Last updated 16 October 2026
Privacy Policy
1. Who we are
Vuelly is a reporting dashboard for marketing agencies. It is operated by Corey Tatnell trading as Vuelly, a sole trader (ABN 82 478 788 326), in Queensland, Australia. Vuelly is not a registered business name. The service is published at https://vuelly.com.
The privacy contact is hello@vuelly.com. That address is the privacy officer for requests and complaints.
We handle personal information in the way this policy describes, following the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 (Cth). A business with annual turnover of $3 million or less can be exempt from those principles unless an exception applies or it opts in. Whether that exemption applies to Corey Tatnell in a given year is for the operator to confirm. We apply this policy either way. Where the Act applies, the access, correction, complaint, and breach rights below are legal rights. Where it does not, those commitments still bind us as a matter of this policy and our contract with the agency.
2. The two roles we play
Agency account data. For the agency's own account (the Google identity, the agency profile, support mail, and any future billing record), Vuelly is the organisation that decides why and how that information is handled. In privacy-law language, we are the controller of that information. The agency user is the individual.
Client platform data. When an agency connects a client's Meta ad account or Klaviyo account, the agency decides which client to connect, which account to select, and who may see the report. The agency is the controller of that client data. Vuelly handles it only to provide the dashboard the agency asked for. In privacy-law language, we are the processor, or service provider, for that data.
A person whose information sits inside a client's Meta or Klaviyo account should contact the agency first. We will help the agency respond. Section 16 explains how.
3. What we collect
3.1 Agency account
When someone signs in with Google, we collect:
- name and email address;
- the Google account identifier, and any profile image URL Google includes in the sign-in response (Supabase Auth stores that sign-in record; our profiles table stores the name and email);
- agency name, timezone, and the rough size of the client book entered during setup;
- sign-in and sign-out events, including the IP address, in an audit log.
We ask Google only for the OpenID sign-in scopes openid, email, and profile. We do not ask for Gmail, Drive, Calendar, or ads access on the Google account.
3.2 Clients the agency adds
The agency enters a client name and, if it chooses, goals for that client. A client name is personal information when the client is an individual. We also store the state of that client's share link: a hash of the secret, an expiry time, and whether it has been revoked. We do not store the share-link secret after it has been shown to the agency.
3.3 Meta advertising data
When an agency connects Meta, we receive an access token, the Facebook user id of the person who connected, the ad accounts that person can access (id, name, and account status), and the account the agency selects. We then store aggregated Ads Insights and the names, ids, and delivery status of campaigns, ad sets, and ads. The metrics we store are spend, impressions, reach, clicks, and aggregated purchase counts and purchase value. We derive rates such as CTR, CPC, CPM, and ROAS in the product from those figures.
We do not receive the person's Facebook password. We do not pull Facebook profile content, friends, messages, custom audiences, targeting specifications, or creative image files.
3.4 Klaviyo data
When an agency connects Klaviyo with OAuth, we request these read-only scopes: accounts:read, campaigns:read, flows:read, metrics:read, lists:read, segments:read, events:read, and profiles:read. We do not request write access, and we do not request forms:read. We store the organisation name, campaign and flow names and status, and aggregate performance: attributed revenue, orders, list size (a count of profiles), and, where the report returns them, deliveries, opens, clicks, bounces, and unsubscribes as counts.
With events:read we read Placed Order events: the time, the order value, and an anonymous profile id. That is how we count new versus returning customers, lifecycle stages, RFM groups, and cohort retention. The id is used only while the sync is running. We do not store it, and we do not store email addresses or phone numbers. A list or segment contributes a count of people, not a list of people.
With segments:read we store segment names and how many people are in each segment. With profiles:read we count profiles Klaviyo has suppressed, such as a hard bounce or a spam complaint. That is an account total.
An agency can instead paste a Klaviyo private API key. We encrypt that key. A private key can be more powerful inside Klaviyo than our OAuth scopes. Our sync still only reads the aggregate, event, segment, and suppression counts described above, and it still does not store email addresses or phone numbers. We never write to Klaviyo.
3.5 Support and the public website
If you email hello@vuelly.com, we keep that correspondence so we can answer it. If you join the waitlist, we store the email address you submit so we can tell you when access opens. We do not sell that address or add it to a third-party mailing list.
We do not ask for sensitive information as the Privacy Act defines it (health, biometrics, racial or ethnic origin, political or religious views, sexual orientation, criminal record, or membership of a trade association). Do not send it to us.
4. How we collect it
We collect personal information:
- from the person, when they sign in with Google or email us;
- from the agency, when it creates clients, goals, and share links;
- from Meta and Klaviyo, when an agency user connects an account and our server syncs the fields in section 3;
- from the browser and our host, as IP address, user agent, and security logs described in section 12.
At or before collection we give this policy. The sign-in screen links to it. Connecting Meta or Klaviyo also shows that platform's own consent screen. If we receive unsolicited personal information we did not ask for, we use it only to deal with the message and then delete it when we no longer need it.
