Privacy Policy

1. Who we are

Avexio Inc. operates Avexio, an AI marketing platform that helps businesses create posts, images, and short videos, and optionally connect supported third-party social media platforms—including Facebook, Instagram, X, Threads, Pinterest, YouTube, and TikTok—and, where supported in the product, publish or schedule content to destinations you authorize. Questions about this notice can be sent to support@avexio.ai.

2. Information we process

Depending on how you use Avexio, we may process:

• Account and profile information, including name, email address, and authentication credentials managed by Supabase Auth.
• Organization and business information, such as workspace name, brand details, and uploaded logos.
• Content you submit or generate, including prompts, captions, images, videos, and related metadata.
• Subscription and billing records needed to operate checkout, invoices, and plan changes.
• Social connection data for supported platforms you authorize (including Facebook, Instagram, X, Threads, Pinterest, YouTube, and TikTok). That may include account or channel identifiers, usernames or display names, pages, boards, channels, or other destinations available to the authorized account, granted permissions or scopes, OAuth access credentials or tokens needed to maintain the connection, and related token expiry or refresh information.
• Publishing and scheduling records for content you ask Avexio to publish on supported platforms, such as status or results, provider post or content identifiers where applicable, and Meta-derived engagement information for Facebook Page posts when available through the permissions you granted.
• Operational logs and hosting telemetry created while providing the service.

3. Why we use this information

We use this information to:

• Create and authenticate accounts and keep you signed in.
• Provide workspaces, brand profiles, and content libraries.
• Generate marketing content with AI providers you invoke in the product.
• Connect and maintain authorized social accounts and show available publishing destinations.
• Publish or schedule content to destinations you authorize on supported platforms, when that capability is available in the product and you request it.
• Retrieve information needed to operate the authorized integration, maintain connection authorization, diagnose integration failures, and record publishing or scheduling results.
• Meter plan allowances, credits, and subscription status.
• Send transactional messages such as invites and authentication email.
• Maintain security, debug failures, and operate the hosted service.

4. Processors and third parties

Avexio uses infrastructure and AI providers to run the product. The following are evidenced by the current application:

• Supabase — authentication, application database, and related backend services.
• Cloudflare R2 — object storage for uploaded and generated files such as logos, images, video assets, and audio.
• OpenAI — text, image, vision, speech/audio generation, and related AI processing for prompts and generated content.
• Fal / Flux — image generation used in the AI video first-frame path.
• Pika — image-to-video generation for photographic video motion.
• Stripe — subscription checkout, customer portal, invoices, and payment processing.
• Meta (Facebook, Instagram, and Threads) — OAuth and account connection; destination discovery and selection; publishing and scheduling where supported in the product; and Facebook Page-post engagement information when you connect a Facebook Page and grant the related permissions.
• X — OAuth and account connection; text and image publishing and scheduling where supported in the product.
• Pinterest — OAuth and account connection; reading the authorized account identity and available boards so you can select a board; and, when you request it, publishing or scheduling an image Pin or a video Pin to that board. Avexio does not publish text-only Pins.
• TikTok — OAuth and account connection; and, when you request it, video publishing or scheduling to the connected TikTok account. Current publishing through this app is private (Only me). Avexio does not publish TikTok photo posts.
• Google / YouTube — Google OAuth and YouTube API Services so you can authorize a Google/YouTube account, select a YouTube channel, and—when you explicitly publish or schedule a video in Avexio—upload that video to the selected channel. See section 6A.
• Resend — transactional email such as agency invitations. Authentication email is sent through Supabase Auth.
• Vercel — application hosting, deployments, and scheduled jobs.

Those providers process information according to their own terms and privacy notices. Avexio does not control those providers’ privacy practices. Avexio does not sell personal information.

5. Cookies and session storage

We use cookies required to keep you signed in (Supabase session cookies) and to remember the organization you currently have selected. We do not currently operate a separate product-analytics or advertising pixel in the application.

6. Social platform connections

When you connect a supported social platform from Social Connections in the dashboard, you authorize Avexio to access only the information and permissions needed for that integration for accounts you authorize. Avexio does not use those connections to access arbitrary other users’ private social data, run advertising or ad-campaign management, or provide social-platform analytics products beyond what is described in this notice.

If you connect Facebook, you authorize Avexio through Meta. Avexio stores Facebook user and Page access tokens in encrypted form using secure credential storage so the authorized connection can continue without requiring Facebook sign-in for every action. Avexio can list Facebook Pages you are permitted to manage. For Pages managed through a Meta Business Portfolio, Avexio requests the business_management permission only so those Pages can be discovered and listed. Avexio does not use business_management to manage ad accounts, business people or roles, Business Manager administration, or unrelated business assets.

