Privacy policy & cookies

This policy explains how ViaVib handles personal data. ViaVib is a set of marketing tools for businesses: customers join the businesses they like, choose how they want to hear from them, and businesses send offers, manage bookings and loyalty, and schedule social media posts through accounts they connect.

1. Who we are

ViaVib is operated by VIAVIB TECHNOLOGY LTD, a company registered in England and Wales (company number 17513989). Registered office: 81 Bascombe Grove, Dartford, DA1 3RH, United Kingdom. Website: https://viavib.com.

Privacy questions and requests: info@viavib.com (you can also use privacy@viavib.com).

2. Our role and the role of businesses

• ViaVib as controller. We decide how data is used for ViaVib accounts (customers and business users), sign-in and security, the consent and channel choices you record with us, fraud prevention, billing of businesses, support and our own service emails.
• ViaVib acting for businesses. When a business uses ViaVib to write and send its campaigns, run its bookings or loyalty scheme, or publish to its own social media accounts, we handle that data on the business's instructions. ViaVib itself decides who can be messaged, based on the consent you gave us, and blocks messages to anyone who has not agreed or has unsubscribed. The business is responsible for its message content, for what it publishes, and for using the tools lawfully (for example, only marketing to people who have consented on that channel).

3. Information we collect, where it comes from and why

• Account details (from you): email address, password (stored only in hashed form by our sign-in system) or Google sign-in. Used to create and secure your account.
• Optional profile details (from you): name, mobile number, birthday, gender, postcode. Used only if you add them — for example to receive SMS, birthday offers, or offers relevant to your area.
• Business and team membership (from business users): business name, address and contact details, team members and their roles, branches, security and verification settings for business accounts.
• Connections (from you): which businesses you joined, including by scanning a business's QR code or following its invitation or registration link, and when.
• Consent records and marketing preferences (from you): each choice you make per business and channel (email, SMS, WhatsApp), with date and time, kept as a record of what you agreed to.
• Registration by email: if you register by emailing register@viavib.com, we receive your email address and message and reply with a one-use sign-up link that expires after 30 minutes.
• Communications: support conversations, replies to business SMS/WhatsApp messages, and delivery information for messages sent (delivered, bounced, opened where the email provider reports it, unsubscribed).
• Bookings, check-ins, loyalty and receipts: bookings you make with a business, check-ins, VVpoint transactions and rewards, and any legacy stamps retained in the service.
• Billing and membership information (businesses): membership tier, module entitlements, activation and expiry dates, upgrade choices, unused prepaid-value credits, payments, refunds, messaging-credit purchases and usage records. We do not store full card numbers or security codes.
• Technical and security data: a random device ID (stored only in scrambled form), the network (IP) address used for sign-in, bookings and check-ins, and error logs. Used to keep the service secure and prevent fraud and abuse.
• Connected social media account data (businesses only): see section 6, including TikTok connection and draft preparation where enabled.
• Publishing confirmations: the responsible user, business, time, confirmation version, selected account and audience, content references and posting choices. These records show the instructions given; changes may require renewed confirmation.

Businesses never download customers' contact details. They see totals (for example "42 members") and can message customers only through ViaVib, and only on channels the customer allowed.

4. Membership entitlements and internal testing

For business accounts, we may use the organisation’s active subscription tier, billing history, upgrade transactions, permitted modules, expiry date and staff roles to show the full menu, mark unavailable modules “Upgrade”, and enforce access restrictions. These records support contract administration, accounting, service security and preventing unauthorised use. Where an upgrade is offered, we may calculate the remaining membership value and eligible credit from purchase and expiry records; this is not automated decision-making with a legal or similarly significant effect under UK GDPR.

We may designate a specific internal test business for full-module access. Test access is limited to authorised personnel and should not be used to expose real customers’ personal information unnecessarily. Test and production access must remain subject to security controls and audit records. Menu visibility does not mean that restricted services are available or enabled.

