Privacy Policy

Last updated: October 17, 2026

This policy explains what personal information My Social Manager collects, why, who receives it, and the choices you have. We do not sell your personal information, share it for cross-context behavioral advertising, or use it for advertising of any kind.

Who we are

My Social Manager is operated by VIPA, a French company (SAS, Paris Trade and Companies Register no. 108 694 613), 19 rue du Quatre-Septembre, 75002 Paris, France, which determines how your data is used (the “controller” under European law). For any question about your data: contact@vipagence.net.

Information we collect

• Account: email address, password (stored in hashed form, never in plain text), language and time zone, and account creation and login dates.
• Assessment and brand profile: your answers, information about your brand, offer, and audience, your colors, logo, key images (photos and style references), and the video scripts you share.
• Workspace content: strategy, calendars, posts, carousels, scripts, generated visuals, briefs, and files uploaded to the media library (images and videos).
• Connected social accounts (plans with automatic publishing): network, account ID, name and link, and connection date. Access authorizations for the networks are held by our provider Post for Me, not by us. Scheduled posts: text, media, date, status, and any error message returned by the network.
• Brand analysis and tracking (only after you subscribe): public content of your website; the profile and latest public posts of the Instagram, TikTok, and Facebook accounts you provide (text, date, number of likes, comments, shares, views, and saves); the assessment, performance reviews, and history of these figures, updated during follow-up analyses. Images and videos are read during the analysis and never stored: only the descriptions produced by the analysis are kept. They may describe people appearing in your posts.
• Subscription: plan, status, billing history, billing address and, where applicable, tax ID, as well as the date of your request for immediate access to the Service. Card details are processed by Stripe and never stored by us.
• Technical usage: history of AI generations (date, type, volume, model) to enforce your plan’s limits, and our host’s technical logs (IP address, date, page requested) for security.
• How you found us: the website or campaign your visit came from when you created your account (“utm” link parameters, referring site name) and landing page.
• Audience measurement: pages viewed and steps completed on the public website and the assessment (for example “assessment completed”), without cookies or any identifier stored on your device. This data does not identify you and is only used as aggregate statistics.

We do not knowingly collect sensitive personal information as defined by U.S. state privacy laws, and we do not use personal information to make decisions that produce legal or similarly significant effects about you.

How we use it, and our legal bases

• To provide the Service: your account, the analysis of your brand, content and visual generation, publishing the content you schedule, performance tracking, and service emails (account verification, notice before deletion). Legal basis under European law: performance of our contract with you.
• Payment, invoicing, and proof of your request for immediate access: performance of the contract and legal obligations.
• Security, abuse prevention, and cost control (usage limits): our legitimate interest.
• Traffic statistics and measuring the effectiveness of our acquisition channels, to improve the website: our legitimate interest.
• Contacting you again about our services by email, if you created an account without subscribing or after your subscription ended (business-to-business prospecting): our legitimate interest. You can object at any time, free of charge, by writing to contact@vipagence.net.

Your data is never sold or used for advertising. The only marketing emails you may receive are about our own services. Our artificial intelligence providers are used through their business offerings (APIs), whose terms exclude using the data we send to train their models.

Who receives your information

Your information is only accessible to us and to the following service providers, limited to what they need to do their job:

• Vercel Inc. (United States): application hosting, run in the Paris region, and cookieless audience measurement (your IP address is not stored).
• Supabase Inc.: database, authentication, and file storage, with data hosted in the European Union (Paris region).
• Stripe (Stripe Payments Europe Ltd, Ireland, and its affiliates): payment, invoicing, and tax calculation.
• OpenAI (United States) and Anthropic (United States): writing the strategy and content, describing images, and creating visuals, from the brand information we send them.
• Google (United States), Gemini API: analyzing the public videos of your accounts and, depending on the Service settings, creating images for visuals.
• Firecrawl (United States): reading the public content of your website during the analysis.
• Apify Technologies (Czech Republic): reading the public profiles and posts of your Instagram, TikTok, and Facebook accounts during the analysis and follow-up analyses.
• Post for Me (United States): connecting your social media accounts and sending the posts you schedule.
• Brevo (France): sending service emails.

