Privacy Policy

Account details. Your name, business name, email address and password (stored hashed, never in plain text).

Your website content. When you give us your website address we read the public pages of that site: logo, fonts, colours, product information and text. We only read pages that anyone can visit.

Instagram connection. When you connect your Instagram professional account we store the access token Meta issues, your account ID and username. We use them only to publish and to read the performance of posts we published. We never post anything outside your plan, and we never read your direct messages.

Content we create for you. Generated images, captions, schedules and the record of what was published.

Usage and billing. Log data such as IP address and browser, and, if you subscribe, the billing details held by our payment provider. We never see or store your full card number.

To build your brand kit, plan and produce content, publish it to your Instagram account, run your subscription, support you, and keep the service secure. We do not sell your personal information, and we do not use your data to train our own models.

We use a small number of providers, each only for the job listed:

Supabase (database and authentication, hosted in Sydney), Vercel (website hosting), Meta Platforms (publishing to Instagram), fal.ai (image generation), Anthropic and OpenAI (writing captions and analysing site content), Stripe (payments), and an email provider for service notifications.

Some of these providers process data outside Australia, including in the United States. We only send them what the task requires.

Your account, brand kit and content are stored in Sydney, Australia. Backups are held in the same region.

While your account is open, and for 12 months after you close it, in case you come back. You can ask us to delete everything sooner and we will do it within 30 days. Disconnecting Instagram removes the stored token immediately.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or withdraw consent for anything optional. Email hello@veso.app and we will respond within 30 days.

If you are not satisfied with how we handled a privacy matter, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Data is encrypted in transit and at rest. Access tokens are stored encrypted and are only decrypted when a scheduled post runs. Access to production data is limited to people who need it.

Veso is for businesses. We do not knowingly collect information from anyone under 18.

If we change this policy we will update the date above, and for anything significant we will email account holders before it takes effect.

Veso, Melbourne, Australia. hello@veso.app