5. Why we use and disclose it
We use personal information to:
- create and secure the agency account;
- show the agency, and anyone it gives a live share link, the reporting dashboard for its clients;
- sync, refresh, and disconnect Meta and Klaviyo connections;
- diagnose errors, limit abuse, and keep audit logs;
- answer support and privacy requests;
- meet a law that applies to us, including a tax or breach-notice law.
We do not sell personal information. We do not use Meta, Klaviyo, or Google user data to build advertising audiences, to retarget, to score credit, or to train a model for anyone else. We do not give one agency's data to another agency.
For agency account data, the uses above are the primary purpose. A related secondary use is securing the service and answering a legal request. For client platform data, we use and disclose it only on the agency's instructions, which are: run the product as the agency configures it, including share links the agency creates, and the disclosures in section 9.
6. Meta data
The Meta connection uses Facebook Login and asks for ads_read and business_management. ads_read is how we read ad performance. business_management is how we list ad accounts the user can access, including accounts that sit under a Business Manager. We do not request ads_management. We cannot create, edit, pause, or delete ads, and we cannot change budgets or targeting.
Meta platform data is used only to provide the agency's reporting and the share view the agency turns on. It is not sold, licensed, or used for advertising or profiling outside that reporting. It is not shared with another customer. Our use of it is subject to the Meta Platform Terms and the Meta Developer Policies.
Disconnecting Meta in Vuelly calls Meta to revoke the permission (DELETE /me/permissions) and deletes the stored token. Removing Vuelly from Facebook can also send us a signed deletion request. How that works, and what it does and does not delete, is set out at vuelly.com/data-deletion.
7. Klaviyo data
Klaviyo data is used only to show the agency, and its share-link viewers, email and SMS performance for the connected account. We do not sell it, use it to contact subscribers, or pass subscriber-level records to anyone, because we do not store those records.
The agency must have the right to connect the Klaviyo account. Disconnecting an OAuth connection sends the refresh token to Klaviyo's revoke endpoint and deletes our copy. A private API key has no revoke endpoint. Disconnecting deletes our copy of the key. The agency should also revoke the key in Klaviyo.
Our use of the Klaviyo API is subject to the Klaviyo API Terms of Use. Those terms require us to keep a privacy policy that matches what we actually collect, to get the user's permission before we access the account, and to delete a user's data when they ask or close the account. Section 16 is how we do that.
8. Google sign-in and Limited Use
Google sign-in is how an agency user proves who they are. We use the name and email to create the account, show who is signed in, and contact that person about the service. We do not use Google user data for advertising.
Vuelly's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we limit Google user data to providing the sign-in and account features a user can see in Vuelly. We do not sell it or use it to serve ads. We do not allow people to read it except where that is needed to provide support the user asked for, to investigate abuse or a security issue, to comply with the law, or where the data is aggregated for our own operations. Transfers are limited to the providers in section 9 who host the account, and to a legal request or a sale of the business after we have told the affected users.
The sign-in scopes we use are not Gmail or other restricted Google scopes. If we ever ask for a new kind of Google user data, we will change this policy first and ask for consent before we use it.
10. Overseas disclosure
Vuelly is operated from Australia. Some providers store or access personal information outside Australia. Likely countries are:
- United States: Vercel, Google, Meta, Klaviyo, and Upstash if rate limiting is enabled. The application's hosting region is not pinned in the software. Production traffic can be served from the United States.
- Supabase (hosted on Amazon Web Services); data may be stored in Australia or other regions. This is an Australian Privacy Principle 8 disclosure: the project region is not recorded in the software, so the database may be in Australia or in another country where Amazon Web Services operates.
- Google, Meta, and Klaviyo may also process information in other countries where they operate their services.
Australian Privacy Principle 8 requires us, before we disclose personal information to an overseas recipient, to take reasonable steps to ensure the recipient handles it in accordance with the Australian Privacy Principles. The steps we take are contractual terms with the provider where we can require them, encryption of platform tokens, limiting each provider to the data it needs, and choosing providers that publish their own security and privacy terms. We do not rely on a country or binding scheme prescribed under APP 8.3.
Those steps do not let us promise that every overseas recipient is bound by the Privacy Act. Please read this before you create an account. If you use Vuelly, you agree to the overseas disclosures in this section for the purposes in this policy. If you consent after being told this, and an overseas recipient handles the information in a way that would breach the Australian Privacy Principles, we may not be accountable under the Privacy Act for that handling, and you may not be able to seek redress under the Privacy Act against that recipient. You can refuse by not creating an account and by not connecting a platform.
11. Direct marketing
We do not use personal information for our own direct marketing. We do not operate a mailing list. Service messages about an account the person already has (security, a change to these terms, a reply to a request) are part of providing the service.
If we later send promotional email, we will do it only with consent or as the Spam Act 2003 (Cth) allows, and every message will include a working unsubscribe. Platform data from Meta and Klaviyo is not used for that.
13. Share links
An agency owner can create a link that shows one client's report without a Vuelly login. The secret is 32 random bytes. We store a SHA-256 hash, not the secret. The link expires 90 days after it is created or rotated, unless the agency owner chooses a link that does not expire. The owner can revoke it sooner. An invalid, expired, or revoked link returns a not-found page. The page shows the latest synced numbers, not a copy frozen when the link was created.
