Privacy Policy

1. Who we are

Vibkings Social Manager (https://social.vibkings.com) is run by Vibkings Global Limited, a company registered in Nigeria ("Vibkings", "we", "us"). This policy explains what personal data we handle, why, and the choices you have. It is written to meet the Nigeria Data Protection Act 2023 and Meta's platform requirements.

2. Our two roles

• For people who use the service (business owners and their staff), we are the data controller. We decide how your account data is used.
• For a business's customers (people who comment on or message a business's Facebook Page or Instagram account), the business is the controller and we process the data on its behalf and on its instructions. If you're a customer with a question about your data, contact that business first; we'll help it respond, or you can write to us.

3. What we collect

• Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name and email from Google.
• Workspace details: business name, timezone, team members and their roles, invitations, settings, and the activity log of actions taken.
• Your content: posts, images, videos, captions, campaigns, business facts (products, prices, hours, policies), saved replies and automation rules.
• Data from connected social accounts: see section 4.
• Leads: a summary, status and notes your team records about a possible buyer, linked to the comment it came from.
• Payments: plan, amount, currency, payment reference and status. Card and bank details are handled by our payment provider; we never see or store full card details.
• Usage and technical data: AI usage and costs, publishing results, error reports (with personal details removed before they leave our servers), and basic server logs.

We don't collect sensitive data on purpose, and we ask businesses not to add it.

4. Facebook and Instagram data

When a business connects a Facebook Page or Instagram professional account through Meta's official sign-in, and only for the permissions it grants, we receive:

• the Page or account name, ID and profile picture;
• access tokens, which we encrypt and only use on our servers. They're never shown in the browser, written to logs or sent to AI;
• the business's own posts, and their publishing results;
• comments on those posts, including the commenter's public name, Meta ID and comment text;
• private messages people send to the business on Messenger or Instagram Direct, and the business's replies: the sender's name and Meta ID, the message text, and the type and link of any photo or file (we don't copy the files themselves);
• Page and post insights, such as reach, engagement and follower counts.

We use this data only to provide the features the business uses: publishing, the inbox, replies, leads and analytics. We don't sell it, use it for advertising, or share it with data brokers, and we follow Meta's Platform Terms and Developer Policies. We never ask for Facebook or Instagram passwords.

5. How we use data, and why

• To provide the service you signed up for (performing our contract): accounts, workspaces, scheduling and publishing, the inbox, AI drafts, leads, analytics and support.
• To keep it secure and working (our legitimate interests): preventing abuse, fixing errors, keeping activity logs and protecting other workspaces.
• To take payments and keep records (contract and legal obligations, such as tax and accounting).
• To tell you about the service: important account and billing messages. We'll only send marketing emails if you agree, and you can stop them at any time.
• With your consent, where the law needs it, for example when you connect a social account. You can withdraw consent at any time by disconnecting.

6. AI processing

• AI features (captions, reply drafts, automatic replies, classifying comments) send the relevant text to Anthropic's Claude models: for example, a customer's comment and the business's approved facts. Tokens, passwords and other secrets are never included.
• Anthropic processes this data to give us a response and does not use it to train its models. We don't use your data to train models either.
• Automatic replies are off by default. Businesses choose which questions they answer, and complaints, legal or payment issues and uncertain questions go to a person instead. Every automatic reply is recorded with the rule and facts it used.

7. Who we share data with

We share data only with service providers that help us run the service, under contracts that require them to protect it and use it only for us:

We may also share data if the law requires it, to protect people's safety or our rights, or with a buyer if our business is sold (who must keep this policy). Within a workspace, team members can see the workspace's data according to their role. Vibkings staff can see a workspace's plan and usage for support and billing, but not its posts, comments, leads or facts, and every staff action is recorded.

8. International transfers

Some of our providers store or process data outside Nigeria, including in the European Union and the United States. When data leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act allows, such as contracts with data protection terms, and we choose providers with strong security.

9. How long we keep data

We keep data only as long as we need it. Our main rules:

10. Security

• Data is encrypted in transit (HTTPS) and Facebook and Instagram tokens are encrypted at rest.
• Each workspace's data is kept apart by database rules, so people can only see workspaces they belong to, according to their role.
• Important actions are logged, and staff access is limited and recorded.
• No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the Nigeria Data Protection Commission as the law requires.

11. Your rights

Under the Nigeria Data Protection Act you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict or object to how we use it;
• give you your data in a format you can move to another service;
• withdraw consent you have given.

Email support@vibkings.com and we'll reply within 30 days. We may need to check it's really you. Workspace owners can also download all of a workspace's data themselves in Settings → Your data.

12. Deleting your data

• A workspace: the owner can request deletion in Settings → Your data. Everything is removed after 30 days, including media files; the owner can cancel during that time.
• Your account: email support@vibkings.com from the address you signed up with.
• Facebook or Instagram data: disconnect the account in the service, or remove Vibkings Social Manager in your Facebook settings (Settings & privacy → Settings → Business integrations) or Instagram settings (Apps and websites). When Meta tells us you removed the app, we delete the connection details and tokens straight away, and you can check the status on our data deletion page.
• A comment you left on a business's page: if you delete it on Facebook or Instagram, we clear its text within 30 days. You can also ask the business or us to delete it.

13. Cookies and browser storage

We only use the cookies needed to keep you signed in. We remember your light or dark theme choice in your browser. We don't use advertising or tracking cookies, and we don't record your sessions.

14. Children

The service is for businesses and is not meant for anyone under 18. We don't knowingly collect children's data; if you think we have, contact us and we'll delete it.

15. Changes to this policy

We'll update this policy when our practices change, and change the date at the top. If a change is significant, we'll tell workspace owners by email or in the service before it takes effect.

16. Contact and complaints

Vibkings Global Limited. For privacy questions or requests, email support@vibkings.com.

If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or to the data protection authority where you live.

See also our Terms of Service.