Privacy Policy

INTRODUCTION

This Privacy Policy ("Policy") describes how Vista Social LLC ("Vista Social," "we," "us," or "our") collects, uses, shares, and protects information about you when you use our website at https://vistasocial.com (the "Site") and our social media management platform and services (the "Services").

By accessing or using our Site or Services, you agree to this Privacy Policy. If you do not agree with our practices, please do not use our Site or Services.

Last Updated: September 2, 2026

Effective Date: September 1, 2026

1. WHO WE ARE

Vista Social LLC is a provider of social media management software and services. We help brands, agencies, multi-location businesses, freelancers, and social media managers schedule content, engage with their audience, analyze performance, and collaborate across multiple social media platforms.

Contact Information:
Vista Social LLC
Email: privacy@vistasocial.com
Website: https://vistasocial.com

For questions about this Privacy Policy or our privacy practices, please contact us using the information in the "How to Contact Us" section below.

2. INFORMATION WE COLLECT

We collect several types of information from and about users of our Site and Services.

2.1. Information You Provide Directly

We collect information that you provide directly to us, including:

• Account Information: When you register for an account, we collect your name, email address, company name, phone number, and password.

• Profile Information: Information you add to your profile, such as profile picture, job title, and bio.

• Payment Information: When you purchase our Services, we collect billing information including credit card number, billing address, and payment details. Payment processing is handled by third-party payment processors, and we do not store complete credit card numbers.

• Social Media Account Information: When you connect your social media accounts to our Services, we collect authentication tokens and may access information from those accounts including your social media handle, username, profile information, posts, comments, messages, follower counts, and engagement metrics.

• Content You Create: Posts, images, videos, comments, messages, and other content you create, upload, or schedule through our Services.

• Communications: Information you provide when you contact our customer support, participate in surveys, or communicate with us through any channel.

• Employment Applications: If you apply for a job with us, we collect your resume, cover letter, employment history, education information, references, and other application materials.

2.2. Information We Collect Automatically

When you access or use our Site or Services, we automatically collect certain information, including:

• Device Information: Device type, operating system, browser type, unique device identifiers, and mobile network information.

• Usage Information: Pages viewed, links clicked, features used, time spent on pages, search queries, and other actions you take on our Site and Services.

• Location Information: General geographic location based on your IP address (country, state, or city level).

• Log Information: IP address, browser type, Internet Service Provider (ISP), referring/exit pages, date/time stamps, and clickstream data.

• Cookies and Similar Technologies: We use cookies, web beacons, pixels, and similar tracking technologies to collect information about your browsing activities. See our "Cookies and Tracking Technologies" section below for more details.

2.3. Information from Third-Party Sources

We may receive information about you from third-party sources, including:

• Social Media Platforms: Information from social media platforms (such as Facebook, Instagram, Twitter/X, LinkedIn, TikTok, Pinterest, YouTube, Threads, Bluesky, Reddit) when you connect your accounts or interact with our content on those platforms.

• Data Providers: Information from third-party data providers that help us verify and supplement the information we collect, such as business contact information.

• Partners: Information from our business partners, resellers, and integration partners who offer co-branded services or joint marketing activities. Where you purchased through a reseller and have signed an agreement authorizing it, we also share limited product data with that partner as described in Section 4.8.

• Customers: If you are an authorized user of a customer's account, we receive information about you from that customer.

• Publicly Available Sources: Information that is publicly available, such as social media profiles and business directories.

2.4. Sensitive Personal Information

We do not ask for or intentionally solicit sensitive personal information. Our Acceptable Use Policy prohibits you from submitting Sensitive Information through our Services, and defines that term to include Social Security numbers, personal financial account information other than the payment details we need for billing, health information, biometric data, and information about racial or ethnic origin, religious or philosophical beliefs, sexual orientation, or political opinions.