If you connect Instagram or Threads through Meta, or connect X or Pinterest, Avexio stores the authorization credentials needed to maintain that connection and may list destinations available to the authorized account (such as an Instagram professional account, Threads profile, X account, or Pinterest boards) so you can select where content should go when publishing is available.

You can disconnect supported social accounts from Social Connections in the dashboard. Disconnecting removes or disables stored authorization credentials and tokens for that provider connection in Avexio according to the product implementation for that provider, disables related destination selection for that connection, and stops Avexio from using that connection to access or publish through Avexio. For Facebook, Avexio also makes a best-effort request to revoke corresponding Meta permissions; that request can fail, and disconnect still completes on Avexio. Avexio does not guarantee that permissions are removed on a provider’s systems. If you remove Avexio from Facebook, that deauthorization also stops Avexio from accessing or publishing through that Facebook identity. It does not by itself delete historical Facebook-related records in Avexio. A Facebook data-deletion request is a separate, stronger process. Appropriate historical Avexio operational and publication records may remain unless separately removed through product or support processes.

6A. Google / YouTube

Avexio uses Google OAuth and YouTube API Services when you choose to connect YouTube from Social Connections. Connecting is optional and user-directed: you must explicitly start the Google authorization flow for a business workspace.

When you connect Google/YouTube, Avexio may access:

• Basic Google identity information needed to associate the OAuth connection with your Avexio business (such as a stable Google account subject identifier used for the connection record).
• YouTube channel information available to the authorized Google account (such as channel identifiers, titles, and handles) so you can discover and select which channel Avexio should use for that business.

Avexio uses YouTube upload permission to upload videos only when you explicitly publish or schedule a video through Avexio for a completed video in your library. Eligible connected users can choose Private, Unlisted, or Public. YouTube may reject the upload or apply a different visibility.

Avexio stores OAuth access and refresh credentials in encrypted form using secure credential storage so the authorized connection can continue without requiring Google sign-in for every action. Avexio also stores channel identifiers and selection state, and publication or scheduling metadata (such as titles you provide, Made for Kids declarations, provider video identifiers, permalinks, and job status) needed to operate publishing/scheduling and to maintain publication history.

Google/YouTube-derived connection credentials and channel identifiers are stored with Avexio’s infrastructure providers (including our application database host) so the product can run. Video files you generate or store in Avexio may reside in Avexio object storage and are sent to YouTube only when you publish or schedule. Avexio does not sell Google user data and does not use Google user data for advertising. Separately, content you create in Avexio (prompts, captions, images, videos) may be processed by Avexio’s AI and hosting providers as described in section 4; that is distinct from Google OAuth credentials.

Avexio’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Avexio’s use of information received from Google APIs is also subject to the Google Privacy Policy. Avexio’s use of YouTube API Services is also subject to the YouTube API Services Terms of Service and the YouTube API Services Developer Policies.

You can disconnect YouTube from Social Connections in the Avexio dashboard, or revoke Avexio’s access to your Google Account from Google’s security settings page at https://security.google.com/settings/security/permissions. Disconnecting in Avexio programmatically revokes the Google authorization when possible, burns locally stored OAuth credentials, and deletes applicable stored YouTube Authorized Data associated with that consent as soon as possible and within 7 calendar days. If you revoke access on Google’s security settings page, Avexio deletes related YouTube API Data as soon as that revocation is detected and within 30 calendar days. Deleting Avexio-stored data does not delete videos or other data stored on YouTube; to delete data on YouTube, use YouTube or YouTube Studio. Avexio-created workspace content you authored in Avexio (for example videos generated in your library) is distinct from YouTube API Data and is handled under Avexio account or data deletion requests separately.

Avexio does not use Google user data obtained through Google APIs to train generalized artificial intelligence or machine-learning models. Separately, prompts and media you create in Avexio may be processed by AI providers you invoke in the product as described in section 4; that product content is distinct from Google OAuth credentials and Google API-derived connection identifiers.

