This policy covers the Velivoa website, the signed-in app, and the emails the service sends. It also covers the optional YouTube connection, which uses Google APIs. The social networks themselves, Google, and our payment page are separate services with their own policies. Links are in the sections below.
In short: we only collect what we need to run Velivoa for you. We never ask for your Google or social media passwords. We never sell your information. We do not use anything we receive from Google or YouTube for advertising, for building profiles about you, or for training AI. You can disconnect your YouTube channel whenever you like, and when you do, we delete the keys that give us access.
GoogleHow Velivoa accesses, uses, stores, and shares Google user data
This section is the complete description of Google user data in Velivoa. Velivoa accesses Google user data only when you choose to. Signing in with Google and connecting a YouTube channel are two separate choices. Velivoa uses YouTube API Services. The rest of this policy covers the same facts in more detail.
What Google user data Velivoa accesses
If you sign in with Google, Velivoa accesses only the Google user data returned for the openid, email, and profile permissions: your name, your email address, your profile picture, and your Google account ID. Signing in with Google does not give Velivoa access to YouTube.
If you connect a YouTube channel, Velivoa accesses Google user data through the YouTube Data API (version 3). We ask for one permission, https://www.googleapis.com/auth/youtube.force-ssl, which Google displays as "See, edit, and permanently delete your YouTube videos, ratings, comments and captions". We need that permission because Velivoa lets you upload, edit, and delete your own videos, and read and reply to comments on your videos from the Velivoa Inbox. Replying to comments is only possible with this permission. The Google user data we then access is:
- Your channel. Its ID, name, handle, description, profile picture, country, creation date, subscriber count (only if you show it publicly), video count, view count, whether it is public, whether it may upload long videos, and whether it is set as made for kids.
- Your uploaded videos. Title, description, tags, category, thumbnail, duration, publish date, privacy status (public, unlisted, or private), any scheduled publish time, processing status, made-for-kids setting, and view, like, and comment counts.
- Comments on your videos. For each comment thread on your channel's videos: the comment ID, the text, the commenter's public display name, profile picture and channel link, the like count, the time it was posted, the number of replies, the replies themselves, whether replies are allowed, and which video it is on. We also store the replies you post from Velivoa. If you choose Save as lead on a conversation, the commenter's public name, picture, channel link and comment are copied into your lead list; that copy is removed when the conversation is deleted from the Inbox, unless you have replaced it with details you typed yourself.
- The uploads playlist only. The automatic list YouTube keeps of videos on that channel, so Velivoa can find those videos. We do not read, create, or change any other playlist.
If you connect Google Calendar for WhatsApp bookings, Velivoa asks for one calendar permission, https://www.googleapis.com/auth/calendar.app.created, which Google displays as "Make secondary Google calendars, and see, create, change, and delete events on them", plus openid and email so we can show which Google account is connected. With it Velivoa creates one calendar called "Velivoa bookings" in your Google account and adds, moves and removes appointment events in that calendar only. Each event holds the appointment title and time, the customer's WhatsApp name and number, the place, any note your team typed, and a link back to Velivoa. Velivoa cannot see your other calendars or any event Velivoa did not create, and it never reads events back to decide anything: bookings come from Velivoa's own records.
Velivoa does not access your Gmail, Google contacts, Google Drive, your other Google calendars, YouTube Analytics, captions, ratings, comments you wrote on other people's channels, subscriber list, watch history, likes, messages, channel memberships, or YouTube payments. Velivoa never asks for or stores your Google password or your YouTube password.
How Velivoa uses Google user data
Velivoa uses Google user data only to provide and improve the user-facing features you can see in the Velivoa app.
We use Sign in with Google data to create your Velivoa account and to sign you in. We use YouTube data to show the connected channel and its videos in Velivoa, to upload a video, edit a video's details, or delete a video when you, or a teammate you have given that role, ask us to, and to show the comments on your videos in the Velivoa Inbox so you can read them and reply. A reply is posted to YouTube only when someone in your workspace writes or approves it and presses Send. We use the Google Calendar permission only to keep the "Velivoa bookings" calendar in step with the appointments in your workspace, so your team sees them on their phones and gets a reminder before each one. Velivoa does not change anything on your channel unless someone in your workspace asks it to.