Social media content works differently. Posts, comments, reviews, and direct messages are written by people outside your organization, and they can reveal health conditions, religious or political views, sexual orientation, or similar details without anyone intending to send that information to us. Content like this reaches our platform through the social accounts you connect and the content you upload, and no filter can reliably keep it out. That is a normal consequence of managing social media.

When information of this kind appears in customer content, we treat it as customer content. We do not seek it out and we do not use it for our own purposes. We store and process it to provide the Services, on the instructions of the customer whose account it belongs to, subject to our Data Processing Addendum where it applies. Under our Acceptable Use Policy, customers are responsible for monitoring the content on their accounts and removing Sensitive Information from the Services.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1. To Provide and Improve Our Services

• Operate and maintain our Site and Services

• Process your registration and manage your account

• Authenticate your access to our Services

• Enable you to publish, schedule, and manage social media content

• Provide social media analytics and reporting

• Facilitate team collaboration and workflow management

• Process payments and manage subscriptions

• Administer subscriptions purchased through authorized resellers and, where you have authorized it, share product data with those partners

• Improve and optimize our Services through testing and analysis

• Develop new features and functionality

3.2. To Communicate with You

• Send you service-related notifications, updates, and security alerts

• Respond to your comments, questions, and support requests

• Send you marketing communications about our Services, special offers, and announcements (with your consent where required)

• Conduct surveys and gather feedback

• Send you newsletters and educational content

3.3. For Analytics and Research

• Analyze how you use our Services to understand user behavior and preferences

• Monitor and analyze usage trends and activity

• Create aggregated, de-identified, or anonymized data for analytics and research

• Conduct market research and competitive analysis

3.4. For Security and Fraud Prevention

• Detect, prevent, and investigate fraud, abuse, and security incidents

• Protect against malicious, deceptive, or illegal activity

• Monitor and improve the security of our Services

• Verify user identity and prevent unauthorized access

3.5. For Legal Compliance

• Comply with legal obligations, court orders, and legal processes

• Enforce our Terms of Service and other agreements

• Protect our rights, property, and safety, and the rights of our users and others

• Resolve disputes and address legal claims

3.6. For Marketing and Advertising

• Deliver targeted advertising and marketing messages

• Measure the effectiveness of our advertising campaigns

• Personalize your experience on our Site and Services

3.7. For Employment Purposes

• Review and process job applications

• Evaluate candidates for employment

• Conduct background checks (with your consent)

• Communicate with applicants about employment opportunities

3.8. With Your Consent

• For any other purpose with your notice and consent

3.9. Aggregated and De-Identified Data

We may use and share aggregated, de-identified, or anonymized data that does not identify you for any purpose, including for analytics, benchmarking, product improvement, marketing, and research. Once information is de-identified or aggregated, we will maintain and use it only in de-identified or aggregated form and will not attempt to re-identify it.

4. HOW WE SHARE YOUR INFORMATION

We share your information in the following circumstances:

4.1. With Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Cloud hosting and infrastructure providers (Amazon Web Services)

• Payment processors

• Email service providers

• Customer support platforms

• Analytics providers

• Security and fraud prevention services

• Marketing and advertising platforms

A current list of subprocessors is available at https://vistasocial.com/subprocessors.

These service providers are contractually obligated to use your information only to provide services to us and are prohibited from using it for their own purposes.

4.2. With Social Media Platforms

When you connect your social media accounts to our Services, we share information with those platforms as necessary to provide our Services, including:

• Facebook and Instagram (Meta)

• Twitter/X

• LinkedIn

• TikTok

• Pinterest

• YouTube (Google), through YouTube API Services

• Reddit

• Bluesky

• Threads

Your use of these platforms is subject to their respective privacy policies and terms of service.

4.3. For Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

4.4. For Legal Reasons

We may disclose your information if we believe it is necessary to:

• Comply with applicable laws, regulations, legal processes, or governmental requests

• Enforce our Terms of Service and other agreements

• Protect the rights, property, or safety of Vista Social, our users, or others

• Detect, prevent, or investigate fraud, security issues, or illegal activity

• Respond to claims that content violates third-party rights

4.5. With Your Consent

We may share your information with third parties when you direct us to do so or consent to such sharing.