6B. Security and Protection of Google User Data

Avexio applies technical and organizational safeguards intended to protect Google/YouTube user data and related sensitive credentials processed for the YouTube integration. Absolute security cannot be guaranteed, and these measures may evolve as the product and hosting environment change. Current product and infrastructure practices include:

• Encryption in transit. Avexio is served over HTTPS in production so Google user data and other information exchanged with the Avexio application travel over encrypted TLS connections between your browser or clients and our hosting provider.
• Protection of OAuth credentials at rest. Google OAuth access and refresh tokens used for YouTube are encrypted by Avexio before storage using an application encryption key held in server environment configuration. Tokens are stored as ciphertext in a dedicated secrets table; they are not exposed to ordinary browser or customer JWT database reads.
• Server-side credential handling. Google client secrets, encryption keys, and decrypted OAuth tokens are handled in Avexio server-side processes. Privileged token read/write operations use service-role database access on the server. Tokens are not designed to be returned to the customer UI.
• Access controls. Google/YouTube connection records are associated with the business workspace that authorized them. Application authorization and Postgres row-level security policies are used so that connection metadata is available only to authorized members of that workspace (and to Avexio server processes that operate the integration).
• Private media storage with controlled access. Video and other media files you store in Avexio for publishing reside in private object storage (Cloudflare R2). Browser access to those objects uses authenticated, time-limited signed URLs rather than permanent public links. Files are sent to YouTube only when you explicitly publish or schedule.
• Least-privilege Google access. Avexio requests only the Google OAuth scopes needed for YouTube channel discovery and user-directed YouTube video upload, using the Private, Unlisted, or Public visibility choices supported by Avexio (and OpenID for a stable account subject). Avexio does not request Google profile or email scopes for this integration.
• Operational and administrative safeguards. Hosting, database, and object-storage providers process data under their own security programs. Avexio limits privileged operations to server-side paths, stores secrets in environment configuration rather than in client code, and retains operational logs as needed to run and secure the service.
• Disconnection and revocation. You can disconnect YouTube in Avexio and revoke Avexio via Google’s security settings page as described in section 6A, which removes or burns Avexio’s local credentials, stops future authorized Google API use under those credentials, and deletes applicable stored YouTube Authorized Data on the timelines in section 6A.

These protections apply to Google user data Avexio processes for the YouTube integration (including OAuth credentials and channel identifiers obtained through Google APIs). They complement the use, sharing, Limited Use, retention, and deletion disclosures in sections 6A and 8.

7. Publishing and engagement

Avexio publishes or schedules content only when you request it and only to destinations you authorize on supported platforms where that capability is available in the product. Current publishing and scheduling support includes Facebook Page posts (text and, when present in the product flow, a single image), Instagram image publishing and scheduling, text and image publishing and scheduling to X and Threads, YouTube video publishing and scheduling when an eligible connected channel chooses Private, Unlisted, or Public, and TikTok video publishing and scheduling. YouTube may reject an upload or change visibility. Current TikTok posts through this app are private (Only me). Avexio does not publish TikTok photo posts. When you request it, Avexio can publish or schedule an image Pin or a video Pin to a Pinterest board you select, using your public caption as the Pin description when you have one. Avexio does not publish text-only Pins. Avexio does not currently publish to LinkedIn.

When available, Avexio may read engagement information for posts Avexio published to a connected Facebook Page, such as reactions, comments, and shares, using the pages_read_engagement permission. Avexio does not currently request Facebook Insights permissions (for example pages_read_insights) and does not obtain impressions or reach from Insights. Avexio does not provide Pinterest advertising, ecommerce, or Pinterest analytics functionality.

8. Retention and data deletion

We keep account, content, billing, and connection records while they are needed to provide the service. The product does not currently expose an automated account-deletion control or publish a fixed retention schedule. If you want a copy of your information or want your Avexio account or data deleted, email support@avexio.ai. We will review requests manually. Disconnecting a social provider is not the same as deleting your Avexio account or workspace data.

For Facebook-specific disconnect, deauthorization, and Meta data-deletion requests, see our Data deletion page. Avexio implements Meta deauthorization and User Data Deletion callbacks. When those callbacks are configured on the Meta app dashboard and running in a production deployment, Meta can notify Avexio. Deauthorization stops Facebook access and publishing for matching connections while retaining historical Facebook-related records. Data deletion removes or anonymizes Facebook-sourced connection data associated with the request. Until that production configuration is in place, Facebook data-deletion requests can also be sent to support. Avexio does not currently implement an automated Google/YouTube data-deletion callback; Google/YouTube-related Avexio deletion requests are handled through the support process above (applicable YouTube Authorized Data deleted as soon as possible and within 7 calendar days) and through Google Account revocation described in section 6A.

9. Your choices

You can update profile and business information in the dashboard, manage billing through Avexio billing and the Stripe customer portal, disconnect social accounts, revoke third-party authorizations with the provider (including Google), and stop using the service by cancelling a subscription at period end. Privacy requests that the product cannot complete in-app should be sent to the support address above.

10. Children

Avexio is intended for business users. It is not directed to children.

11. Changes

We may update this notice as the product changes. The “Last updated” date at the top of this page will change when we do. Continued use of Avexio after an update means you are aware of the revised notice.

12. Contact

Privacy questions: support@avexio.ai. See our Data deletion page. You can also use our Contact page.