Privacy Policy

This Privacy Policy explains how Vantic (“Vantic”, operated by Medurik Corporation — “we”, “us”) collects, uses, and protects your information when you use our analytics service (the “Service”). By creating an account you agree to the practices described here. It also applies if you visit a promotional or landing page we operate, even if you never create an account.

Information we collect

• Account information. Your email address and, for accounts with a password, an encrypted password — managed by our authentication provider. Some accounts are created without a password (for example, with a one-time emailed code). If you enable two-factor authentication, we store the associated factor and a set of one-time backup recovery codes, which we keep only as secured (hashed) values that we cannot read.
• Connected platform data. When you connect a social account (YouTube, Instagram, Facebook, TikTok, or X) we access analytics about that account and its content — for example views, watch time, followers, reach, engagement, and audience demographics — on a read-only basis. If you use our publishing features and grant the additional permission they require, we also publish content to your connected accounts — but only the content you choose, when you explicitly ask us to. We never post, message, or make changes on your behalf on our own. For X (formerly Twitter), what we store is your own posts — the text of the post, when you published it, and its link — along with their public numbers: views, likes, replies, reposts, quotes, and bookmarks. We also keep a daily record of your follower count, the number of accounts you follow, and your total number of posts, so you can see them as a trend over time. We only ever read the account you connected: we do not collect anyone else's account, and we do not combine data across accounts.
• Content you upload. Videos, captions, and images you upload — including photos of you that you add to your thumbnail library — are stored in private storage accessible only to your account. Videos and thumbnails are transmitted only to the platforms you select for that post. You can delete an upload at any time, which removes the stored file.
• Creator profile & niche preferences. If you complete our optional thumbnail survey, we store your answers — your content niche, audience description, style preferences, and any channels you admire — with your account. We use this only to personalize the thumbnail and content guidance you see inside the Service. You can edit or delete your answers at any time from your account settings.
• Notification subscriptions. If you enable push notifications, we store a subscription token for that device so we can deliver them. You can disable notifications per device or per type at any time, which stops their use.
• Access tokens. The OAuth access and refresh tokens that let us sync your analytics are encrypted at rest and are used only by our server-side sync jobs. They are never exposed to your browser and never logged.
• Promotional offer and purchase data. If you visit a promotional or landing page we operate — for example a quiz or offer page linked from an ad or email — we collect the email address, name, and any survey or quiz answers you provide, along with the marketing source (campaign tags or ad click ID) that brought you there. If you buy a one-time product or service through one of these pages, our payment providers — Stripe, or PayPal where offered — collect and process your payment details; we do not store your full card number. We keep a record of the purchase — your email, the amount charged, and a provider reference ID — so we can confirm your order, provide support, and keep accurate business records.
• Billing information. When you subscribe to a paid plan, our payment providers (Stripe and PayPal) collect and process your payment details — such as your name, billing address, and card or PayPal account — to charge you and to calculate any applicable tax. We do not store your full card number; we keep only a provider reference and your plan and subscription status. Where a payment form appears on one of our own pages, it is served directly by the payment provider inside a secure frame — your card number goes straight to Stripe or PayPal and never touches our servers.
• Support requests. If you contact support — from our support page or from inside the app — we collect your email address, an optional name, and the subject and message you write, so we can help you and keep a record of the conversation. Your message is delivered to our support mailbox, and our replies are sent to the email address you provided.
• Technical data. Limited diagnostic and error data to keep the Service reliable and secure.

How we use your information

• Provide your unified dashboard, trends, and reports.
• Generate AI-assisted insights derived from your stored metrics.
• Send the email reports and notifications you configure.
• Follow up on offers you’ve shown interest in, fulfill purchases you make, and send you a receipt.
• Secure the Service, prevent abuse, and provide support.
• Publish your public media kit page, if you choose to turn it on.

Platform data & compliance

Our use of information received from platform APIs adheres to each platform’s developer terms and policies. In particular, Vantic’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google’s own Privacy Policy explains how Google itself collects and uses your information. We only request the minimum scopes needed to display your analytics, and we do not use platform data for advertising or sell it to anyone.

How we store and protect your data

Your data is stored in a managed PostgreSQL database with row-level security, so each account can access only its own data. Access tokens are encrypted with application-level encryption. All traffic is served over HTTPS. While we work hard to protect your information, no online service can guarantee absolute security; if we ever become aware of a breach affecting your personal data, we will notify you as required by applicable law.

Service providers

We share data only with the infrastructure providers required to operate the Service, under their own data-protection obligations: hosting and database (Supabase, Vercel), transactional email (Resend), AI insight generation (Anthropic), bot protection (Cloudflare), error monitoring (Sentry), and, when billing is enabled, payments (Stripe and PayPal). We do not sell your personal information.

The platforms you connect are separate companies, not our providers. When you connect an account or publish through the Service, that platform — Google (YouTube), Meta (Instagram and Facebook), TikTok, or X Corp. — receives the requests we make on your behalf and any content you choose to publish, and handles it under its own privacy policy.

