Last updated 16 October 2026
Data deletion
1. Disconnect inside Vuelly
- Sign in at vuelly.com/login.
- Open the client, then the integrations or sync area for that client.
- Choose Disconnect on Meta Ads or Klaviyo, and confirm.
For Meta, we ask Facebook to revoke Vuelly's permission and we delete the stored access token immediately. For Klaviyo OAuth, we send the refresh token to Klaviyo's revoke endpoint and delete our copy. A pasted Klaviyo private API key has no revoke endpoint. We delete our copy, and you should revoke the key in Klaviyo as well.
Disconnect does not delete the reporting rows already synced for that client. Those rows stay until you ask us to delete them (section 4) or, for Meta, a matched Facebook deletion callback deletes them (section 7). Offboarding a client revokes its tokens and its share link. It also does not, by itself, delete historical reporting rows.
2. Remove Vuelly in Facebook
- Open Facebook and go to Settings & privacy, then Settings.
- Open Business integrations. Meta sometimes labels the same list Apps and websites.
- Find Vuelly and remove it.
Removing the app tells Meta to notify us. If our app is configured with the deletion callback in section 7, Meta sends a signed request, we process it, and Meta shows you a status link. You can also follow section 4 and include your Facebook user id if you want a person to confirm the deletion.
3. Remove Vuelly in Klaviyo
In Klaviyo, open the account settings and remove Vuelly from connected applications, or revoke the private API key you pasted into Vuelly. Klaviyo does not send us an automatic deletion callback. Disconnect in Vuelly as well, or email us, so we delete the copy we hold.
4. Ask us by email
Email hello@vuelly.com from the address on the Vuelly account. Use the subject "Data deletion request". Include:
- the account email;
- whether you want one client, one platform, or the whole account deleted;
- any Facebook confirmation code or Facebook user id, if you have one.
We may ask a short question to confirm you control the account. We complete a verified request within 30 days and email you when it is done. There is no charge.
5. What is deleted, and when
| Action | Tokens | Synced reporting data |
|---|---|---|
| Disconnect in Vuelly | Deleted immediately, and revoked at the provider where a revoke call exists. | Kept until a deletion request or a matched Meta callback. |
| Offboard a client | Deleted and revoked, and the share link is revoked. | Kept until a deletion request or a matched Meta callback. |
| Matched Facebook deletion callback | Revoked if still stored, then the Meta connection is deleted. | Meta reporting rows for each matched connection are deleted with that connection. The status page shows the result. |
| Email request | Deleted as part of the request. | Deleted within 30 days, for the clients or the account you named. |
A matched callback deletes Meta data for connections where we stored the Facebook user id of the person who clicked Connect. Connections made before that id was stored, or made by a different Facebook user, will not match. Use section 4 for those. Klaviyo data is deleted through disconnect plus an email request. The callback does not delete Klaviyo rows or the agency's Google account.
Deletion removes rows from the live database. A hosting or database backup may keep a copy until the provider overwrites that backup. We do not use backups to put deleted customer data back, except when restoring from an incident, in which case we delete it again.
6. What we may keep
We may keep records the law requires. We do not hold tax invoices today, because billing is not live. If we later charge fees, tax records are generally kept for 5 years. Security and audit logs may be kept for up to 12 months, or longer when an investigation or a law requires it. Those logs can include an ad account id and an IP address from a sign-in. They do not include platform tokens or the reporting tables once those have been deleted.
7. Facebook deletion callback
Vuelly implements Meta's data deletion callback. The callback address for the Meta App Dashboard is https://vuelly.com/api/meta/data-deletion. Meta posts a signed_request. We check the HMAC-SHA256 signature with the app secret. If the signature is valid, we record the request and return JSON with a url and a confirmation_code. The url is a public status page. A real confirmation code is 32 hexadecimal characters. The address looks like https://vuelly.com/data-deletion/status/{confirmation_code}.
The status page shows whether the request is still in progress, whether matching Meta connections were deleted, or whether no connection was stored for that Facebook user. It does not show the Facebook user id. This instructions page remains available so a person can delete data without going through Facebook. The Privacy Policy is the full description of retention and of the roles of the agency and Vuelly.