Privacy Policy

This Privacy Policy describes how VHcom ("we", "our", the "Platform") handles information when our internal operations staff ("users", "operators") use the Platform to run e-commerce and social commerce operations on the accounts our team is authorized to manage on third-party platforms.

VHcom is not a public consumer product. Access is restricted to authorized VHcom staff accounts.

1. Information we collect

Account information — the work email and display name of VHcom staff who sign in to the Platform.

Third-party OAuth tokens — when an operator connects an account they are authorized to manage on a third-party platform (including but not limited to TikTok, Meta / Facebook / Instagram, Google, Etsy, and Amazon), we store the access and refresh tokens issued by that platform.

Third-party platform data — for accounts connected by an operator, we may read content metadata, post and listing performance, order data, and ads reporting (spend, impressions, clicks, conversions) through the APIs of each connected platform.

Operational data — order, product, and inventory records synced from connected shops, plus project plans, listing drafts, content drafts, and ad creatives produced by the Platform's AI agents on behalf of the operator.

The VHcom mobile app — the app (iOS and Android) is for the same staff accounts. Beyond the information above, it handles:

• Location — read only while the Attendance screen is open and at the moment a staff member clocks in or out, to check that they are at their workplace. The position of each clock-in and clock-out is stored with that attendance record. The app never reads location in the background.
• Attendance records — clock-in and clock-out times (set by our server's clock), breaks, leave and correction requests, and signals used to keep attendance honest: whether the phone reported a mock location, a random identifier the app creates per installation, and the phone's clock at the time of the punch.
• Photos and camera — only the photos a staff member takes or picks to attach to a task or a chat message are uploaded. The app does not read the rest of the photo library.
• Face ID / fingerprint — the optional app lock is handled entirely by the device. No biometric data reaches VHcom.
• Push notification token — stored so we can send the notifications a staff member is due, and removed when they sign out on that device.

Employment records — for staff, the Platform keeps the records our HR team needs to run payroll and employment: job and contract details, pay and payslips, salary advances and expense claims with their receipts, documents a staff member or HR uploads, and the personal details a staff member enters on their own profile (date of birth, ID number, address, bank account).

Job applications — when someone applies through one of our public job pages, we keep the name, phone number, email, link to their CV and the answers they submit.

2. How we use information

We use the information above solely to operate the Platform for VHcom staff: to publish AI-drafted content and listings to authorized third-party accounts, to manage ad campaigns for our internal projects, and to surface performance metrics to the operators running those projects.

Location and attendance data are used only to record working time, handle leave and corrections, and prepare payroll. Employment records are used only for employment and payroll administration. Job applications are used only to consider the applicant for the role.

We do not sell or rent personal data or data derived from any third-party platform. The mobile app contains no advertising and does not track users across other companies' apps or websites. We do not use such data to build advertising profiles, to train general-purpose AI models, or to enrich any third-party dataset.

3. How we store and protect data

OAuth tokens from every connected platform are encrypted at rest in our database and scoped to the team that connected the account. They are never exposed to the Platform frontend. Sessions are issued as HS256-signed cookies and invalidated on logout.

Reporting data is cached for up to 90 days for trend analysis and then aged out. Raw media assets are uploaded directly to the destination platform and are not retained on our servers after publish. Order PII from marketplace platforms is read only as needed for operations and is not used for any other purpose.

Access to staff data follows the staff member's role. A clock-in position and the attendance signals above are visible only to the people who run attendance for that team (its owner, admins and HR). Pay is visible only to company HR, platform administrators and the staff member concerned. ID and bank account numbers are shown masked to company HR and platform administrators until they ask to see them in full. Uploaded documents are private and opened only through short-lived links.

4. Sharing

We share data only with infrastructure providers strictly necessary to operate the Platform (hosting, error monitoring), bound by data processing agreements. We do not share data derived from third-party platforms with any other third party.

5. Retention and deletion

Operators can disconnect any third-party account from the Platform at any time, which revokes the stored tokens and stops further data access. To request deletion of any remaining data, contact us via the address listed on our Data Deletion page. We honor deletion requests within 30 days.

Job applications are deleted twelve months after they are submitted, as the application form states; the application of someone who is hired becomes part of their employment record. Attendance, payroll and employment records are kept for as long as we are required to keep them as an employer. A staff member can ask for their account and personal details to be deleted through the same page; records we are legally required to retain are kept only for that purpose.

6. Children

VHcom is restricted to authorized internal staff and is not directed to children under the age of 16.

7. Compliance with platform policies

Our use of each connected platform's data complies with that platform's developer terms, platform policies, and data-use requirements, including (where applicable) the TikTok Developer Terms of Service, the Meta Platform Terms, the Google API Services User Data Policy (including the Limited Use requirements), Etsy's API Terms of Use, and the Amazon Acceptable Use Policy for SP-API and the Amazon Ads API.

8. Changes

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page.

9. Contact

For any privacy question, contact us via the address listed on our Contact page.