Velivoa does not use Google user data for targeted advertising, personalised advertising, retargeted advertising, interest-based advertising, selling data to data brokers, providing data to information resellers, determining credit-worthiness, lending, creating databases, or any purpose that is not a feature you can see in Velivoa.
Velivoa does not use Google user data from Google APIs, including YouTube API Services, to develop, improve, or train generalized, non-personalized, or personalized AI or machine learning models. Data obtained through Google APIs is never used to train AI or machine learning models. The one exception is the optional Write with AI button in the Velivoa Inbox. When you, or a teammate, click it on a comment thread, Velivoa sends the text of that one thread (the comments, the display names of the people who wrote them, and the video title) and any instructions you typed to our AI provider, OpenAI, only to write one suggested reply for you to review. Nothing is posted until you press Send. Nothing is sent to the AI provider unless you click the button, and we never send your tokens, your channel details or your video list. Our AI provider processes that text only for us, under an agreement that does not let it use the text to train its models.
Velivoa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing YouTube and sign-in features described here.
With whom Velivoa shares, transfers, or discloses Google user data
Velivoa does not sell Google user data. We do not transfer or disclose your Google user data to third parties for purposes other than providing or improving the Velivoa features described in this policy. We do not transfer Google user data for advertising, to data brokers, to information resellers, or for training AI or machine learning models.
We share Google user data only as follows:
- Your workspace. People you invite can see the connected channel, its videos and the comments in the Inbox. Editors can upload, edit and reply to comments. Managers and owners can delete videos or disconnect the channel.
- Google and YouTube. When you ask Velivoa to upload, edit, or delete a video, or to post a reply to a comment, we send that video, the details you entered, or your reply to YouTube, because that is the action you requested.
- Our AI provider (OpenAI), only when you ask. When you click Write with AI on a comment thread in the Inbox, the text of that thread goes to OpenAI to draft a reply, as described above. It is not used for training.
- Google Calendar. When an appointment is booked, moved or cancelled, we send that change to the "Velivoa bookings" calendar in the Google account your workspace connected. Nothing from Google Calendar is sent to our AI provider.
- Our hosting provider. Encrypted access tokens and the small channel record are stored on infrastructure we control, only so the YouTube and calendar features can run.
We do not share Google user data with advertisers, advertising networks, data brokers, information resellers, or Paystack. Our AI provider receives only the comment threads you choose to draft a reply for.
How Velivoa protects Google user data
Security procedures are in place to protect the confidentiality of your Google user data. We use encryption to protect it. Traffic to Velivoa is encrypted with HTTPS. Access tokens and refresh tokens are encrypted before they are saved, using Fernet authenticated encryption (128-bit AES with an HMAC-SHA256 integrity check). The encryption keys are stored separately from the database. Tokens are never sent to your browser, never shown in the app, and never written in our logs.
How long Velivoa keeps Google user data, and how you delete it
We retain Google user data only for the length of time needed to fulfill the purposes in this policy, unless a longer period is required by law. While a channel stays connected we keep its ID, name, handle, picture link, uploads-playlist ID, long-upload status, the permission you granted, and the encrypted tokens. A short-lived copy of the channel overview is kept for up to 10 minutes, and of the video list for up to 2 minutes, and is then deleted. Comment threads shown in the Inbox, with any reply draft, are refreshed from YouTube every time Velivoa checks for new comments, and a thread YouTube has not returned for 30 days is deleted automatically. When you disconnect the channel, we delete the tokens, the short-lived copy and all of that channel's comment threads immediately. For Google Calendar we keep only the connected email address, the ID of the "Velivoa bookings" calendar, the encrypted refresh token and, on each appointment, the ID of its event. When you disconnect Google Calendar (WhatsApp, then Bookings, then Disconnect) we revoke our access with Google and delete the token and calendar ID immediately; the calendar and its events stay in your Google account for you to keep or delete.
When the retention period for a given type of Google user data expires, we delete or destroy it. You may request that your Google user data, or your whole Velivoa account, be deleted by emailing support@velivoa.com from the email address on your Velivoa account. We confirm the request and finish it within 30 days. The steps are on our data deletion page.
