Privacy Policy

1. Scope

VCE is a private, workspace-based platform for approved Flow Media users, team members, and authorized client collaborators. This policy covers the website, account access, content analysis, reports, and optional Google Sheets exports. It does not replace the separate privacy policies of Google, Meta/Instagram, or other providers you may choose to use.

2. Information we collect and process

• Account and authentication data: your email address, account role, Workspace access assignments, authentication status, login timestamps, and identifiers returned by our sign-in provider. Password authentication is handled through Supabase Auth rather than a custom plaintext password database.
• Workspace content: names and settings of Workspaces; user-provided documents, media, notes, client brand knowledge, Projects, scripts, and other content uploaded or entered by authorized users.
• Public social-media research: content and account information collected or supplied for Instagram research, including usernames, public posts, Reels, captions, media, engagement metrics, dates, performance comparisons, and analysis results.
• Service and diagnostic data: usage records, account actions, processing status, error details, security-related events, and potentially device, browser, IP address, or connection information in infrastructure logs.
• Connected Google account data: as explained below, a Google account email and OAuth authorization credentials when you deliberately connect Google Sheets.

3. Google Sign-In and Google Sheets permissions

Google Sign-In

VCE's Google admin sign-in is managed through Supabase Auth. Google identity information, such as your account email and identifiers, is used to verify your identity and determine whether your account has been approved for access. The Google consent screen may identify this OAuth integration as “Flow Software,” a Flow Media application used for Viral Content Engine. A Google account is not automatically connected to Google Sheets just because you sign in.

Optional Google Sheets export

When an authorized user chooses Connect Google Sheets, VCE requests access to the Google account's email and the Google Drive per-file permission (drive.file). The requested permission allows VCE to create and manage files it creates or that the user explicitly opens or shares with the app; it is not a request to browse or read every file in the user's Drive.

We use these permissions to identify the connected Google account, obtain and refresh authorized access, and create formatted idea-sheet spreadsheets in the Drive belonging to the person who connected their Google account. Sheet content comes from the VCE Workspace and the user's requested export. Connecting your account does not make another team member's exports save to your Drive.

VCE stores the Google account email and an encrypted OAuth refresh token in its access-controlled database to maintain the connection. Short-lived access tokens are used to make Google API requests. The application does not request access to your Gmail messages, Google Contacts, or your entire Google Drive. Google OAuth data is not used to train AI models, sell profiles, or target advertising.

VCE sends the requested export rows to Google to create your spreadsheet. Google then processes and stores that spreadsheet under your Google account according to Google's policies. VCE does not automatically make the created spreadsheet public or share it with other accounts; you control sharing from Google Drive.

Google API Services User Data Policy / Limited Use: Our use of information obtained through Google APIs is limited to the user-facing sign-in and Sheets export functions described here and is subject to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it to serve ads, or allow unrelated human review of connected Google account data. Access by service providers is limited to operating and securing these requested functions, subject to applicable obligations.

4. Why we process information

We process information to authenticate users; enforce account roles and Workspace permissions; collect and organize content authorized for research; generate analyses, scripts, reports and exports; operate and troubleshoot the Service; protect against misuse; handle support requests; and comply with applicable legal obligations. Features that use AI may send relevant input content and saved analyses to a model provider to generate the requested result. Review generated output before acting on it.

5. Who can access information

Information in a Workspace may be available to users who have been granted access to that Workspace under its roles and permissions. We also rely on infrastructure and service providers for hosting, database and authentication (including Supabase), app hosting (including Railway), Google identity and Sheets exports, AI processing (including Gemini), email delivery, and Instagram research infrastructure. These providers process information as required to deliver the applicable service. We may disclose information where required by law, to protect rights or security, or in connection with a legitimate business reorganization subject to applicable obligations.

We do not sell information obtained through Google APIs. Third-party sites and social networks you visit through VCE are subject to their own policies.

6. Cookies, sessions and security

VCE uses authentication and session cookies or similar mechanisms to remember sign-ins and protect account access. Our systems use access controls, server-side secrets, and encrypted storage for Google refresh tokens; however, no online service can guarantee absolute security. Users should protect their credentials, use trusted devices, and promptly report suspected unauthorized access.

7. Retention

We retain account, Workspace, analysis, and operational records for as long as needed to provide the Service and fulfill legitimate operational, security, or legal requirements. An authorized account holder or administrator may request removal or correction of data, subject to applicable requirements and any obligations to preserve certain records. Residual copies may persist temporarily in backups or logs. Revoking a Google connection stops future authorized API access once revoked, but previously exported spreadsheets remain in the Google user's Drive until that user changes or deletes them.

8. Your choices and requests

• Use Google Account security settings at myaccount.google.com/connections to review or revoke VCE's access to your Google account.
• Request disconnection of a Google Sheets account and deletion of its stored authorization credentials by emailing us.
• Ask for access to, correction of, or deletion of personal data associated with your VCE account, subject to role permissions, identity verification, and applicable law.
• Contact your Workspace administrator to change Workspace membership or access permissions.

Deleting or disconnecting VCE's credentials does not automatically delete spreadsheets you own in Google Drive. You can manage those files directly in your own Google account.

9. Location of processing and children

VCE is operated from the United States, and its service providers may process information in other locations. VCE is a business research product intended for adults and authorized professionals, not children under 18. We do not knowingly invite children to register; contact us if you believe a child submitted personal information.

10. Policy changes

We may update this policy as our features and processing practices change. Material changes affecting connected Google account data will be communicated as appropriate, and renewed permission will be requested when required. The date above indicates when this version took effect.

11. Contact

Privacy requests and questions can be sent to info@flow-media.co.

Flow Media Marketing LLC (doing business as Flow Media), Florida, United States. Product: Viral Content Engine, viralcontentengine.com.