Privacy Policy

VERZUZ is operated by VS The World Productions. Contact: seth@vstheworldproductions.com.

Access is invite-only for workspace teams. This is not a consumer social network and not an open signup product.

Depending on how you use VERZUZ, we may process:

• Account data — email, name, optional Google profile photo, password hash if you use password sign-in, role, and two-factor status.
• Workspace and brand data — brand names, kits (logo, colors, type, voice), assignments, and settings you save.
• Content you create — media you upload, captions, drafts, approval queue, scheduled and published posts, and messages you send to the VERZUZ agent or team chat.
• Brand-scoped social connections — when you connect Facebook, Instagram, TikTok, YouTube, X, Threads, or LinkedIn to a specific brand, we store encrypted OAuth tokens plus the Page, channel, or account identity needed to publish for that brand. A connection on Brand A is never reused for Brand B.
• Buffer credentials you paste — encrypted per brand. Until a native token exists (and for platforms whose native send is not live yet), publishing still goes through Buffer.
• Technical data — session cookies, security logs, and error logs. We do not log access tokens or API secrets.

We use this data only to operate VERZUZ:

• Sign you in and enforce workspace roles.
• Generate brand-voice captions, queue posts for human approval, and schedule or publish to the channels you selected.
• Keep each social connection inside the brand you connected so teams cannot accidentally post from the wrong account.
• Provide support, security, and product reliability.

We do not sell personal data. We do not use connected social accounts to build advertising profiles. We do not scrape your friends, followers, or inboxes. Publishing uses the Page, channel, or professional account you authorized for that brand.

Native connections live on Brands → Connections. Each row is (brand, platform). Encrypted tokens stay on the server. Switching brands in the header cannot leak another brand's tokens.

Facebook and Instagram connections are for Pages / professional accounts you manage, not personal profiles. YouTube is the channel you authorize. Other platforms follow the same brand-scoped pattern.

Buffer remains the fallback publisher. If a brand has no native token, or native posting is not implemented for that platform yet (TikTok, X, Threads, LinkedIn as of this policy), posts go through Buffer using the brand's Buffer key. A failed native send is not silently retried on Buffer (that could double-post).

We share data only as needed to run the product, with processors under contract or platform APIs you connect:

• Vercel — hosting.
• Supabase — database and media storage.
• xAI (Grok) — chat, captions, and image understanding for content you send to the agent.
• Google Gemini — optional video analysis you trigger.
• Buffer — when a post is published or scheduled through Buffer.
• Meta, Google/YouTube, TikTok, X, LinkedIn, Threads — only when you connect that platform or we publish using that connection.
• Resend — invite emails, if configured.

Uploaded media is stored so Buffer and native publishers can fetch a public HTTPS URL. Do not upload content you do not have the right to publish.

You can cut a social connection without deleting your VERZUZ login:

1. In VERZUZ: open the brand → Connections → Disconnect (requires permission to manage brand secrets).
2. On the platform: remove VERZUZ from Facebook/Instagram Apps and websites, Google Account third-party access, TikTok, X, or LinkedIn authorized apps.
3. Buffer: revoke the brand Buffer key in VERZUZ (Brands → Buffer keys) or disconnect channels in Buffer.
4. Email seth@vstheworldproductions.com to request account closure or deletion of remaining workspace data.

Step-by-step deletion, including Meta's callback, is at /data-deletion.

We keep account and content data while the workspace is active. Disconnected social tokens are revoked (ciphertext overwritten). Backups may take a short period to expire. Session cookies are HTTP-only. Secrets are encrypted at rest with a server key. We use HTTPS in production.

You may request access, correction, or deletion of personal data we hold, subject to law and to records we must keep (for example security logs or content you published that already lives on a social platform). Platform posts already delivered to Facebook, Instagram, TikTok, YouTube, X, Threads, LinkedIn, or Buffer are controlled by those services — delete them there if you need them removed from the network.

We will update this page when practices change. The date at the top is the current version. Material changes will be reflected here before we rely on them in app review.