Last updated: May 4, 2026
VibeKOL ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application VibeKOL (the "App"), including its Facebook Login, Facebook Page posting, and Facebook Messenger Agent features.
The App's image generation, video generation, caption suggestion, video script suggestion, and Messenger Agent reply features rely on third-party artificial intelligence services. Before any of these features sends your data off your device, the App will display an in-app consent dialog and will not transmit anything until you tap Agree. You can revoke that consent at any time from the user menu (Avatar β Data Sharing β Revoke Consent). Revoking blocks new AI requests but does not delete content that was already generated.
All inputs above are provided by you directly through the App's image picker, camera, file picker, and text fields β except for Messenger messages, which are delivered to our backend by Meta's webhook in real time when you have enabled the Messenger Agent on a connected Page.
We do not use your inputs or generated content to train any AI model.
| Third party | Role | Privacy policy |
|---|---|---|
| Google LLC | Vertex AI / Gemini, Veo, Cloud Run backend, Firebase (Auth, RTDB, Storage, App Check), Google Drive (optional sync) | policies.google.com/privacy |
| Meta Platforms, Inc. | Facebook Login for Business, Graph API publishing, Messenger webhook delivery | facebook.com/privacy/policy |
| Apple Inc. | App Store in-app purchases (iOS) | apple.com/legal/privacy |
| Google LLC (Play) | Google Play Billing in-app purchases (Android) | policies.google.com/privacy |
We have reviewed each third-party processor named above and confirm that they provide privacy and security protections at a level equivalent to or stronger than those described in this Policy, including encryption in transit, restricted access, audit logging, regional data-residency controls, and contractual obligations not to use your content to train their AI models without your consent. Each processor is independently certified under recognized frameworks (Google: ISO 27001 / 27017 / 27018, SOC 2, GDPR / CCPA compliance; Meta: ISO 27001, SOC 2, GDPR / CCPA compliance).
You may withdraw your consent at any time. To withdraw, open the App, tap your avatar in the top-right corner, choose Data Sharing, and tap Revoke Consent. Once revoked, the App will no longer call third-party AI services on your behalf. You will be asked again the next time you initiate an AI generation. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
This Section provides additional, dedicated transparency about how the App handles facial / portrait images, in line with biometric-data privacy laws (such as Illinois BIPA, Texas CUBI, and the EU GDPR's special-category rules) and Apple App Store / Google Play store requirements. It supplements β but does not replace β Section 3 above.
VibeKOL collects facial / portrait images only when you explicitly upload them from your camera roll, choose them from your KOL library, or capture them with the in-app camera and tap the upload button. The App does not activate the camera, microphone, or any biometric sensor in the background. The App does not perform on-device face detection, face recognition, faceprint extraction, or liveness checks; we do not generate or store any biometric template, faceprint, embedding, or identifier derived from a face.
Facial images you provide are sent to Google Vertex AI (Gemini and Veo) for the sole purpose of generating the image or video you requested (KOL portrait, product model photo, video clip). We do not use facial data for:
Facial data is shared only with the AI processors needed to fulfil your generation request, namely Google LLC (Vertex AI Gemini, Veo, Cloud Run worker, Firebase Cloud Storage). Each processor is contractually required to provide an equivalent or stronger level of data protection, as further described in Section 3.5. For their handling of your data, see Google's Privacy Policy and the Google Cloud Data Processing Addendum.
Image and video generation runs as a background job through Google Cloud Tasks β Google Cloud Run β Vertex AI. To support this asynchronous pipeline, your uploaded image is briefly written to Firebase Cloud Storage at image/{jobId}/<name>.png (encrypted in transit and at rest, region asia-southeast1) so the Cloud Run worker can read it. The intermediate file is automatically deleted as soon as the job finishes; an automated cleanup hard-caps any orphaned file at 24 hours. Generated outputs are returned to your device and stored in your local Hive database under images/{userId}/{kol|history|videos}/.
asia-southeast1 (Singapore).You can delete an individual image at any time inside the App (Gallery β long-press β Delete; KOL β swipe β Delete). To delete all facial data we hold, delete your account from the user menu (Avatar β Delete Account) or email hello@nviai.com from the address linked to your account. Deletion is completed within 30 days.
