Privacy Policy

Last updated October 11, 2026

Vitalis AI is an autonomous marketing engine. You connect your advertising accounts, and Vitalis AI researches, plans, and builds campaigns for you. No advertising money is ever spent without an explicit human approval click. This page explains exactly what we collect, why, and how to get rid of it.

Our use of artificial intelligence

Vitalis AI is an AI product. The research, strategy, ad copy, images, and video it produces are generated by artificial intelligence, not written or filmed by people. AI can be wrong, and it can produce claims that are inaccurate for your business - which is why every campaign is built paused and shown to you before anything runs. You review and approve what goes live, and you remain responsible for the accuracy of the claims in ads you approve. Performance figures shown in the product are your own reported ad-platform and payment-processor data, not predictions or guarantees.

Your business data and advertising data are sent to our AI providers solely to produce your work. They are not used to train AI models - ours or anyone else’s. Generated images and video are synthetic; where an ad depicts a person, that person is AI-generated and not a real customer or a genuine testimonial unless you supplied that material yourself.

What we collect

• Your account. Email address and authentication details, so you can sign in.
• Advertising data. When you connect Meta or Google Ads, we read your ad accounts, campaigns, ad sets, ads, and their performance metrics - spend, impressions, clicks, and conversions. We use this to report your results and to let the agents make grounded decisions. See the platform-specific sections below.
• Access tokens. The credential that lets us reach your ad account on your behalf.
• Business information you give us. Your products, pricing, service area, budget, objective, and anything you add to the knowledge base.
• Creative assets. Images and videos you upload, and the ad creative generated for you.
• What was said in a meeting, in words. When you start a meeting in Vitalis AI, we write down what is said and keep the transcript, the notes, and the action items. We do not record or store the audio. See “Meetings and your voice” below.

Data collection at a glance

The short version of everything below - what we collect, why, whether it leaves us, and whether it is tied to your identity.

We do not sell your data, and we run no advertising trackers inside the product. The signed-in Vitalis AI console contains no third-party analytics or advertising pixels - your campaign data, revenue, and business information are never fed to an ad network. Our public marketing pages may use standard website analytics (such as Google Analytics) and, where a conversion pixel is present (such as the Meta pixel), those providers may set cookies to measure visits and ad performance in aggregate. You can block these with your browser or an ad blocker with no loss of product functionality.

How your access tokens are protected

Access tokens are encrypted at rest with AES-256-GCM before they are written to the database. The encryption key is held only by the application server, never in the database. Tokens are never displayed back to you, never sent to your browser, and never written to logs. Each workspace can only reach its own data, enforced at the database level.

Meetings and your voice

Vitalis AI does not record or store the audio of your meetings, and no one at Vitalis AI can listen to them. There is no recording to play, no stored file, and no part of the product - and no employee account, support tool, or administrator - that can reach one. Your voice is yours.

What happens instead: while Vitalis AI is listening, your browser turns a few seconds of sound at a time into words. Each of those short pieces of audio is sent to our server and on to our speech-to-text provider, held only for as long as that single request takes, and then discarded. It is not written to our database, not written to storage, and not written to any log, and it is not used to train any AI model. Nothing else - no other company, no ad platform - ever receives it. Our speech-to-text provider is named on our subprocessors page, and it holds that audio only for as long as it takes to answer, under its own API terms.

What we keep is the transcript: the words, in your own workspace, along with the notes, decisions, and action items produced from them. You can read it, edit what came out of it, share it if you choose, and delete the meeting - which deletes everything under it. Meetings are also deleted automatically 180 days after they happen unless you delete them sooner.

Vitalis AI never joins your call as a participant. There is no bot, no attendee added to the invite, and nothing installed in Zoom, Teams, or Google Meet. It listens on the device of the person who started it, only while they have started it, and only until they end it. A meeting you start as a private brainstorm is readable by you alone - not by your colleagues, not by your workspace administrator, and not by us.

Recording a conversation is regulated differently in different places, and some of those laws require everyone present to be told or to consent. Vitalis AI writes down what is said in meetings you choose to run through it, and you are responsible for telling the people in the room that you are doing so.

Google user data

You choose which Google services to connect. Each connection requests the permissions needed for that service. Connecting one service does not require connecting all of them.

