Privacy Policy
Last updated ·
Who we are
Vireo (“we”, “us”) builds an AI representative for creators. When you connect your accounts, our agents find brand-sponsorship opportunities, draft and send outreach, and negotiate deal terms on your behalf, with your approval required at the important moments. This policy explains what information we collect to do that, how we use it, and the choices you have. Questions any time: founders@vireoengine.com.
Information we collect
Account & profile. When you sign up (through our sign-in provider, Clerk) we collect your email address and display name. During onboarding you provide profile details that shape your agent: your content niche, gender and age band, pricing preferences, and timezone.
Gmail (if you connect it). We request two permissions only: read your mail and send mail on your behalf. We can never modify, label, or delete anything in your mailbox. From your inbox we process incoming messages to identify sponsorship-related conversations; messages that are part of a deal are stored in full (subject, body, participants, and safe attachments) so your agent can negotiate with complete context. Your personal sent mail on non-deal threads is never collected. Humans at Vireo do not read your email content (the reading is done by software) except with your explicit consent, when necessary for security or abuse investigation, or as required by law.
TikTok (if you connect it). We collect your profile information, follower and engagement statistics, and your recent videos with their captions, to build your media kit and match you with relevant brands.
Content you upload. Media-kit photos, clips, and documents; and if you share an analytics screenshot, we extract audience demographics from it, which you review and confirm before anything is shown.
Media-kit page views. When someone views your public media kit, our analytics record only the referring website and a timestamp. No IP addresses and no browser fingerprints.
Brand contact information. To find opportunities for you, we compile business contact details of brand marketing teams (names, work emails, titles) from public and professional sources. This is business-to-business information about companies, handled with source records and opt-out suppression.
How we use information
- To operate the service: identify opportunities, draft and send outreach, negotiate deals, with your approval gates.
- To personalize your agent: your writing style, preferences, and history make its work sound like you.
- To secure, debug, and improve the reliability of the service.
We do not sell your personal information, show you ads, or use third-party analytics on your email data.
Google API disclosure
Vireo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.
We do not use, retain, or transfer Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models. Google user data is used only to provide and improve your own personalized experience within Vireo.
AI processing
Vireo is an AI product: message content and profile data are processed by large-language-model providers acting as our service providers (Fireworks AI, OpenAI, Anthropic, and Voyage AI), strictly to provide the service to you. These calls run through our own proxy, which is configured not to log message content.
Service providers
We use a small set of vendors to run Vireo, each processing data only on our instructions: Clerk (sign-in), Neon (database), Cloudflare (file storage), Railway and Amazon Web Services (hosting and key management), Inngest (workflow processing), Upstash (caching), Google (Gmail API and notifications), TikTok (platform API), the AI providers listed above, and Serper and Hunter (brand-side business contact data).
Cookies
We use only the essential cookies our sign-in provider (Clerk) sets to keep you logged in securely. We use no advertising or tracking cookies.
Security
- Least-privilege access: we request the minimum account permissions the service needs.
- Your connection credentials are encrypted at rest (AES-256-GCM) with keys held in a managed key service (AWS KMS).
- Stored data, including message content, is encrypted at rest by our database provider.
- All data moves over encrypted connections (TLS); message content is redacted from our system logs.
Retention & deletion
We keep your information while your account is active so your agent has the context to represent you. When you delete your account (in the product, or by emailing us), we revoke our access to your Google account at Google, destroy the stored connection credentials, and delete your account and its data. We honor deletion requests within 30 days. De-identified usage and cost telemetry (with your identity removed) may be retained for audit purposes.
You can also disconnect Gmail or TikTok individually at any time, which revokes our access to that account immediately.
Age
Vireo is for creators aged 13 and older, and is not directed at children under 13. Creators aged 13–17 receive additional protections: age-restricted brand categories are automatically excluded from their opportunities.
Your rights
Vireo currently serves creators in the United States. Regardless of where you live or what statutes apply, we honor requests to access, correct, or delete your personal information. Email founders@vireoengine.com and we will respond within 30 days.
Changes to this policy
If we materially change how we handle your information, we will update this page and note the new date above. Continued use of the service after a change means the updated policy applies.