For your privacy and to reduce the risk of misuse, the App actively encourages you to create fully AI-generated KOL portraits via the KOL AI tab rather than uploading photos of real people. The App is built for marketing and e-commerce content creation and does not attempt to produce a photorealistic likeness of a real, identifiable individual. If you choose to upload a real person's photo, you confirm that you are that person or have their explicit, informed consent to use their image for AI generation, and you accept full responsibility for that upload under applicable law.
VibeKOL uses Facebook Login for Business and the Meta Graph API to let you connect Facebook Pages you manage, publish content to those Pages, and optionally enable an AI Messenger Agent. Facebook Login is strictly optional β you can use the rest of the App without connecting any Facebook account.
| Permission | Why we use it |
|---|---|
public_profile | Identify you during OAuth (default permission). |
pages_show_list | Show the list of Pages you manage so you can choose which Page to connect. |
pages_manage_posts | Publish image, video, and text posts to Pages you have connected, using content you author in the App. |
pages_read_engagement | Read basic Page metadata (Page name and ID) to display connected Pages inside the App. |
pages_manage_metadata | Subscribe a connected Page to our Messenger webhook when you enable the Messenger Agent feature. |
pages_messaging | Send and receive Messenger messages on behalf of a connected Page when you enable the Messenger Agent feature (optional). |
We do not request email, user_friends, user_gender, user_birthday, user_posts, or any other user-level advanced-access permissions. All Meta API calls are Page-scoped β we never post to your personal timeline.
page_tokens/{pageId}/access_token), used solely to call the Graph API on your behalf when you publish a post or reply to a message.agents/{uid}/{agentId}.Tokens and Page data are retained only while your Agent is connected. When you disconnect a Page inside the App, we call DELETE /{page-id}/subscribed_apps to unsubscribe our webhook, call DELETE /me/permissions to revoke app permissions, and then delete the stored token and Page record from our database.
GET /me/accounts β list the Pages you manage during setupPOST /{page-id}/photos β publish image posts you compose in the AppPOST /{page-id}/videos β publish video posts you compose in the AppPOST /{page-id}/feed β publish text posts you compose in the AppPOST /{page-id}/subscribed_apps β subscribe your Page to our Messenger webhook (only if Messenger Agent is enabled)DELETE /{page-id}/subscribed_apps and DELETE /me/permissions β executed when you disconnectFor information about how Meta processes your data, see Meta's Privacy Policy and Meta Platform Terms.
If you choose to enable the Messenger Agent on a connected Page, the following additional processing takes place:
asia-southeast1. Webhook events and knowledge-base files are processed in this environment.We do not sell your personal information. We may share data with:
You have the right to:
You can delete your data at any time using the options below.
DELETE /me/permissions, and (c) deletes the stored Page Access Token, Page record, and Agent configuration from our database.To permanently delete your VibeKOL account and all associated data (KOLs, generation history, Agent configurations, Facebook tokens, purchase records where permitted), email us at hello@nviai.com from the address associated with your account. We will complete deletion within 30 days and confirm by email.
Our Data Deletion Request URL for Meta platform compliance is:
https://vibekol.com/data-deletion
The App is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us.
We retain your account data for as long as your account is active. Facebook Page Access Tokens are retained only while the corresponding Agent is connected. Message content processed by the Messenger Agent is retained for at most 30 days in short-term logs for abuse prevention and debugging. You can delete your data at any time by:
Your data may be processed in countries other than your own, including the United States (Google's servers) and Singapore / asia-southeast1 (our Cloud Run backend). We ensure appropriate safeguards are in place for international data transfers.
We may update this Privacy Policy from time to time. We will notify you of significant changes through the App or via email. Your continued use of the App after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:
Email: hello@nviai.com