You can disconnect a YouTube channel inside Velivoa: open Social Accounts, choose Manage channel, and click Disconnect. We then delete the access tokens. You can also revoke Velivoa's access without opening Velivoa, on the Google security settings page at https://myaccount.google.com/permissions (the same page is at https://security.google.com/settings/security/permissions). Choose Velivoa and select Remove access. After you revoke access, Velivoa can no longer read or change the channel.
By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy. Questions or complaints about these practices go to info@velivoa.com.
01Who we are
Velivoa runs the service at velivoa.com and is responsible for the personal information described here. When we say "we" or "us" in this policy, we mean Velivoa.
If you join a workspace that someone else owns, that owner chooses who on the team can see the workspace. We still handle personal information as this policy describes. Privacy questions and requests go to info@velivoa.com.
Where the Kenya Data Protection Act 2019 applies, Velivoa is the data controller for the personal information in your account. Where the GDPR applies, we are the controller for the same information. A workspace does not become a separate controller of Google or YouTube data: that data is used only to provide the YouTube features inside Velivoa.
02What we collect
Most of what we hold is information you type in, upload, or agree to share when you connect an account. The table is the map. The paragraphs under it are the detail.
| Category | Examples | Why we have it |
|---|---|---|
| Account | Name, email, password hash, time zone, profile picture | Create your account and keep you signed in |
| Sign in with Google | Name, email, picture, Google account ID | Let you sign in without a separate password |
| Content you create | Posts, captions, media, brand profile, campaigns, leads and notes, AI Agent chats, invites | Draft, schedule and publish what you ask us to |
| Connected accounts | Name, username, ID, picture, permissions, tokens | Publish to the accounts you pick |
| YouTube | Channel and video details described in section 4 | Show and manage your channel inside Velivoa |
| Billing | Plan, invoices, wallet, card brand and last four digits | Charge the plan you choose and show receipts |
| Technical | IP address, browser, time of the request, activity log | Keep the service secure and fix problems |
| Messages to us | Support and privacy emails you send | Reply to you and keep a record of the request |
We do not use advertising trackers, and we do not buy or sell data.
When you create an account
We ask for your name, email address and a password. We never keep your password itself, only a secure one way hash of it (Argon2). We also keep your time zone and, if you add one, a profile picture. We record when your email address was confirmed.
If you sign in with Google
Google tells us your name, email address, profile picture and your Google account ID. For this we ask Google only for the basic openid, email and profile permissions. Signing in with Google does not give us any access to YouTube. YouTube is a separate, optional connection, described below.
What you put into Velivoa
This is the posts, captions, hashtags and links you write, the photos and videos you upload, video titles, descriptions and tags, your workspace name, the brand profile you give our AI (things like your business description, audience and tone of voice), the email addresses of teammates you invite, your campaigns, and the leads you add (the name, phone number, email address, interest and notes you type about a person who contacted you). You are responsible for having a lawful reason to keep details about the people you add as leads. We strip location and camera details out of photos when you upload them.
If you invite someone, we store the email address you entered and send them an invitation. If they never join, that address is only there so the invite can be completed or cancelled.
Billing
We keep your plan, invoices, wallet balance and payment history. Card payments go through Paystack. The card form is Paystack's, so we never see or store your full card number or the security code. After a successful payment we keep the card brand, the last four digits and the expiry, so you can see which card is on file, and an encrypted authorisation from Paystack so a renewal can be charged without asking you to type the card again. You can pay from your wallet instead of a card.
Technical information
We keep your IP address, browser type and the time of each request so we can keep the service secure and fix problems. We also keep an activity log of important actions in your workspace, for example who connected an account, published a post, changed a video or deleted a YouTube video, so your team can see what happened. The log records the action. It does not keep a second copy of the post or the video.
03What we don't collect
A few things people assume a social tool must be holding. We are not:
- Your password for Google, YouTube, Facebook, Instagram, LinkedIn, X or TikTok.
- Your Gmail, contacts, Google Drive, Calendar, or YouTube Analytics.
- YouTube subscribers, watch history, likes, captions, messages, channel memberships or payment details, or comments you wrote on other people's channels.
- Your precise location. We remove location and camera details from photos on upload, and we do not ask the browser for GPS.
