Privacy Policy
Last updated: October 27, 2026
This policy explains what personal data NextVip, operated by NEXTVIP LLC, collects, why it uses that data, who it shares it with and how to request deletion. It covers nextvip.app, nextvip-isolated-mvp.vercel.app and the NextVip application.
Data we collect
Data you give us
- Account. Your email address and, if you provide one, your name. Passwords are handled by our authentication provider and are never visible to us.
- Videos. The video files you upload, along with any title and caption you write.
- Affiliate links. The destination URLs you enter, plus the labels, programs and campaign tags you attach to them.
When you contact us through our contact form or by email, we process your contact details, question and the records needed to respond. Form submissions are stored in our database. Email notifications and replies may also be retained by our email delivery service, forwarding service and business mailbox. Please do not include passwords or access tokens.
AI with your own key
If you connect an AI key, we store its encrypted form and your selected provider to generate titles, descriptions and hashtags. Gemini receives your original video (up to 12 MiB) or its cover and your instructions; Groq receives the original MP4 to transcribe speech and generate copy; OpenRouter receives the cover and instructions and forwards them to a compatible free-model provider. We do not send data obtained from TikTok Shop to these features. You can disconnect the key in AI: that provider's stored key is removed. Other authorized connections may continue working; removing the last connection disables generation and cancels pending jobs. Your videos and copy remain.
Quota, any charges and third-party retention depend on the provider and the customer's project. Google may use free-tier content to improve its products and have it reviewed by humans; do not submit sensitive, confidential or personal information to Google's unpaid services. Its terms require paid services when the API client is made available to users in the EEA, Switzerland or the UK. Disconnecting NextVip does not revoke the key at the provider or confirm deletion of their copies or our historical backups.
Gemini · Groq · OpenRouter
Data we receive from connected platforms
When you connect a TikTok, YouTube, Instagram or Facebook account, that platform sends us an access token so we can post on your behalf. We store the token, the account identifier, the display name, the profile picture and the list of permissions granted. We request the narrowest set of permissions the feature needs.
Data generated by using the service
Depending on the connection you choose, NextVip may also receive data from Threads, Pinterest and X. Available information depends on the permissions you grant and the access approved by each platform. Connecting an account does not grant access to all of its features. LinkedIn is not currently offered: new LinkedIn accounts cannot be connected and nothing is published to LinkedIn. If you connected LinkedIn before, we keep that authorization and the data described here only until you disconnect it or delete your account, and handle it like that of the other networks.
When you enable a supported comments or messaging feature, we process comment and message text and identifiers, the related account or post, and reply status. We use this data to apply your configured rules, send permitted replies and display their history. Publishing permissions do not confer messaging permissions.
When an analytics feature is enabled and authorized, we retrieve available metrics for your posts, such as views, likes, comments and shares, to display in your dashboard. Comment retrieval may include the author's public display name, text, date and identifiers needed to associate the comment with your post. Metrics a platform does not provide are shown as unavailable.
- Distribution records. Which video went to which account, when, and the resulting post identifier and URL.
- Link clicks. When someone clicks one of your NextVip short links, we record the time, the referring page, the browser user agent and the country the request came from. We do not store the visitor’s IP address and we do not set advertising cookies on the redirect.
- Billing. Your subscription plan, its status (for example free trial or active), billing period, trial-end and renewal dates, and the customer and subscription identifiers issued by our payment processor. Card numbers never reach our servers.
2. Why we use it
| Purpose | Data used |
|---|---|
| Signing you in and keeping your account | Email, name |
| Publishing your videos to the accounts you connected | Videos, captions, platform tokens |
| Showing you how your links perform | Link clicks, distribution records |
| Charging for a paid plan and enforcing plan limits | Plan, subscription status and dates, payment processor identifiers |
| Keeping the service secure and diagnosing failures | Error records tied to your account |
We do not sell personal data. We do not use your videos, captions or audience data to train machine learning models, and we do not share them with other users.
3. Who we share it with
Depending on the feature you use and the provider configured for it, we use the services below. Connected social platforms also handle data under their own terms and privacy policies.
- Supabase — database, authentication and video storage.
- Vercel — hosting and delivery of the website.
- Resend — transactional email, including verification and account security messages. This includes the recipient address, message content and delivery records.
- Deletion request ledger — Cloudflare D1 stores an encrypted request record and a protected identifier, separately from the application database. We use it to review deletion requests after restoring a backup. Cloudflare Workers receives only the protected identifier and encrypted receipt; it does not receive the master recovery key. This record contains no video files or social platform credentials. Recording a request does not mean deletion has been completed.
- Support and business email — Supabase stores contact form submissions, Resend delivers email notifications and our Google business mailbox receives messages sent or forwarded to our contact address. Delivery and forwarding services may also process recipient details, content and delivery records. Deleting a notification in one service does not automatically delete its copies in the mailbox or our database.
- Product-data providers — retrieving product information from the public product identifiers needed for your selected workflow (RapidAPI, OpenWeb Ninja and DataForSEO); only the provider configured for an operation receives its request. These providers never receive data obtained from the TikTok Shop API.