4.6. Public Information

If you make information public through our Services (such as by posting on public social media accounts or sharing content publicly), that information may be viewed by others.

4.7. Aggregated and De-Identified Information

We may share aggregated, de-identified, or anonymized information that does not identify you with third parties for any purpose, including analytics, benchmarking, marketing, and research.

4.8. With Resellers and Channel Partners

If you purchased access to our Services through an authorized reseller or channel partner, you can choose to have us share limited product data with that partner so they can see how your organization uses the platform, support your account, and recommend other products and services.

Nothing is shared by default. Sharing begins only after you sign an agreement authorizing it, and covers only what that agreement specifies. Purchasing through a reseller does not by itself authorize any sharing. If you do not sign an agreement, we share nothing with the reseller. Support is a narrow exception. If you or your reseller raise an issue that involves both of us, we may confirm to the reseller that you are a customer and share the limited details needed to resolve that specific issue. This happens case by case, in response to a support request, and is never an ongoing feed. The limits described below apply in full.

We never share your content or your social media data with a reseller. This is an absolute limit that no agreement can change. It covers the content of your posts, comments, and messages, the social media accounts you connect, including their names and handles, your audience and follower data, your social media performance and analytics, the activity of any individual user, and the names, email addresses, and other contact details of the additional users you create on your account. No reseller agreement, customer authorization, or other arrangement can permit this sharing, and we will not enter into one that attempts to.

The only information we may share is Vista Social product data about your subscription and your organization's use of our platform. Examples include your organization name, the name and email address of your account owner or billing contact, plan and subscription status, renewal date, number of licensed users, and summary counts such as how many social profiles are connected. The exact fields are agreed for each reseller arrangement and are limited to what the agreement you signed specifies.

Resellers and channel partners are independent parties, not service providers or subprocessors, and are not listed on our subprocessors page. They act as independent controllers of the product data we share with them and use it to manage their commercial relationship with you, including support, account planning, and recommending other products and services. Their handling of that data is governed by their own privacy notice.

Sharing is always optional. You can withdraw your authorization at any time by emailing privacy@vistasocial.com, and we will stop sharing your product data with the reseller. You do not need to give a reason, and withdrawing does not affect your subscription, your billing, or your access to our Services.

5. COOKIES AND TRACKING TECHNOLOGIES

5.1. What Are Cookies?

Cookies are small text files that are placed on your device when you visit a website. We use cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to collect information about your browsing activities and preferences.

5.2. Types of Cookies We Use

• Essential Cookies: Required for the operation of our Site and Services. These cookies enable core functionality such as security, authentication, and network management.

• Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences and settings.

• Analytics Cookies: Help us understand how visitors use our Site and Services by collecting information about pages visited, time spent, and user interactions. We use Google Analytics and similar services.

• Advertising Cookies: Used to deliver relevant advertisements and measure the effectiveness of advertising campaigns. These cookies may track your activity across different websites.

5.3. Third-Party Analytics and Advertising

We use third-party analytics and advertising services, including:

• Google Analytics: To analyze how users interact with our Site and Services. Learn more at https://policies.google.com/privacy

• Facebook Pixel: To measure advertising effectiveness and deliver targeted ads. Learn more at https://www.facebook.com/privacy/policy/

• LinkedIn Insights: To track conversions and deliver targeted ads. Learn more at https://www.linkedin.com/legal/privacy-policy

5.4. Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to:

• View and delete cookies

• Block third-party cookies

• Block all cookies

• Clear cookies when you close your browser

Please note that blocking or deleting cookies may impact your ability to use certain features of our Site and Services.