- Your full payment card number or card security code.
- Advertising identifiers, and we do not follow you around other websites.
04Google and YouTube
Velivoa uses Google APIs, including the YouTube Data API (version 3), so that you can manage your YouTube channel from Velivoa. Connecting YouTube is optional. You start it yourself from Social Accounts, Google shows you exactly what Velivoa is asking for, and nothing is connected unless you agree.
Separate from Sign in with Google. Signing in only identifies you. Connecting a channel is a second step, with a different permission, and you can use Velivoa without ever taking it.
The permission we ask for
We ask Google for one permission only: https://www.googleapis.com/auth/youtube.force-ssl, which Google shows as "See, edit, and permanently delete your YouTube videos, ratings, comments and captions". We need it because Velivoa lets you edit and delete your videos, not just upload them, and lets you reply to comments on your videos from the Inbox. YouTube only allows replying to comments with this permission, and it also covers uploading, editing and deleting videos, so instead of asking for several permissions we ask for this single one. Velivoa does not read or change your captions or ratings, even though the permission's name mentions them. We do not ask for access to your Gmail, contacts, Google Drive, YouTube Analytics or any other Google product. Connecting YouTube does not give us your Google email address or password.
What we read from YouTube
Your channel
ID, name, handle, description, profile picture, country, the date it was created, subscriber, video and view counts (the subscriber count only if you show it publicly), whether it is public, whether it is allowed to upload long videos, and whether it is set as made for kids. We show this on your channel page so you can see which channel is connected and how it is doing.
Your uploaded videos
Title, description, tags, category, thumbnail, length, publish date, who can see it (public, unlisted or private), any scheduled publish time, whether YouTube has finished processing it, whether it is set as made for kids, and its view, like and comment counts. We use this to list your videos so you can review, edit or remove them.
Comments on your videos
The comment threads on your channel's videos: each comment's text, the commenter's public name, picture and channel link, likes, when it was posted, and the replies. We show these in the Inbox so your team can read them and answer from one place. We check for new comments about every 15 minutes, and when you press Check for new.
The uploads list only
Every channel has an automatic "uploads" list that YouTube keeps for it. We read that list, and only that list, to find your videos. We do not read, create or change any of your other playlists.
We do not read your subscribers, watch history, likes, captions, messages, channel memberships, analytics reports or payment details, or comments you wrote on other channels.
What we change on YouTube
Velivoa only changes something on your channel when you, or a teammate you have given that role in your workspace, asks it to. That means uploading a video you chose, with the title, description, tags, category, audience setting and visibility you entered; editing those details on one of your videos; or deleting a video you picked. You can upload straight away or schedule the upload for later.
In the Inbox, Velivoa posts a reply to a comment only when someone in your workspace presses Send. An AI draft is never posted on its own. We do not like, subscribe, message anyone, hide or delete comments, or change channel settings you did not ask us to change.
What we keep
While your channel is connected we keep a small record of it: the channel ID, name, handle, a link to its picture, the ID of its uploads list, whether it can upload long videos, the permission you gave, and your encrypted access tokens. So that we don't ask YouTube for the same thing over and over, we keep a short lived copy of your channel overview for up to 10 minutes and of your video list for up to 2 minutes. That copy sits in private memory on our own server and is thrown away when it expires or when you disconnect.
For videos you upload through Velivoa, we keep the post you made (the file and the details you typed) plus the video's ID and link, so you can see your posting history. For edits and deletions, our activity log records which video was changed, which fields, by whom and when. It does not copy the content itself.
For the Inbox we keep the comment threads on your videos (the details listed above) and the replies sent from Velivoa, with who sent them. A thread is deleted automatically when YouTube has not returned it for 30 days, and straight away when you disconnect the channel. We do not keep a permanent copy of your video list, your statistics or anything else from your channel.
05Other social accounts
You can also connect Facebook, Instagram, LinkedIn, X and TikTok. Each connection is optional and starts from Social Accounts. The platform shows you the permissions it is granting. Nothing is connected unless you approve it.
From an account, page or profile you pick, we receive its name, username, ID and picture, the permissions you approved, and the access tokens that let us act for you. We use them to publish and schedule the posts you create, and to show those accounts in your workspace. When a post goes out, we keep its ID and link so your history stays intact.