Content you publish is sent to the social networks involved (Meta, TikTok, LinkedIn), which process it under their own policies. Briefs stay in your workspace: they are only shared with VIPAGENCE, VIPA’s creator service, if you contact it. We may also disclose information when required by law or to protect our rights, or to a successor in the event of a merger or acquisition.

International transfers

We are based in France and your data is mainly stored in the European Union. Some providers process data in the United States. Where data leaves the European Union, transfers rely on the EU–U.S. Data Privacy Framework when the provider is certified, or otherwise on the European Commission’s standard contractual clauses.

How long we keep it

Account and workspace data, including your posts’ statistics and your social media connections, is kept as long as a subscription is active. An account without an active subscription (never subscribed or subscription ended) is kept until the end of the current month, with a minimum of seven days, and then permanently erased; we notify you by email beforehand. Only your email address, your brand name, how you signed up and, if applicable, your last plan and subscription end date are then kept, for three years from your sign-up or the end of your subscription, to contact you again, unless you object. If you delete your account yourself, nothing is kept for this purpose.

Videos uploaded to the media library are deleted 3 days after upload if they are not scheduled. A scheduled video is deleted from our storage as soon as it is sent to our publishing provider, which keeps it until publication; only its title and posts remain visible in your media library.

When you delete your account from “My account”, it is deactivated immediately and your data is no longer used; it is kept until the end of the subscription period already paid for, and for at least seven days, so you can reactivate your account by logging in again. It is then permanently erased (profile, content, generation and statistics history, files, credentials, and your social media connections at Post for Me). Technical backups are overwritten within the following days.

Invoices, billing data, and proof of your request for immediate access are kept for ten years by our payment provider, in accordance with French accounting obligations. Technical logs are kept by our host for a few weeks at most.

Cookies and storage on your device

We only use cookies that are necessary for signing in and keeping your session secure, plus a preference cookie (mysmm_locale, kept for one year) that remembers the language of the website you browsed so your account is created in that language. Your assessment answers are kept in your browser’s local storage until you create your account, so you don’t lose them, together with the origin of your visit, which is erased once it is saved to your account. During your visit, the origin is also kept in the tab’s storage, which is cleared when you close it. Audience measurement works without cookies and stores nothing on your device. We do not use advertising cookies or tracking pixels.

Previews of visuals load fonts from Google Fonts, which means your IP address is sent to Google. The payment page, hosted by Stripe, sets its own cookies that are necessary for fraud prevention.

Because we do not track you across websites, we do not respond differently to “Do Not Track” signals; Global Privacy Control signals have no effect because we do not sell or share personal information.

Security

Connections are encrypted (HTTPS). Access to data is limited to your account and to authorized VIPA staff. Provider keys are never exposed in your browser. No method of transmission or storage is completely secure, but we work to protect your information and will notify you of any breach as required by law.

Your rights and choices

Wherever you are, you can ask us to access, correct, delete, or export your personal information, or object to or restrict its use, by writing to contact@vipagence.net. You can delete your account and disconnect your social networks anytime from your workspace. We will not discriminate against you for exercising these rights.

Depending on the U.S. state you live in, you may have additional rights under state privacy laws, including the right to know what personal information we collect and to appeal our decision on your request (by replying to our response at the same address). We may need to verify your identity before acting on a request, and you may use an authorized agent. [applicability of state privacy laws to be confirmed by counsel]

Because we are established in France, you may also file a complaint with the French data protection authority, the CNIL (cnil.fr).

Children

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with information, contact us and we will delete it.

Changes to this policy

We may update this policy. We will notify you of material changes by email or in your workspace before they take effect. See also our Terms of Service.