Anyone who has the link can open the report until it expires or is revoked. The agency is responsible for sending it only to people who should see that client's numbers. Campaign and flow names are shown as the platform returns them.
14. Security
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Those steps include technical and organisational measures. The public description of what is actually in the product is the security overview. In short: HTTPS in transit, AES-256-GCM encryption of platform tokens at rest, database row-level security between agencies, hashed share links that expire after 90 days unless the owner chooses no expiry, rate limits, audit logs, and revocation of provider tokens on disconnect.
No method of storage is perfectly secure. We have not commissioned a SOC 2 report or an ISO/IEC 27001 certificate.
15. How long we keep it
| Information | Retention |
|---|---|
| Agency profile and Google sign-in record | While the account is open. Deleted within 30 days after a verified closure request, except records a law requires us to keep. |
| Platform tokens | Deleted when the agency disconnects, when a matched Meta deletion callback runs, or when we close the account. We ask the provider to revoke the token at the same time, where the provider has a revoke endpoint. |
| Synced reporting rows | Kept while the agency uses the connection. Disconnecting, and offboarding a client, revoke tokens and the share link. They do not by themselves delete historical reporting rows. Those rows are deleted when a matched Meta callback runs (Meta rows for that Facebook user), or within 30 days after a verified email request to delete them. |
| Share link | Stops working 90 days after issue or rotation, unless the owner chose no expiry, or immediately when revoked. We keep the hash only as part of the client record. |
| Audit and security logs | Up to 12 months, longer if we need them for an open security investigation or a legal obligation. There is no automated purge job yet. The 12-month period is the commitment we will meet operationally. |
| Billing records | None today. If we charge fees, tax law generally requires business records to be kept for 5 years. |
| Support email | Until we have finished the request, then with the account or deleted if there is no account. |
Deletion removes the information from the live database. A provider backup may keep a copy until that provider's backup cycle overwrites it. We do not restore deleted customer data from a backup except to recover from an incident, and we delete it again if a restored backup brings it back.
16. Access, correction, and deletion
You can ask for access to personal information we hold about you, or ask us to correct it, by emailing hello@vuelly.com. We may need to confirm you are the person, or that you act for the agency. We respond within 30 days. If we refuse access or correction where the Privacy Act allows a refusal, we will explain why and how to complain. We do not charge a fee to make a request. If the Act allows a charge for giving access, we will tell you before we incur it, and the charge will not be excessive.
For client platform data, the agency is the controller. If a request is about a client's Meta or Klaviyo data, we may refer it to the agency and help the agency complete it. If we can identify the information in our database, we will correct or delete it when the agency, or the individual where we are the controller, asks us to.
Deletion instructions, including the in-product disconnect, the Facebook removal path, and the email route, are at vuelly.com/data-deletion. Account closure and deletion requests are completed within 30 days of a verified request. We may keep what the law requires us to keep.
An agency can also disconnect a platform inside Vuelly, and an owner can offboard a client. Read section 15 for what those actions delete immediately and what remains until a deletion request.
17. Notifiable Data Breaches
The Notifiable Data Breaches scheme in the Privacy Act requires notice of an eligible data breach: unauthorised access to, unauthorised disclosure of, or loss of personal information, where serious harm is likely, and where remedial action has not prevented that likely risk.
If we suspect an eligible data breach, we will contain it and assess it promptly. We will take reasonable steps to finish that assessment within 30 days of becoming aware of the grounds for the suspicion. If we believe an eligible data breach has occurred, we will, as soon as practicable, give the Office of the Australian Information Commissioner a statement and notify individuals at risk of serious harm. The statement will include our identity and contact details, a description of the breach, the kinds of information involved, and the steps we recommend individuals take.
Where the affected information is client platform data, we will also tell the agency without undue delay so the agency can meet its own obligations. Successful remedial action, such as encryption where the key was not exposed, can mean the breach is not eligible. We will still tell the affected agency when a client's tokens or report data were in the incident.
18. Children
Vuelly is a business service for marketing agencies. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe we have, email hello@vuelly.com and we will delete it.
19. Automated decisions
We do not use personal information in a computer program to make, or to do something that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests. Charts, totals, and pacing against a goal the agency typed in are reporting. They are not a decision about a person's eligibility for a benefit, a price, or a job.
From 10 December 2026, Australian Privacy Principle 1.7 requires extra privacy-policy detail if that kind of automated decision-making starts. If we introduce it, we will update this section first with the kinds of personal information used and the kinds of decisions involved.
20. Complaints
Email hello@vuelly.com with the details. We will acknowledge the complaint and aim to resolve it within 30 days. If you are not satisfied, or if we do not respond, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. The Commissioner expects you to complain to us first where it is reasonable to do so.
21. Changes to this policy
We will post changes on this page and change the date at the top. If a change affects how we use Google user data, or expands the Meta or Klaviyo data we collect, we will tell signed-in users and, where the platform or the Privacy Act requires it, ask for consent before we rely on the new use. The history of this page is the text published at https://vuelly.com/privacy.