• Google Ads (adwords). We list accessible ad accounts, read campaigns and performance, and prepare campaign changes. No advertising money is spent without your explicit approval click.
• Calendar (calendar.readonly, calendar.events). We read calendars and events to show your schedule and help prepare meetings. We create events you request; invitations to other people require approval.
• Analytics and Search Console (analytics.readonly, webmasters.readonly). We read your selected property’s traffic, conversion, and search-performance reports to explain marketing results. We do not change these properties or read competitors’ private properties.
• YouTube (youtube.readonly, yt-analytics.readonly, youtube.upload). We read channel and video information and analytics to report performance, and upload videos after your approval.
• Drive (drive.file). We create, list and read files made by or explicitly opened with Vitalis, including Google Docs, Sheets and Slides. This permission does not give us access to your entire Drive.
• Gmail in limited testing (gmail.modify). Gmail is not publicly available. In an enabled review environment, an explicitly connected mailbox can be searched and read, drafts prepared, and messages archived or marked read or unread. Sending requires approval of the exact sender, recipients, subject and body. We do not permanently delete messages, change forwarding or delegation, or read attachments. Personal mailbox data is not automatically included in shared briefs.
• Processing and storage. Connection tokens are encrypted at rest. Relevant Google data may be processed by our AI service providers to carry out the work you request, and retained in reports, conversations, approval records and work products. It is not used to train general-purpose AI models. The service-provider and retention sections below describe these processors and deletion.
• Disconnecting and deletion. Disconnecting a service on the Connections page deletes its stored connection credentials and stops future access through that connection. It does not erase reports or work already saved. You can also remove the app’s Google authorization at your Google Account permissions. Google authorization may cover multiple services connected through the same app. Contact us to request deletion of retained account data as described below.

Limited Use. Vitalis AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we do not sell Google user data; we do not use it for advertising outside of operating your own campaigns at your direction; we do not transfer it to third parties except as needed to provide the service to you, for security, or to comply with the law; and we do not allow humans to read it except with your consent, for security, to comply with the law, or where the data is aggregated and de-identified. We never use Google user data to train AI models.

Meta user data

If you connect Meta, we access the ad account, Facebook Page, and pixel you select - their performance metrics for reporting, and the ability to create campaigns and ads in a paused state for your approval. The same rules apply: it is used only to operate Vitalis AI for you, is never sold, and is never used to train models. You can revoke access at any time from your Facebook Business Integrations settings.

What we do NOT do

• We do not sell your data, or share it with data brokers or advertisers.
• We do not use your business data to train anyone’s general-purpose AI models.
• We do not post to your accounts or spend your ad budget without your explicit approval.

Service providers we share data with

We use a small number of processors to run the product. Each receives only what it needs to do its job. The full list, with what each one processes and where, is on our sub-processors page.

• Supabase - database, authentication, and file storage.
• Anthropic - powers the agents and the assistant by default. Your campaign and performance context is sent to generate plans, copy and reports. It is not used to train models. If you choose an OpenAI or xAI model in Loop, that request goes to them instead, with the same context and the same rule: not used to train models.
• Runway, Higgsfield and Google (Veo) - generate ad images and video from the creative briefs. They receive the scene descriptions we write, not your performance data.
• Meta (and other ad platforms you connect) - we read your performance data and, once you approve, create campaigns in your account.
• Stripe - subscription billing. Stripe handles your card details directly; we never see or store them.
• Vercel - application hosting.

Government and legal requests

We may receive requests from law enforcement or other public authorities for user data. Our practice when that happens:

• We review legality first. We do not disclose data in response to a request unless we are satisfied it is valid, properly scoped, and legally binding on us.
• We challenge requests we believe are unlawful, overbroad, or improperly issued, and we will seek to narrow or resist them where we have grounds to do so.
• We disclose the minimum necessary. We provide only the specific data a valid request actually compels - never a broader export for convenience.
• We document every request - what was asked, who asked, what we concluded about its legality, what we disclosed, and when.
• We notify affected users where we are legally permitted to do so.

How long we keep it

We keep your data for as long as your account is active. Disconnecting a platform deletes that platform’s access token immediately. Deleting your account removes your data - see Delete your data.

Your rights

• Disconnect any platform at any time, from the Connections page.
• Request a copy of the data we hold about you.
• Request deletion of your account and all associated data.
• Correct anything inaccurate.

Revoking Vitalis AI from your Facebook Business Integrations settings also immediately cuts off our access to your Meta account.

Children’s privacy

Vitalis AI is a business tool and is not intended for children. We do not seek or knowingly collect personal information about children. If we learn that we have collected information about a child without knowing it - in particular a child under 13 - we will make commercially reasonable efforts to delete it from our systems. If you are the parent or guardian of a child under 13 who has given us their personal information, contact us using the details below and we will delete it.

Contact

Questions, access requests, or deletion requests: support@govitalisai.com.