5. Our lawful bases (UK GDPR)

• Contract — providing your account, bookings, loyalty, registration links and service emails (for example sign-in, security and booking messages). These are not marketing.
• Consent — marketing by email, SMS and WhatsApp, which under the Privacy and Electronic Communications Regulations (PECR) needs your consent per channel. You can withdraw it at any time.
• Legitimate interests — security, fraud and abuse prevention, keeping the service working, and improving it.
• Legal obligation — keeping records we are required to keep, such as billing records, and proof of consent.
• Business customers' social accounts — contract with the business that connected the account.

6. Consent, preferences and unsubscribing

You choose, per business, which channels you agree to. You can view and change these choices at any time in My ViaVib. Marketing emails include an unsubscribe link. Unsubscribing or withdrawing consent stops future marketing on that channel; it does not affect messages already sent. When you block or unsubscribe, a scrambled (hashed) form of the address or number is kept on a suppression list so it is not messaged again by any business.

7. Connected social accounts

Facebook and Instagram

Only business users can connect social accounts. Customers' Facebook or Instagram data is not collected. A business can connect in two ways:

• Facebook Login — connects Facebook Pages the business manages and Instagram professional accounts linked to them. Permissions requested: pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, instagram_content_publish, business_management. For advertising (only if a business chooses it): ads_management, ads_read.
• Instagram Login — connects an Instagram Business or Creator account directly. Permissions requested: instagram_business_basic, instagram_business_content_publish.

What we access and store: the account or Page ID and name, the access token issued by Meta, the permissions granted, token expiry, the business's own ad account ID and currency (if advertising is connected), the posts and media the business schedules, and results such as the published post ID, errors and, for ads, basic campaign results (for example spend and reach).

What we use it for: only to publish the posts the business schedules, to create and manage the business's own ad campaigns (created paused; they run only after the business explicitly activates them), and to show the business its results. We do not read private messages, comments or followers' personal data, we do not sell Platform Data, and we do not use it for any other purpose or share it with other businesses.

Access tokens are encrypted and stored only on our servers. They are never shown in the app or sent to the browser.

Disconnecting and deletion: a business can press "Disconnect" in Social scheduler → Connections; we delete that account's access token straight away, and any posts still scheduled for it are not published. You can also remove ViaVib in your Facebook or Instagram settings; when Meta sends us its removal or data-deletion notice, we delete the related tokens and disconnect the account. See Data deletion.

TikTok connections, drafts and publishing choices

Customer TikTok connection and draft features are being prepared and depend on configuration and the permissions available for the app. Public customer TikTok publishing is not currently enabled. A saved draft does not automatically publish or authorise a later release.

When you choose to connect your business's own TikTok account through an enabled connection flow, TikTok supplies an account identifier, display name, access and refresh credentials and their expiry information. We obtain available privacy choices, maximum video duration and whether comments, Duet or Stitch are permitted. The connection requests basic account information and publishing permission (user.info.basic and video.publish); the authorisation screen shows the access actually requested and granted. We do not collect your TikTok password.

For a prepared video draft we store the uploaded media, caption, duration, intended time, selected privacy level, interaction switches, commercial-content disclosures and the confirmation record. We use these to prepare the requested content and validate the choices against the connected account. A draft confirmation is a preparation record, and publication must follow the relevant final confirmation and platform controls when available.

TikTok credentials are encrypted and handled on our servers. Disconnecting removes the local connection credentials and invalidates pending connection requests; we also attempt to revoke access at TikTok. A failed provider revocation can require you to remove ViaVib in TikTok's own settings. Disconnecting does not itself delete saved drafts or content already held by TikTok. Contact info@viavib.com to request removal of retained draft media and associated data; there is not currently a self-service TikTok draft-deletion control.

Scheduled and unpublished content

Preparing or scheduling material does not by itself make it public. Businesses are responsible for their content, permissions and publishing choices; ViaVib remains responsible for the processing duties that apply to us. Authorised staff and service providers may process unpublished media to operate and support the service. If an approved publishing feature sends content to a network, that network then processes it under its own privacy terms. Cancelling a job cannot recall a copy already downloaded or published by that network.

Where signed media links are used, they give temporary access to the relevant file. Our current hosting provider has advised that platform request logs can retain full URLs, including query parameters. Link expiry or cancellation stops future access where enforced, but does not delete an existing log entry or recall a downloaded file. The customer TikTok delivery route is not being enabled by this policy update.