Apart from WhatsApp Business (below), which exists to receive the messages people send to your business number, we do not ask those platforms for your password, your private messages, or a list of your friends or followers to build our own contact list. What a given platform allows Velivoa to do is limited to the permissions you approved on that platform's screen.
You can disconnect any of these accounts inside Velivoa, or revoke Velivoa from the platform itself. Steps for each network are on the data deletion page.
WhatsApp Business
You can connect a WhatsApp Business number through Meta's official WhatsApp Business Platform. We then receive the messages people send to that number (text, photos, voice notes, documents, locations and contact cards), their WhatsApp name and number, and delivery and read receipts for the messages your team sends. We keep these so your team can read and answer chats in Velivoa, run the automations you switch on, send the broadcasts you create, and show you how they did.
For those chats, your business decides what happens to your customers' messages and Velivoa handles them on your behalf. You are responsible for having your customers' agreement before you send them broadcasts. When someone replies STOP we mark them as opted out and leave them out of future broadcasts automatically. Photos and files people send are stored privately on our server and are only shown to signed in members of your workspace. Meta's own handling of WhatsApp messages is covered by WhatsApp's and Meta's privacy policies.
If your business keeps using the WhatsApp Business app on its phone (coexistence), we also receive the messages sent from that phone, the business's WhatsApp contacts, and, if the business agrees on the phone, up to six months of past chats, so the conversations in Velivoa are complete. If your business adds helpers, customer messages are forwarded to the helper's own WhatsApp number or shown to them through a private link that the business can switch off at any time.
Website chat widget
A business can add Velivoa's chat bubble to its own website. When a visitor writes in it, we receive and keep their messages, the name and email they choose to give (if the business asks for them), the address of the page they started the chat on (without anything after a question mark), and their browser's user agent, so the business's team can answer them in Velivoa. To keep the chat going when the visitor comes back, the widget stores a random chat key in that browser's local storage on the business's website; it is not used to track anyone across other sites, and clearing the browser's site data ends the chat. As with WhatsApp chats, the business decides what happens to these messages and Velivoa handles them on its behalf.
06How we use your information
We use your information to run Velivoa for you: to save your drafts, publish and schedule your posts, manage your YouTube videos when you ask, show you how things went, manage your workspace, team and plan, and send you the emails the service needs (like confirming your email address, inviting a teammate, or resetting your password). We send marketing emails only if you agree to them, and every one has an unsubscribe link.
We also use technical information to keep the service safe, for example to block abuse, protect accounts and investigate errors. We may look at overall usage numbers, such as how many posts are published each day, to improve Velivoa. Those numbers never include anything we received from Google or YouTube.
Why the law lets us
Where data protection laws such as the Kenya Data Protection Act 2019 or the GDPR apply, we rely on the grounds below.
| Ground | What it covers |
|---|---|
| Contract | Running the account you signed up for: drafts, scheduling, publishing, the workspace, and billing |
| Consent | Optional steps you start yourself, such as connecting YouTube or another social account, Sign in with Google, and marketing emails. You can withdraw these. |
| Legitimate interests | Keeping Velivoa secure, preventing abuse, fixing errors, and understanding overall product usage without Google or YouTube data |
| Legal obligation | Records we have to keep, such as invoices required by tax law |
We do not use your information to make decisions that produce legal effects about you, or that similarly significantly affect you, by automated means. AI features draft text and visuals for you to review. Plan limits are usage counters, not a judgement about you.
07Our AI features
Velivoa can help you write captions, hashtags and descriptions, suggest post ideas, rewrite a draft, plan the posts of a campaign, chat with you in the AI Agent, and create an image or a short video to go with a post. You choose when to use these. Nothing is sent for an AI suggestion unless you ask for one.
