Privacy Policy

Introduction

VitaLab is the public wellness website and publication available at https://vitalab.blog. VitaLab Social is VitaLab's social media publishing and distribution tool, available separately at https://social.vitalab.blog.

VitaLab Social may connect to third-party social platforms, AI services, and publishing providers when a user authorizes or configures those connections. The public VitaLab website remains an editorial content site and does not process product orders, shipping, payments, or customer accounts.

Information we collect

For the public VitaLab website, we may collect information you choose to provide, such as an email address submitted for newsletter updates or a message sent to VitaLab.

For VitaLab Social, information may include account or profile information, OAuth authorization information, connected social media account or channel identifiers, content and media submitted or selected for publishing, draft social copy, publishing and scheduling metadata, platform status information, analytics or engagement data made available by connected services, and technical or log information needed to operate and secure the tool.

The current website uses a language preference cookie and browser local storage value for the selected language. Client-side analytics code may record page views, article views, referral sources, newsletter signups, related article clicks, product card clicks, affiliate clicks, and similar interaction events.

Google and YouTube API Services

VitaLab Social may use Google OAuth and YouTube API Services only after a user explicitly authorizes access. Depending on the permissions granted and the enabled features, this may include basic Google profile or email information, YouTube channel or account information, YouTube videos and video metadata, upload or publishing functionality, and YouTube Analytics information.

Google and YouTube data is used only to provide the requested account connection, social publishing, upload, management, scheduling, and analytics functionality. Google user data is not sold, is not used for advertising, and is limited to the permissions or scopes granted by the user.

If OAuth access or refresh tokens are stored, they are stored only as needed to maintain the authorized connection and provide the requested functionality. The current website does not publish a separate self-service deletion endpoint; deletion requests are handled through the data deletion process described on the Data Deletion Instructions page and by email.

Users can revoke Google access at any time through Google Account permissions. VitaLab Social's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google's own privacy practices are described in the Google Privacy Policy.

Meta, Facebook and Instagram

When a user connects an eligible Facebook Page or Instagram professional account, VitaLab Social may receive only the information and permissions granted through Meta OAuth or through an authorized publishing provider. This may include Facebook Page lists and Page identifiers, Page publishing permissions, Page engagement or insights data, Instagram professional account information, Instagram content publishing permissions, and Instagram comments or insights where enabled.

Meta, Facebook, and Instagram data is used only to connect accounts, publish or schedule authorized content, manage account-related functionality, and provide engagement features requested by the user. Meta data is not sold.

Users can disconnect or revoke Meta access through their Meta, Facebook, or Instagram account settings, including Facebook Business Integrations. Deletion requests are supported through VitaLab's data deletion process.

TikTok

VitaLab Social includes TikTok as a supported publishing platform. If a user connects TikTok through TikTok OAuth, the TikTok Content Posting API, or an authorized publishing provider, TikTok data is accessed only after authorization and used for account connection, uploading or publishing content, and related account functionality requested by the user.

OpenAI and AI processing

The current VitaLab Social implementation can send article text, excerpts, URLs, and user-selected content to the configured AI provider to generate or adapt social media copy. The codebase currently uses the OpenAI Responses API when OPENAI_API_KEY is configured.

AI processing is governed by the applicable provider terms and privacy policy. VitaLab does not make retention guarantees for third-party AI providers beyond the commitments that apply under those provider policies and our agreements with them.

Sharing with service providers

We may share information with service providers only where necessary to operate VitaLab or VitaLab Social, comply with law, protect the service, or carry out actions authorized by the user.

Service provider categories may include hosting and cloud infrastructure, database or storage providers, social media and API providers, AI providers, analytics providers, security tools, and email or communication services.

Data retention

We retain data only for as long as necessary to provide the service, meet legal obligations, resolve disputes, and enforce agreements. The current project does not define fixed retention periods in code.

If a connected social account is disconnected or a deletion request is completed, we will delete or de-identify data that is no longer needed unless retention is legally required or necessary for security, dispute resolution, or compliance records. Third-party platforms and providers may retain information according to their own policies.

User choices and rights

Users may request access, correction, deletion, or restriction of personal information associated with VitaLab or VitaLab Social by contacting info@vitalab.blog.

Users can disconnect connected social accounts through the relevant platform settings or by asking VitaLab for help. Users can revoke OAuth permissions directly through Google, Meta, TikTok, or other connected platform account settings.

Where GDPR or other data protection laws apply, users may have rights to access, rectify, erase, restrict, object to, or receive a copy of their personal data, subject to legal limits and verification of the request.

Security

We use reasonable technical and organizational safeguards intended to protect information handled by VitaLab and VitaLab Social. No online service can guarantee absolute security, and users should keep their own account credentials and platform permissions secure.

Children's privacy

VitaLab and VitaLab Social are not directed to children and are not intended for use by children under the age required by applicable law. We do not knowingly collect personal information from children.

International transfers

VitaLab operates in Europe and may use third-party services that process information in other countries, including outside the European Economic Area. Where required, we rely on appropriate safeguards or lawful transfer mechanisms for those transfers.

Changes

We may update this Privacy Policy as VitaLab and VitaLab Social evolve. Material updates will be posted on this page with an updated date, and we may provide additional notice where appropriate.

Contact

Questions, privacy requests, and data deletion requests can be sent to info@vitalab.blog.