Privacy policy.

Who we are

Vitraz (“we”, “us”) provides a hosted service for collecting, curating and embedding social content and reviews. For data protection purposes we are the controller of the account data described below, and a processor of the content you choose to aggregate. You can reach us at privacy@vitraz.io.

What we collect

Account data

When you sign up we store your name, email address, hashed password (or the identifier from your Google sign-in), and your workspace name. This is necessary to give you an account.

Content you connect

When you connect a source we retrieve the public posts, reviews and videos that source exposes, along with their authors’ public handles, avatars and timestamps. We store this so your feed can render without calling the network on every page view.

Usage data

We count how many times your embedded feeds are viewed, so we can apply plan limits and show you analytics. To count a viewer once per day rather than once per page load, we derive a one-way hash from the viewer’s IP address and browser user-agent. We do not store the IP address itself, and the hash cannot be reversed to identify anyone.

Billing data

Payments are handled by Lemon Squeezy, who act as merchant of record. We never see or store your card details — only a customer reference, your plan, and its status.

Why we’re allowed to use it

• To perform our contract with you — running your account, fetching your sources, serving your embeds, taking payment.
• Legitimate interests — keeping the service secure, preventing abuse, and understanding aggregate usage so we can improve it.
• Legal obligation — retaining billing records for as long as tax law requires.

Who we share it with

We do not sell your data. We share it only with the providers needed to run the service:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Lemon Squeezy — payment processing and invoicing.
• The networks you connect — when you link an account, that network receives the request and applies its own privacy policy to it.

Cookies

We use a single category of cookie: the session cookie that keeps you signed in. It is required for the application to function, so it is set without a consent banner. We do not run advertising or cross-site tracking cookies. Embedded feeds on your visitors’ sites set no cookies at all.

How long we keep it

Account and content data lives for as long as your account is open. Delete your account and we remove your workspace, feeds, sources and collected posts. Aggregated view counts that cannot identify anyone may be retained. Billing records are kept for the period tax law requires.

Your rights

Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, and to object to processing based on legitimate interests. You can edit or delete your account directly in Settings, or write to privacy@vitraz.io and we will respond within 30 days. If you are in the EEA or UK and are unhappy with our response, you may complain to your local supervisory authority.

International transfers

Our providers may process data outside your country, including in the United States. Where that happens we rely on the transfer mechanisms those providers put in place, such as Standard Contractual Clauses.

Children

Vitraz is a business tool and is not directed at children under 16. We do not knowingly collect their data.

Changes

If we make a material change to this policy we will update the date at the top and notify account holders by email before it takes effect.