When you do, we send your instructions, the text you are working on in Velivoa, and your brand profile to our AI provider, which is currently OpenAI, to get a suggestion back. For an image or video we also send the description of the visual. For a campaign plan we also send the campaign name, goal, dates and description. When you send a message to the AI Agent, we also send a summary of your workspace so it can give useful advice: your recent and scheduled posts and drafts (titles and captions), your campaigns, counts of your leads by stage, and the name, stage and interest of up to 10 open leads you added yourself. The Agent never receives YouTube comments, YouTube statistics, your YouTube channel's name, or leads saved from YouTube comments. Agent chats are private to the person who started them. The finished file is saved in your media library, the same way an upload is. We keep the suggestion, and whether you accepted, edited or rejected it, so the draft is there when you come back. We also keep a usage record (which feature, when, and how much of your plan it used) so plan limits can be applied.
If your workspace turns on the WhatsApp AI agent, or a teammate asks for a suggested reply in a WhatsApp or website chat, we send the latest messages of that chat (up to 20), your brand profile and the knowledge and instructions you wrote for the agent, so it can write the next reply. The agent answers website chat visitors too, and only runs on chats where a customer has written to you, stops in a chat once a teammate replies or it hands over, and you can switch it off at any time.
Our provider processes this for us only and, under our agreement, does not use it to train its models. We do not use your content to train our own models.
We never use anything we receive from Google or YouTube to build, improve or train any AI or machine learning model, ours or anyone else's. The only YouTube data our AI provider ever sees is a comment thread you click Write with AI on in the Inbox, sent so it can draft one reply for you to review.
You should read AI output before you publish it. It can be wrong, and you are responsible for what you post. More on that is in our Terms of Service.
08Who we share it with
We do not sell or rent your information to anyone. We share it only when we need to in order to run Velivoa.
- YouYour account and content. Posts, media, brand profile and the accounts you connect stay in your workspace.
- VelivoaUsed to provide the product. Drafts, publishing, YouTube tools you open, billing and security.
- Only when neededThe services below. A platform you publish to, Paystack for a card payment, or the AI provider when you ask for a suggestion.
- The platforms you connect, when we publish or manage content there because you asked us to. For YouTube this means sending your video and its details to YouTube.
- Your own workspace. People you invite can see what their role allows. Everyone in the workspace can see the connected YouTube channel and its videos, editors can upload and edit, and managers and owners can delete videos or disconnect the channel.
- Companies that help us run the service, listed below. They may only use your information to do that job for us.
- When the law requires it, or to protect our users or the public from fraud or harm.
- If Velivoa is ever sold or merged, in which case this policy would continue to protect your information and we would tell you first.
| Who | Role | What they receive |
|---|---|---|
| Paystack | Card payments | The details needed to charge the card and confirm the payment. Not your posts, and not Google or YouTube data. |
| OpenAI | AI suggestions, images and video | Your instructions, the draft you are working on, your brand profile, and a visual prompt if you ask for one. From YouTube, only a comment thread you click Write with AI on. From WhatsApp and website chat, the recent messages of a chat the AI agent answers or you ask a suggestion for. Never tokens or channel data. |
| Meta (WhatsApp) | Sending and receiving WhatsApp messages | The messages, files and templates your team, automations, broadcasts or AI agent send, and the number they go to. |
| Sign-in, YouTube, and fonts | The sign-in profile if you choose it; YouTube data for a channel you connect, and the replies you send; your IP address when pages load fonts. | |
| Email delivery | Service email | Your email address and the message, for example a verification or password reset. |
| Hosting | Running Velivoa | The information we store in order to operate the service, on infrastructure we control. |
We never share Google or YouTube data with advertisers, advertising networks, data brokers or information resellers.
09Limited Use of Google data
Velivoa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, this means:
- We use Google and YouTube data only to provide the YouTube features you can see and use in Velivoa, as described above.
- We do not use it, or pass it on, for advertising of any kind, including personalised or retargeted ads.
- We do not use it to build a profile of you, to judge credit worthiness or for lending, or for anything unrelated to the features you use.
- We do not use it to develop, improve, or train generalized, non-personalized, or personalized AI or machine learning models. The only Google data an AI provider receives is a comment thread you ask Velivoa to draft a reply for, and it is processed only to write that draft.
- We do not sell it, and we do not share it with advertisers, data brokers or information resellers.
- We do not allow humans to read it, unless you ask us to (for example when you contact support about a problem with your channel), it is needed to investigate abuse or a security issue, the law requires it, or it has been combined and made anonymous for internal operations.
