Privacy policy
Visteria (“we”) is run by MUTABLE, Croatia, who is the controller of your personal data. Questions or requests: privacy@visteria.app.
The short version: we read your reels and their statistics, read-only, so we can explain how they performed. We never post for you, never sell data, and never show your reels or numbers to other users.
What we collect
When you sign in with Instagram
Using Instagram’s official API with the permissions instagram_business_basic and instagram_business_manage_insights:
- Your Instagram user ID, username, account type, display name, bio, website, and follower, following and post counts.
- Your posts: captions, post time, media type, link, cover image and, where Instagram provides it, the video file.
- Statistics for your posts and account: views, reach, likes, comments, saves, shares, skip rate, watch time, profile visits, follows, and aggregated audience breakdowns (countries, cities, age ranges, gender). These are totals — we don’t receive who your individual viewers are.
- An access token that lets us fetch the above. It’s stored encrypted at rest and never shown in the app.
When you connect YouTube
Using Google’s OAuth with the scopes youtube.readonly and yt-analytics.readonly, plus your Google account email:
- Your channel ID, name and handle; your videos’ titles, upload times and public statistics.
- YouTube Analytics for your videos: views, watch time, average view duration, subscribers gained, and the audience retention curve.
- A refresh token to keep the connection working.
What you give us
- Your email address if you sign in with email or join the waitlist, and an Instagram handle if you add one.
- Videos you upload (for reels Instagram doesn’t hand out) and Instagram Insights screenshots you upload.
- Tags, notes and goals you enter for your account and reels.
Technical data
Standard server logs (IP address, browser, time) kept for security and debugging, and a cookie that keeps you signed in and remembers which account you’re viewing. We use no advertising or cross-site tracking cookies.
What we use it for
- To provide the service (performance of our contract with you): tracking your posts over time, analysing your videos, writing explanations and tips, and showing all of it to you.
- To improve predictions (legitimate interest): we use statistics and analysis results from Instagram reels across all accounts, in aggregated, de-identified form, to improve how well Visteria predicts reel performance for everyone. This never makes your reels, captions or numbers visible to anyone else. You can object at any time by emailing privacy@visteria.app.
- To keep the service secure and working (legitimate interest): logs, error monitoring, abuse prevention.
- To email you about your account, and about the beta if you joined the waitlist. You can unsubscribe at any time.
Google user data (Limited Use)
Visteria’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from YouTube is used only to show you your own channel’s analysis. It is not used for the shared prediction model, not used for advertising, not sold, and not read by people except with your permission, for security, or where the law requires it.
Who processes it for us
We use these providers, each under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in, background jobs | EU (Frankfurt) |
| Vercel | Hosting the website and app | EU (Frankfurt) for app servers; global CDN |
| Anthropic (Claude) | Analysing video frames, screenshots and captions; writing explanations | USA |
| GitHub | Running the video analysis job (files are deleted after each run) | USA |
| Stripe | Payments, once paid plans start | EU / USA |
Anthropic doesn’t use data sent through its API to train its models. Transfers outside the EU rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
How long we keep it
- Account data, posts, statistics and analyses: while your account is active.
- After you disconnect or ask us to delete: removed within 30 days, including uploaded videos and screenshots. Database backups roll off within a further 7 days.
- Aggregated, de-identified statistics used for predictions may be kept, since they can’t be tied back to you.
- Waitlist emails: until you join or ask us to remove you.
Your rights
Under the GDPR you can ask to access, correct, export or delete your data, restrict or object to how we use it, and withdraw consent. Email privacy@visteria.app and we’ll reply within 30 days. You can also complain to the Croatian data protection authority (AZOP) or the authority where you live. To delete everything, see how to delete your data.
Children
Visteria is not meant for anyone under 16, and we don’t knowingly collect their data.
Changes
If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect.
Who we are
MUTABLE, obrt za računalno programiranje · Sokolska ul. 16, 10000 Zagreb, Croatia
hello@visteria.app