AI processing

To generate insights, a compact summary of your own stored metrics is sent to our AI provider. This content is used only to produce your insights and is not used to train third-party models.

To provide niche thumbnail guidance, we also analyze publicly available YouTube thumbnails from creators in your niche using our AI provider. To find and interpret relevant examples, we use the answers you give in the thumbnail survey — how you describe your niche, who your audience is, and the style you want. Your niche description is sent to YouTube as a search, and your answers are included in the request to our AI provider. Your own images, your numbers, and your identity are never part of that analysis, and we store only the resulting written guidance — never copies of anyone’s images.

If you use the thumbnail feedback feature, the thumbnail you’re viewing — which may include a photo of you or your library images — is sent to our AI provider to generate suggestions. It is used only to produce that feedback and is not used to train third-party models; we don’t keep any extra copy of the image beyond what’s already in your thumbnail library.

If you use the caption assistant when publishing a video, the draft title, description, and hashtags you have written are sent to our AI provider to generate platform-specific suggestions. They are used only to produce those suggestions and are not used to train third-party models; we do not keep any copy beyond the drafts you choose to save.

When you send a support request, your message may be processed by our AI provider to prepare a suggested reply for our support team; a human always reviews any reply before it is sent to you. If you use the in-app help assistant, the questions you type are sent to our AI provider to generate an answer. They are used only for that purpose, are not used to train third-party models, and assistant conversations are not stored after you leave the page.

Data retention and deletion

You can disconnect any platform at any time within Vantic, which immediately purges the stored tokens for that connection. If you connected a Google or YouTube account, you can also revoke Vantic’s access directly from your Google Account’s security settings at any time. You may delete your account and all associated data from your account settings or by contacting us; we honor deletion requests, including platform-initiated deletion callbacks, within the timeframes required by each platform. Deleting your account also cancels any active subscription and permanently removes your analytics history, reports, and insights from our systems.

X requires our copy of your posts to stay in step with what is actually on X. If you delete a post on X, or switch your X account to private, our next daily sync no longer finds it and we delete our copy within 24 hours. That check covers your recent posts — the rolling 90-day window we keep re-reading. Disconnecting X purges the stored access tokens and asks X to revoke our access; removing the X account from your connections also deletes the posts and numbers we stored for it, and deleting your Vantic account removes everything.

Our payment providers (Stripe and PayPal) may retain their own records of your transactions after deletion, as required by their policies and by tax and accounting law. Those records are held under their respective privacy policies, not ours.

Your rights

You may access, correct, export, or delete your personal data. To exercise these rights, email us at the address below.

Cookies

We use strictly necessary cookies to keep you signed in. We also set a first-party attribution cookie that remembers how you first found us — the marketing campaign parameters (UTM tags) and advertising click identifiers on the link you arrived through — for up to 90 days. We use it only to attribute a later signup to the marketing that brought you here, so we know what’s working. Beyond the consent-based analytics and advertising cookies described below, we do not use third-party tracking cookies. Our Cookie Policy lists every cookie we set, what it does, and how long it lasts.

Analytics

When enabled, we use Google Analytics 4 to understand how visitors find and use our website — for example which pages you view, how you arrived, and your approximate location (derived from your IP address, not precise location). We use this only in aggregate to improve the Service and our marketing. In regions where the law requires it, we ask for your consent through a banner before any analytics cookies are set; if you decline, no analytics cookies or scripts are loaded.

Advertising

We measure the effectiveness of our advertising by recording when a visit, signup, or purchase follows an ad, using conversion-measurement tools from Google, Meta, and TikTok when those are enabled. Where consent is required, their scripts load only after you consent.

When you take an action we advertise for — such as joining our email list, signing up, starting a trial, or buying a one-time offer — we may send that advertising platform a record of the action. So the platform can match it to the ad you clicked, that record can include the ad click identifier from the link you arrived through and a scrambled (hashed) version of your email address. The scrambled value is a one-way code: the platform can compare it against its own records to find a match, but cannot read your email address back out of it. Some of these records are sent from our servers rather than from your browser, so they are not affected by ad blockers. We share only the action itself and these matching details — never your connected platform analytics, and never your content.

Marketing emails

We send marketing emails (such as tips and product updates) only if you opt in — by joining our email list, when you sign up, or by submitting your email on one of our promotional offer pages. Every marketing email includes an unsubscribe link, and you can opt out at any time. Unsubscribing from marketing does not affect transactional emails you still need, such as password resets, receipts, or the reports you configure.

Public media kit pages (optional)

If you turn on a media kit, we publish a public page for you on Vantic’s own website, at an address you choose (for example, vantic.app/kit/your-name). The page shows, for the accounts you select: your account names, handles and profile photos, follower counts, lifetime and recent view totals, and a recent growth chart. It is visible to anyone with the link and may be copied or cached by others while it is public. You choose which accounts appear, and you can turn the page off at any time in settings, which removes it immediately; copies made outside our Service (for example, link previews in a messaging app) may persist. We never publish your email address, billing information, audience demographics, or any account you did not include.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Contact

Questions about this policy or your data? Email support@vantic.app.