Our YouTube features also follow the YouTube API Services Terms of Service. By connecting a channel you agree to the YouTube Terms of Service. Google's own handling of your data is described in the Google Privacy Policy. You can revoke Velivoa's access at any time at https://security.google.com/settings/security/permissions.
10How we protect your access tokens
When you connect YouTube, Google gives Velivoa two tokens: an access token that works for about an hour, and a refresh token that lets us get a new access token without asking you to sign in again. Tokens for other social accounts are protected the same way. This is how we store them:
- They are exchanged directly between our server and the platform over an encrypted connection. They are never sent to your browser, never shown in the app and never included in anything our API sends back.
- They are encrypted before they are saved to our database, using Fernet authenticated encryption (128 bit AES with an HMAC SHA256 integrity check). The encryption keys are kept separately from the database.
- The YouTube connection step is protected by a random, single use code that expires after 10 minutes and by PKCE, and it has to be finished by the same signed in Velivoa user who started it. This stops anyone from slipping their own channel into your account, or yours into theirs.
- Our logs never contain tokens, passwords or our Google client secret.
- If Google tells us access has been revoked or has expired, we stop using the tokens straight away and ask you to reconnect. The same applies when another platform revokes access.
11Security
All traffic to Velivoa is encrypted with HTTPS, and browsers are told to always use it. Passwords are hashed, tokens are encrypted, and each workspace can only see its own accounts, posts and channels. We also use role based permissions inside workspaces, protection against cross site request forgery, rate limits, an activity log, and we limit which of our own staff can access production systems.
No service can promise perfect security, so please use a strong password that you don't use anywhere else, and tell us right away at support@velivoa.com if you think someone has got into your account. We will investigate and tell you if a breach affects your personal information, as the law requires.
12How long we keep things
We keep information only for as long as the reason in this policy still applies, then we delete it or anonymise it.
| Information | How long |
|---|---|
| Account, workspace, posts and media | While your account is open |
| Access tokens | Deleted the moment you disconnect that account or channel |
| YouTube comment threads (Inbox) | 30 days after YouTube last returned the thread, or immediately when you disconnect the channel |
| Details copied into a lead from a YouTube comment | Removed when the source comment thread is deleted (see the row above), unless you replaced them with details you typed yourself |
| WhatsApp chats, files and delivery receipts | While the number is connected and the workspace is open. Disconnecting the number deletes its chats and files |
| Website chat messages and visitor details | While the workspace is open, or until you delete the visitor's contact |
| WhatsApp contacts and opt outs | While the workspace is open, or until you delete the contact |
| Leads, notes and AI Agent chats | While the workspace is open, or until you delete them |
| Short lived YouTube copy | Channel overview up to 10 minutes, video list up to 2 minutes, or immediately on disconnect |
| AI suggestions you asked for | While the workspace is open, so you can reuse the draft |
| Security and activity logs | Up to 12 months |
| Billing records | As long as tax law requires |
| After you ask us to delete the account | Deleted or anonymised within 30 days, including Google and YouTube data, then removed from backups within a further 90 days |
13Your choices
You do not have to email us for most of this. Inside Velivoa you can:
- Update your name, email, password, time zone and profile picture from your account.
- Edit or delete drafts, posts and uploaded media.
- Disconnect a social account or YouTube channel. Tokens are deleted at that moment.
- Leave a workspace, or remove a teammate if your role allows it.
- Cancel a paid plan from Billing. Access continues until the end of the period you already paid for.
- Unsubscribe from marketing using the link in those emails. Service emails, such as password resets, do not have an unsubscribe because the account needs them.
You can also remove Velivoa's access from the platform side without opening Velivoa. For Google and YouTube that page is myaccount.google.com/permissions. The other networks are listed on the data deletion page.
14Disconnecting YouTube
You can remove Velivoa's access to your channel at any time, in either of two ways:
- From Velivoa. Go to Social Accounts, open Manage channel for your YouTube channel and click Disconnect. We immediately ask Google to cancel our access, delete your access and refresh tokens, and delete the short lived copy of your channel and video data and all of the channel's comment threads in the Inbox.
