ID, title and picture, so your team can see where a video will go.
• Access and refresh tokens, encrypted, so VistaraWave can upload the videos you approved.
• For videos uploaded through VistaraWave: the video ID, its visibility (public, unlisted or private) and processing status, and its view, like and comment counts.

VistaraWave uploads a video only after a person on your team approves it, with the title, description, visibility and audience setting your team chose. VistaraWave does not change a video's visibility without your consent, and does not add anything to a description after you approve it.

Who it is shared with

YouTube data is shown only to people in your workspace. When you ask for a results report, the numbers for your videos may be sent to our AI provider to write the summary. It is not shared with anyone else, except service providers who store it for us under contract.

How long we keep it

We refresh or delete the YouTube data we store at least every 30 days, and we check at least every 30 days that we still have your permission to access it.

• If you disconnect YouTube in VistaraWave, we cancel our access with Google straight away and delete all YouTube data we stored for that channel within 7 days.
• If you ask us to delete your YouTube data, we delete it within 7 days.
• If you remove VistaraWave's access from Google's security settings page instead, we delete the YouTube data we stored as soon as we learn of it, and within 30 days at the latest.

How to revoke access

You can remove VistaraWave's access to your Google account at any time in two ways: in VistaraWave, under Settings, Connected accounts, then Manage and Disconnect; or on Google's security settings page at https://security.google.com/settings/security/permissions.

Information about cookies and data stored on your device is in Cookies and your device. To contact us with questions or complaints, see Contact us.

Facebook, Instagram and Threads

Facebook, Instagram and Threads are Meta products. VistaraWave connects to them through Meta's official login and APIs, and handles the data Meta provides only as this policy describes and as the Meta Platform Terms allow.

• We use it only to publish the posts you approved and to show you numbers for your own Pages, accounts and posts.
• We do not sell, license or buy Meta data, and we do not use it for advertising.
• We do not use it to make decisions about people's eligibility for housing, jobs, insurance or credit, to discriminate, for surveillance, or to build profiles of people.
• We do not request access to Messenger or Instagram direct messages.

Deleting data we received from Meta

You can ask us to delete the data we received from Meta at any time:

• Disconnect the account in VistaraWave, under Settings, Connected accounts.
• Remove VistaraWave in your Facebook, Instagram or Threads settings. Meta tells us automatically, and we delete your tokens and disconnect those accounts.
• When you remove VistaraWave there, you can also send a data deletion request. We delete your data and give Meta a confirmation code and a link where you can check the status of your request.
• Or email us at hello@vistarawave.com.

Step-by-step instructions are on our data deletion page.

TikTok

VistaraWave connects to TikTok through TikTok's official login and Content Posting API.

• Before you post, VistaraWave fetches your TikTok display name, avatar and the privacy and interaction options TikTok allows for your account, and shows them to you.
• You choose who can see each post, whether comments, Duets and Stitches are allowed, and whether the post promotes your own business or someone else's. Nothing is sent until you confirm.
• VistaraWave never adds watermarks or logos to your content.
• We use TikTok data only to publish your posts and to show you each post's status and numbers. We do not sell it or share it, except with service providers who help us run VistaraWave under contract.

You can remove VistaraWave's access in the TikTok app at any time; see our data deletion page. If our access to TikTok ends, we delete the TikTok information we hold.

LinkedIn

VistaraWave uses LinkedIn's APIs to publish to your personal profile and to the Company Pages you administer, and to show statistics for those posts. We use LinkedIn member data only to help you manage your own LinkedIn profile and Pages through VistaraWave.

• We do not use LinkedIn data for advertising, sales, recruiting, finding leads, or adding to other databases.
• We do not export, sell or transfer it to anyone, including other customers, and we do not combine it with other data to build profiles.
• VistaraWave does not collect other members' comments, reactions, mentions or profiles. If a feature ever needs them, other members' activity will be kept for no longer than 48 hours and their profile details for no longer than 24 hours, as LinkedIn requires.
• Totals for your Page, such as post impressions, reactions and follower counts, are kept for up to one year. Page names and logos are refreshed or removed at least every eight weeks.
• For your own connected profile, we keep your name, picture and member ID while it is connected, so your team can see which profile a post will go to.
• Member data about a Page is shown only to people in your workspace who work on that Page.
• We delete the data we collected through LinkedIn for you immediately when you ask us to or close your VistaraWave account.
• VistaraWave staff never post for customers from their own LinkedIn profiles.

X

VistaraWave uses the X API to publish posts you approved to your X account and to show you numbers for those posts.

• Connecting your account does not by itself let VistaraWave post. Before anything is published, VistaraWave shows you exactly what will be posted, and a person must approve it.
• We do not use X data to target advertising, and we do not use it to work out sensitive information about anyone, such as their health.
• If a post is deleted on X, or you or X ask us to remove X content, we update or delete our copy within 24 hours.

Pinterest

VistaraWave uses the Pinterest API to create the Pins you approved on the boards you choose and to show you numbers for your own Pins.