- AI processing — text generation uses the owner's authorized cloud AI connections (Gemini, Groq or OpenRouter), with the content described in the AI with your own key section. Data obtained from TikTok Shop is excluded from these features.
- Optional publishing intermediaries — if you choose a connection through Buffer or Zernio, that provider processes account authorization and the content needed for the enabled publishing feature.
- Stripe — subscription payments, the free trial and the customer portal where you change or cancel your subscription. Stripe sells the subscription to you as merchant of record through Link and receives your billing details directly; we receive only the identifiers, the subscription status, the billing period and its dates.
- The platforms you connect — TikTok, YouTube (Google), Instagram, Facebook and Threads (Meta), Pinterest and X receive the content you authorize for their supported features. It is sent only to the accounts and destinations you select. LinkedIn is not currently offered and receives no new content.
Where processing takes place
Our primary database is configured in Oregon, United States, our Vercel server functions in Washington, D.C., and our transactional email sending in Northern Virginia. Administrative access and downloaded backups are managed from Pennsylvania. AI features use the cloud provider you choose with your own key. These locations do not guarantee that all processing remains in the United States: delivery networks, connected platforms and service providers may process information in other countries. Contact us for information about a particular feature or provider.
We disclose data to anyone else only if the law requires it, and we will tell you when we are permitted to.
4. YouTube API Services
NextVip uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service , and Google’s handling of your data is governed by the Google Privacy Policy .
You can revoke NextVip’s access to your Google account at any time from the Google security settings page . Doing so stops all future publishing to that channel. You can also disconnect the channel inside NextVip, which deletes the stored token immediately.
We use YouTube API data to upload the videos you ask us to publish and record their identifiers. If comments and analytics features are enabled and authorized, we also retrieve comments and metrics for videos belonging to the connected channel to display in your dashboard. These read operations do not publish replies or modify videos.
We do not build audience profiles from this data. We delete stored YouTube API data when you disconnect the channel or within 30 days of it being refreshed, whichever comes first.
5. TikTok and Meta
Connecting a TikTok account is governed by TikTok’s own terms and privacy policy; connecting an Instagram or Facebook account is governed by Meta’s. You can revoke NextVip’s access from the settings of each platform, and disconnecting inside NextVip deletes the stored token immediately.
TikTok Shop data
If you connect your TikTok Shop creator account, TikTok sends us, with your authorization: your creator open_id, the permissions (scopes) you granted, OAuth access and refresh tokens, and content and product events (webhooks) that link your videos to the products you promote. When you ask us to create a sharing link for a product tagged in your video, we also keep the video, product and campaign IDs and the link TikTok Shop returns.
We use this data only to show your TikTok Shop connection, to link your videos to those products and, when you use that feature, to create your own affiliate links. It is stored in the United States (Supabase, Oregon), and tokens are encrypted with AES-256-GCM before storage. We never sell it, use it for advertising or send it to AI providers.
When you disconnect in NextVip or revoke access in TikTok, we immediately delete your tokens, open_id, granted permissions, pending authorizations, events, product associations and sharing-link records. Events, product associations and sharing-link records are otherwise deleted after 30 days.
TikTok Shop, sellers or you can request a copy, correction or deletion at contacto@nextvip.app. Requests forwarded by TikTok Shop or a seller are acknowledged within 2 business days and completed within 10 business days; other requests are answered within 30 days. If a security incident affects TikTok Shop data, we notify TikTok Shop within 24 hours and affected creators or sellers within 72 hours.
6. How long we keep it
- Account data — until you delete your account.
- Platform tokens — until you disconnect the account or the token is revoked by the platform.
- Videos — until you delete them, or 90 days after your account is closed.
- Click records — 24 months, after which they are aggregated into counts that no longer describe individual visits.
- Billing records — as long as tax and accounting law requires.
- Free-trial record — a keyed one-way hash of your email address (never the address itself), kept for 3 years after your trial started, even if you delete your account, only to prevent repeated free trials.
Deletion request records are retained separately for recovery and reconciliation; closing an account does not automatically remove that record. Support inquiries, incident records and backups require separate handling according to their purpose and applicable obligations. The video retention periods do not by themselves describe retention for these categories or copies held by other providers. You can request information or exercise your rights through our contact form.
7. Security
NextVip uses HTTPS in transit, database access policies and server-side ownership checks to restrict access to account data. Trusted server processes access the data needed to perform authorized tasks. We never receive or store card numbers.
No service can promise perfect security. If we ever discover a breach affecting your data, we will tell you and the relevant authority without undue delay.
8. Your rights
You can request a copy, correction, deletion or restriction of processing of your data through our contact form or by writing to contacto@nextvip.app. We will respond within 30 days. Disconnecting a network does not delete your entire account or its posts. To review account deletion, open account deletion.
Depending on where you live you may also have the right to complain to a data protection authority. Nothing in this policy limits that right.
9. Children
NextVip is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, write to us and we will remove it.
10. Changes
If we change this policy in a way that affects how we use data you have already given us, we will tell you by email before the change takes effect.
11. Contact
For questions and requests about your data: contact form or contacto@nextvip.app.
NEXTVIP LLC — contacto@nextvip.app. This policy is governed by the law of the Commonwealth of Pennsylvania, United States.