- From your Google account. Visit myaccount.google.com/permissions, choose Velivoa and select Remove access. Our access stops right away and Velivoa will show the channel as needing to be reconnected.
After you disconnect, the channel's name, ID and picture link stay attached only to posts you already published through Velivoa, so your posting history still makes sense. You can remove those by deleting the posts, or by asking us to delete your data. Videos that are already on YouTube stay there until you delete them on YouTube. Disconnecting YouTube does not delete your Velivoa account, and disconnecting Sign in with Google is a separate step at myaccount.google.com/connections.
15Deleting your data
To have your Velivoa account deleted, or just the Google and YouTube information we hold about you, email support@velivoa.com from the email address you use for Velivoa and tell us what you would like removed. We will confirm the request, finish it within 30 days and let you know when it is done.
A full account deletion removes your profile, workspaces you own, posts, uploaded media, campaigns, leads, Inbox conversations, AI drafts and Agent chats, and connected account tokens, and removes you from workspaces owned by other people. If you own a workspace that still has other members, we will ask whether to transfer it to another admin before we delete it. Billing records we are required to keep are retained or anonymised as the law requires. The full steps are on our data deletion page.
Deleting something inside Velivoa does not delete it from a social network if it was already published there. You delete that copy on the network.
16Your rights
Depending on where you live, including under the Kenya Data Protection Act and the GDPR, you can ask us to:
Access
Get a copy of the personal information we hold about you.
Correction
Fix information that is wrong or incomplete. Most profile fields you can edit yourself.
Deletion
Ask us to delete your account, or only the Google and YouTube data, as described above.
Portability
Receive the information you gave us in a format you can take elsewhere, where the law provides that right.
Objection and restriction
Object to or limit a use that is based on legitimate interests, including overall product analytics.
Withdraw consent
Disconnect YouTube or another account, or unsubscribe from marketing, at any time. That does not affect use that already happened.
Email info@velivoa.com and we will reply within 30 days. We may need to confirm it is really you first. We will not discriminate against you for exercising these rights.
If you are unhappy with how we handled your information, you can complain to your data protection authority. In Kenya that is the Office of the Data Protection Commissioner. If the GDPR applies, you can also complain to the authority in your country.
17Cookies and local storage
We only use the cookies Velivoa needs to work. We don't use advertising or tracking cookies. You can block cookies in your browser, but then sign-in and Google sign-in will not work.
| Name | What it does | How long |
|---|---|---|
velivoa_session | Keeps you signed in. HttpOnly, so page scripts cannot read it. | Up to 14 days |
velivoa_csrf | Protects your account against forged requests from other sites. | Up to 14 days |
velivoa_oauth_state | Protects Sign in with Google and the YouTube connection against interception. | 10 minutes |
Your browser also remembers two preferences in local storage, which is not a cookie: velivoa-theme (light or dark) and velivoa-org (the workspace you last used). We never keep tokens in your browser.
Our pages load fonts from Google Fonts, which means Google receives your IP address when the fonts download. That is described in the Google Privacy Policy.
18International transfers
Velivoa is operated from Kenya. Some of the companies that help us run the service process information in other countries. OpenAI and Google are in the United States, and Paystack processes payments from outside Kenya as well. Your posts can also be sent to the social network you chose, which stores them under that network's own policy.
Where the law requires a safeguard for a transfer, we use contracts that oblige the recipient to protect the information, and we only send what that company needs for the job described in this policy. The only Google or YouTube data that goes to our AI provider is a comment thread you click Write with AI on.
19Children
Velivoa is not meant for children and you must be at least 16 to use it. We don't knowingly collect information from anyone under 16. If you are a parent or guardian and you think a child has given us information, email info@velivoa.com and we will delete it.
The YouTube "made for kids" setting we read is a property of a video or channel on YouTube. It does not mean we collect information from children.
20Changes and contact
If we change this policy we will update the date at the top, and for important changes we will tell you by email or in the app before they take effect. We will never start using your Google or YouTube data in a new way without asking you first.
The current version is always at velivoa.com/privacy-policy. Related pages: Terms of Service, Data deletion, and Support.
Talk to us about your data
For a copy of your information, a correction, a deletion, or any other privacy question, email info@velivoa.com from the address on your Velivoa account. We reply within 30 days.