Opt-Out Tools:

• Google Analytics Opt-Out: https://tools.google.com/dlpage/gaoptout

• Network Advertising Initiative: http://www.networkadvertising.org/choices/

• Digital Advertising Alliance: http://www.aboutads.info/choices/

5.5. Do Not Track and Global Privacy Control

Some browsers have a "Do Not Track" feature that lets you tell websites you do not want your online activities tracked. We do not currently respond to Do Not Track signals. However, we do honor Global Privacy Control (GPC) signals as an opt-out of the sale or sharing of personal information under applicable privacy laws.

6. DATA RETENTION

We retain your information for as long as necessary to provide our Services, comply with legal obligations, resolve disputes, and enforce our agreements.

6.1. Retention Periods

• Account Information: Retained for the duration of your account plus 30 days after account closure, unless we have a legal obligation to retain it longer.

• Content and Posts: Retained for the duration of your account. You can delete content at any time through your account settings.

• Payment Information: Retained for as long as necessary to process transactions and comply with tax and accounting requirements (typically 7 years).

• Communications: Customer support communications are retained for 3 years.

• Analytics Data: Aggregated analytics data may be retained indefinitely in de-identified form.

• Marketing Data: Retained until you unsubscribe or request deletion, whichever comes first.

• Employment Applications: Retained for 2 years after the application process concludes.

• Reseller-Shared Data: Product data shared with an authorized reseller under Section 4.8 is subject to deletion or de-identification requirements in our agreement with that reseller following the end of your subscription.

6.2. Deletion and Anonymization

When information is no longer needed, we will delete it or anonymize it so that it can no longer identify you. Deleted information may remain in backup systems for up to 90 days before permanent deletion.

6.3. Legal Requirements

We may retain information for longer periods if required by law, regulation, legal process, or to protect our legal rights.

7. DATA SECURITY

We implement reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, loss, misuse, alteration, and destruction.

7.1. Security Measures

• Encryption: We encrypt data in transit using TLS 1.3 and encrypt sensitive data at rest using AES-256.

• Access Controls: We limit access to your information to employees and contractors who need it to provide our Services.

• Authentication: We use secure password requirements and support two-factor authentication (2FA) to protect accounts.

• Network Security: We use firewalls, intrusion detection systems, and regular security monitoring.

• Security Testing: We conduct regular security assessments, vulnerability scanning, and quarterly penetration testing.

• Employee Training: Our employees receive security and privacy training annually.

7.2. Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your password

• Enabling two-factor authentication on your account

• Not sharing your account credentials with others

• Logging out of your account when using shared devices

• Notifying us immediately if you suspect unauthorized access to your account

7.3. Security Incidents

Despite our security measures, no system is completely secure. If we become aware of a security incident that affects your information, we will notify you as required by applicable law and take steps to address the incident.

If you believe your account has been compromised, please contact us immediately at security@vistasocial.com.

For more information about our security practices, visit our Security Center at https://vistasocial.com/security

8. INTERNATIONAL DATA TRANSFERS

Vista Social is based in the United States, and our servers are located in the United States (AWS US-East region). If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States.

8.1. Data Transfer Mechanisms

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we rely on the following mechanisms for international data transfers:

• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses for transfers of personal data outside the EEA.

• UK Addendum: For transfers from the UK, we use the UK International Data Transfer Addendum to the SCCs.

8.2. Additional Safeguards

We implement appropriate technical and organizational measures to ensure that your information receives an adequate level of protection, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)

• Access controls and multi-factor authentication

• Regular security assessments and penetration testing

• Contractual obligations on third-party processors

8.3. Your Rights

You have the right to obtain information about the safeguards we use for international data transfers. Please contact us at privacy@vistasocial.com for more information.

9. YOUR PRIVACY RIGHTS

Depending on where you live, you may have certain rights regarding your personal information.

9.1. General Rights

All users have the right to:

• Access: Request access to the personal information we hold about you.

• Correction: Request that we correct inaccurate or incomplete information.

• Deletion: Request that we delete your personal information, subject to certain exceptions.