• A person chooses and approves each Pin before it is published.
• We read your board list from Pinterest when you need it, rather than keeping a copy. We store only what we need: the IDs of Pins VistaraWave created and the numbers for your own account and Pins.
• We do not share or sell information from Pinterest, and we do not use it for advertising.

AI processing

VistaraWave uses AI models from outside providers to research, plan, draft and summarize. Today these providers are Anthropic and OpenAI. To do a task, VistaraWave sends the provider only what that task needs:

• your business information and the instructions you type, for example to the built-in assistant;
• the drafts, scripts, captions and comments the task is about;
• search requests about your market, when the AI researches the public web for you (you see the sources it used);
• the sound from videos you record, when you ask for subtitles;
• numbers for your posts, when you ask for a results report or recommendations. These can include statistics from your connected accounts.

VistaraWave never sends passwords, account tokens, consent forms, or other LinkedIn members' data to AI providers.

The providers process this information to return a result to us. Under their business terms they do not use it to train their models, and may keep it only for a limited time for safety and abuse monitoring. We do not use your content, or data from your connected accounts, to train AI models.

AI can make mistakes. That is why a person reviews and approves everything before it is published.

Health information

VistaraWave is a marketing tool. It is not a medical records system, and it is not designed to receive protected health information (PHI), such as a patient's name together with their condition or treatment, their contact details, date of birth, record or insurance numbers, or identifiable photos taken during care.

• Please do not enter patient health information in drafts, comments, messages to the assistant, uploaded files, or data you send to our conversion tracking.
• Our conversion tracking refuses data that looks like personal details, such as names, email addresses, phone numbers and dates of birth.
• If a patient agrees in writing to appear in your content, keep the signed authorization in your own records. In VistaraWave, record only what your team needs: the person's name, what they agreed to, and the dates.
• Unless we have signed a Business Associate Agreement with your organization, do not use VistaraWave for anything that requires one.

If health information is entered anyway, we use it only to provide VistaraWave to your business, never for anything else. Because content can be sent to our AI providers to complete a task, it may reach them too. Tell us and we will delete it. If we notice it ourselves, we will let your workspace admins know so it can be removed.

Who we share information with

We share information only:

• with the social networks you connect, when we publish your approved posts or read your numbers;
• with service providers that help us run VistaraWave, under contracts that limit their use of it to providing their service to us: hosting and database providers, our email delivery provider for notifications, the AI providers described above, and your browser's push service if you turn on notifications;
• with the people in your workspace, according to the roles your admins set;
• when the law requires it, or to protect the safety, rights or property of our users, the public or us;
• if our company is merged, acquired or sells its assets, in which case this policy keeps applying to your information and we will tell you before it becomes subject to a different policy.

We do not sell personal information, and we do not share it for targeted advertising.

Cookies and your device

This website uses no cookies and no tracking.

The VistaraWave app uses one essential cookie that keeps you signed in, for up to 30 days. The app also saves a few preferences in your browser's local storage, such as the design you picked. If you turn on push notifications, your browser keeps a subscription so we can send them. We use no advertising cookies and no third-party analytics.

How long we keep information

We may keep information longer only where the law requires it, for example business and tax records.

Security

• All connections to VistaraWave are encrypted with HTTPS.
• Account tokens are encrypted with AES-256 before storage, with the key kept separately from the database.
• Passwords are stored only as a one-way hash (Argon2).
• Each business's workspace is kept separate. Roles and permissions decide who can connect accounts, approve and publish.
• VistaraWave keeps an audit log of sign-offs, publishing and account changes.
• Our staff can access customer data only when needed to run or support the service.

No system is perfectly secure. If a security incident affects your information, we will tell you as the law requires. To report a security issue, email hello@vistarawave.com.

Your choices and rights

Depending on where you live, you may have the right to:

• see the personal information we hold about you and get a copy of it;
• correct it;
• have it deleted;
• object to or limit how we use it;
• withdraw your consent, for example by disconnecting an account;
• complain to a data protection authority.

To use any of these rights, email hello@vistarawave.com. We will reply within 30 days and will not treat you differently for asking. If you appear in content a business published with VistaraWave, contact that business first, since it controls that content; we will help it respond.

You can disconnect accounts and remove VistaraWave from each network's settings yourself at any time. See our data deletion page.

Children

VistaraWave is a tool for businesses and is not directed to children. You must be at least 18 to use it. We do not knowingly collect information from children under 13, or under 16 where that is the local rule. If you think a child has given us information, contact us and we will delete it.

Where information is processed

Our servers and service providers may be in the United States and other countries. When we move personal information between countries, we use the safeguards the law requires, such as standard contractual clauses.

Changes to this policy

When we update this policy, we change the effective date at the top. For important changes we tell you by email or in the app before they take effect. If we want to use information from a connected network in a new way, we will ask for your consent first.

Contact us

Questions, requests or complaints about privacy:

hello@vistarawave.com

Or write to us with the form on our contact page.

We aim to reply within 5 business days.