8. Service providers and international transfers

We use these providers to run ViaVib. They act on our instructions:

• Hosting and database services (Lovable Cloud and its Supabase-based database integration) — run the website and store account, business and message data, sign-in details and uploaded files. Hosting infrastructure and its subprocessors may also process request logs.
• SMS and WhatsApp messaging services, including Twilio where configured — sends and receives the text and WhatsApp messages businesses send, including phone numbers and message content.
• Email delivery and inbound mailbox providers — sends our emails and campaign emails (email addresses and message content) and receives emails sent to register@viavib.com.
• Google — only if you choose "Continue with Google" to sign in.
• Social networks, including Meta (Facebook and Instagram) and TikTok — for accounts you choose to connect and content you ask to prepare or publish through an available feature. Networks also have their own privacy policies and responsibilities.
• AI text service provider — writes suggested campaign text from a business's short brief and business name. Our own administrators also use it to summarise email-delivery health; that summary can include delivery error messages.
• AI text and image generation provider — generates text and pictures in the email campaign studio from the business's instructions and draft content. Customer contact details are not sent to AI providers by these features.
• Payment and till providers (Stripe, Square, SumUp, Zettle, PayPal and others) — only if a business connects one; these connections are not yet live.

Some of these providers process data outside the UK, including in the United States. We have not verified an exclusive UK or EU location for every service, log or subprocessor. Provider regions and applicable international-transfer documents are still being confirmed. Where a restricted transfer occurs, the relevant adequacy decision or appropriate contractual safeguard and any required assessment must apply; this policy does not claim those checks are complete. Contact info@viavib.com for the current information and safeguard documentation available for a particular service.

9. How long we keep data

We keep your data while your account is open. In My ViaVib → Profile, the account-deletion review shows recorded connections, points and outstanding responsibilities before you submit a verified deletion request. A request is recorded for review; it does not immediately delete your account, anonymise bookings or forfeit balances. Final deletion and record-specific retention processing are not yet automated, so contact us to progress a deletion request. Social media tokens are deleted when an account is disconnected. Registration links expire after 30 minutes and can be used once. After deletion we keep your consent history, separated from your profile and contact details, to show that messages were sent lawfully, and businesses' billing records as the law requires. Retention is determined by the purpose of each record: providing the account or requested draft, showing the instructions and consent given, preventing repeat contact with suppressed recipients, resolving complaints or disputes, and meeting applicable accounting or legal requirements. TikTok drafts are not automatically deleted by disconnection. Backups and provider logs can have separate retention windows; precise deletion schedules and provider log-retention periods are not yet fully confirmed, so we do not promise immediate erasure from every copy. Contact us for a record-specific deletion or retention enquiry.

10. Your rights

Under UK GDPR you can ask to access, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. Many of these you can do yourself in My ViaVib. Otherwise email info@viavib.com; we respond within the applicable legal time limits, normally one month; if an extension or further identity information is lawfully needed, we explain this. If your request is about a business's own use of your data, we will help you contact that business. You have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

11. Cookies and similar storage

We use only storage that is strictly necessary or that remembers a choice you made. ViaVib does not currently set its own advertising or behavioural-analytics cookies. External sign-in providers, social networks or embedded third-party content may process technical data under their own policies when you use those features. Server request logs are separate from browser cookies.

• Sign-in session (browser storage) — keeps you signed in.
• Language choice (a cookie and browser storage, up to one year) — remembers your language.
• Cookie notice (browser storage) — remembers that you saw this notice.
• Device ID (browser storage) — a random ID used for fraud prevention.
• Console menu state (cookie) — remembers whether the business console menu is open.

12. Security

Connections to ViaVib use HTTPS. Two-step sign-in and step-up checks are used where required by the current security policy; requirements can differ during controlled development or testing. Changing verified contact details uses confirmation controls. Access to data is restricted by database rules so businesses cannot read customers' contact details, and access tokens and provider keys are encrypted and kept server-side only. No system is completely secure; if a breach affects you, we will tell you and the ICO where the law requires.

13. Children

ViaVib is not aimed at children. If you believe a child has created an account, contact us and we will delete it.

14. Changes

We will update this page when our practices change and change the date at the top. For significant changes we will tell account holders by email or in the app.