Privacy Policy

Last Updated: August 13, 2026

Vistoso Creative ("we," "us," or "our") operates the website vistosocreative.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices you have.

1. Information We Collect

Information You Provide

When you submit our contact form, we collect the information you include, such as your name, email address, phone number, and message content. This information is stored in our database and forwarded to our email.

When you subscribe to our email communications, we collect your email address and any additional information you choose to provide.

When you request a gated downloadable resource (such as a guide, template, or checklist), we collect your email address and any other information requested by the download form. We store this information in our database and use it to email you a secure download link.

When you use our Ad Spend Calculator and ask us to email your results, we collect your email address together with the inputs you provide (your trade, city, and estimated monthly ad clicks) and the calculated ad spend figures. We store this information in our database and use it to email you your breakdown.

Information Collected Automatically

We use Google Analytics to understand how visitors use our site. Google Analytics uses cookies to collect data such as your IP address, browser type, operating system, referring URLs, device information, pages visited, and time spent on pages. Google Analytics may also collect demographic and interest data.

We do not use any additional tracking pixels, advertising cookies, or third-party analytics tools beyond Google Analytics.

2. How We Use Your Information

We use the information we collect to:

Respond to inquiries submitted through our contact form
Send email communications you have opted into
Analyze website traffic and usage patterns to improve our site
Maintain and improve the performance and security of our website
Deliver downloadable resources and calculator results you request
Follow up with you about our services after you submit a lead-capture form

We do not use your personal information for automated decision-making or profiling.

3. Cookies and Tracking

Our site uses a cookie consent banner. When you visit our site, you will be asked to accept or decline non-essential cookies before any tracking takes place.

Essential cookies are used to operate the website and do not require consent. Analytics cookies placed by Google Analytics require your consent and are only activated if you accept them.

You can change your cookie preferences at any time through the cookie settings on our site, or by clearing cookies in your browser settings.

4. Third-Party Services

We use the following third-party services to operate our website and communications:

Google Analytics (analytics): collects anonymized usage data via cookies. Google's Privacy Policy
Amazon Simple Email Service (SES) (email delivery): processes email addresses for sending communications on our behalf. AWS Privacy Notice
MongoDB (database): stores contact form and lead-capture submissions (including resource download requests and Ad Spend Calculator results). Data is hosted on secure, access-controlled infrastructure.
Vercel (hosting): serves our website. Vercel's Privacy Policy
Cloudflare Turnstile (spam protection): verifies that form submissions come from a human rather than a bot. Turnstile may process limited browser and device signals to make this determination; verification tokens are not stored with your submission. Cloudflare's Privacy Policy
Hetzner (hosting — social media management platform): hosts our self-hosted social media scheduling tool and its database on access-controlled infrastructure. Hetzner's Privacy Policy

These services only process data as necessary to perform their functions on our behalf.

5. Social Media Management Services

Vistoso Creative operates a self-hosted social media scheduling platform (Postiz, at postiz.vistosocreative.com) to publish and schedule content on behalf of our clients. Client social accounts are managed under a single Vistoso Creative administrator account; we operate the tool as a service provider on our clients' behalf. This section explains what data that platform handles when a social account is connected to it.

Accounts We Connect

With the account owner's authorization (via each platform's OAuth consent flow), we connect accounts on:

Meta — Facebook Pages and Instagram business/creator accounts
LinkedIn — member profiles and company pages
Google Business Profile — business locations
TikTok — business/creator accounts

What We Collect and Store

When an account is connected, we receive and store:

Access and refresh tokens issued by the platform, used solely to act on the connected account with the permissions granted at consent
Account and page metadata — such as page/profile ID, name, username, and profile picture — used to identify the connected account inside the tool
Content we create — scheduled and published post content (text, images, video), publish times, and links to the resulting live posts

This data is stored in a self-hosted database on a Hetzner server operated by Vistoso Creative. It is never placed on a shared or third-party scheduling service.

How We Use Platform API Access

We use each platform's API only to:

Publish and schedule posts (including photos, videos, stories/reels, and carousels) to connected accounts
Post first comments or replies on our own published posts, where the platform supports it
List the pages/profiles the account owner selected during consent, so they can be chosen inside the tool
Read engagement and analytics data for connected accounts' own posts, to report performance to the account owner

We do not read private messages, we do not access other users' personal data, we do not post without a schedule the account owner's team has approved, and we do not use social data for advertising, profiling, or automated decision-making.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Data Shared With vs. Received From Each Platform

Shared with the platform: the content of posts we publish (text and media), scheduling instructions, and the OAuth tokens the platform itself issued.
Received from the platform: account/page metadata, post identifiers and permalinks for content we published, and engagement/analytics metrics for that content.

We do not sell or share this data with any other third party, and data received from one platform is never shared with another.

Retention and Deletion of Social Account Data

Access tokens are retained only while an account remains connected. When an account is disconnected from the tool — or access is revoked from the platform's own settings (e.g., Facebook Settings → Business Integrations, Google Account permissions, TikTok Manage app permissions) — the stored tokens become invalid and are deleted from our system.
Scheduled and published post content and analytics snapshots are retained for the duration of our engagement with the client, then deleted on request or at contract end.
To request deletion of all data associated with a connected social account, email hello@vistosocreative.com with the account name and platform. We will confirm deletion within 30 days.

6. Data Sharing

We do not sell, trade, rent, or otherwise share your personal information with third parties for their own marketing purposes.

We may share information with the third-party service providers listed in Section 4, solely for the purposes described in this policy. We may also disclose information if required by law, regulation, or legal process.

7. Data Retention

Contact form and lead-capture submissions (including resource download requests and Ad Spend Calculator results) are retained in our database indefinitely unless you request deletion. Email subscriber information is retained for as long as you remain subscribed. Google Analytics data is retained according to Google's default retention settings. Social media account data is retained as described in Section 5.

You may request deletion of your data at any time by contacting us (see Section 11).

8. Data Security

We take reasonable measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include secure hosting with Vercel, encrypted data transmission via HTTPS, and access-restricted database storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights

You have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete personal data
Delete your personal data from our systems
Opt out of email communications at any time using the unsubscribe link in any email
Withdraw cookie consent at any time through the cookie settings on our site

To exercise any of these rights, contact us at hello@vistosocreative.com. We will respond to requests within 30 days.

10. Children's Privacy

Our website is not directed at children under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us at:

Vistoso Creative hello@vistosocreative.com

Staunton, Virginia