• Opt-Out of Marketing: Unsubscribe from marketing communications at any time.

• Withdraw Reseller Sharing: If you authorized sharing with an authorized reseller, withdraw that authorization at any time and we will stop sharing, as described in Section 4.8.

9.2. Rights for EEA and UK Residents

If you are located in the European Economic Area or United Kingdom, you have additional rights under the GDPR:

• Data Portability: Request a copy of your information in a structured, machine-readable format.

• Restriction of Processing: Request that we restrict processing of your information in certain circumstances.

• Object to Processing: Object to our processing of your information based on legitimate interests.

• Withdraw Consent: Withdraw consent for processing based on consent at any time.

• Lodge a Complaint: File a complaint with your local data protection authority.

9.3. Rights for U.S. Residents

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or other U.S. states with privacy laws, you may have additional rights. See the "Additional Disclosures for U.S. Residents" sections below for details.

9.4. Legal Basis for Processing (EEA and UK)

We process your personal information based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Services to you.

• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our Services, marketing, fraud prevention, and administering subscriptions purchased through authorized resellers. This includes sharing product data with a reseller where your organization has authorized it in writing, and confirming limited account details to a reseller when responding to a support issue that involves both of us.

• Consent: Processing based on your consent, which you can withdraw at any time.

• Legal Obligation: Processing necessary to comply with legal requirements.

10. HOW TO EXERCISE YOUR RIGHTS

To exercise any of your privacy rights, you can:

• Email us: privacy@vistasocial.com

• Access your account: Many settings and preferences can be managed directly through your account settings.

• Unsubscribe: Click the "unsubscribe" link in any marketing email.

10.1. Verification

To protect your privacy and security, we may need to verify your identity before processing your request. We may ask you to:

• Provide your email address and account information

• Confirm recent account activity

• Answer security questions

10.2. Response Time

We will respond to your request within:

• 45 days for GDPR requests (may be extended by 45 days if necessary)

• 45 days for U.S. state privacy law requests (may be extended by 45 days if necessary)

• 10 business days for acknowledgment of requests

10.3. Authorized Agents

You may designate an authorized agent to make requests on your behalf. We will require:

• Written authorization from you

• Proof of the agent's identity

• Verification of your identity

10.4. Limitations and Exceptions

We may deny or limit your request if:

• We cannot verify your identity

• The request is excessive, repetitive, or manifestly unfounded

• We have a legal obligation to retain the information

• The information is necessary to complete a transaction or provide Services you requested

• Disclosure would violate the privacy rights of others

10.5. Notification to Resellers

Where we have shared information with an authorized reseller under Section 4.8, we will communicate your deletion, correction, or restriction request to that reseller, unless this proves impossible or would involve disproportionate effort. You may ask us which resellers have received your information.

11. MARKETING COMMUNICATIONS

11.1. Email Marketing

We may send you promotional emails about our Services, special offers, new features, and other updates. You can opt out of these communications at any time by:

• Clicking the "unsubscribe" link in any marketing email

• Adjusting your email preferences in your account settings

• Contacting us at privacy@vistasocial.com

11.2. Transactional Emails

Even if you opt out of marketing emails, we will still send you transactional emails related to your account, such as:

• Account confirmations and password resets

• Billing and payment notifications

• Service updates and security alerts

• Responses to your support requests

11.3. Processing Time

Please allow up to 10 business days for us to process your opt-out request. You may receive emails that were already in process during this time.

11.4. CAN-SPAM Compliance

Our marketing emails comply with the CAN-SPAM Act and include:

• Clear identification that the message is an advertisement

• A valid physical postal address

• A clear and conspicuous unsubscribe mechanism

• Our contact information

12. CHILDREN'S PRIVACY

Our Services are not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13.

12.1. COPPA Compliance

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent.

12.2. Age Verification

By using our Services, you represent that you are at least 13 years old. If you are under 18, you represent that you have obtained parental or guardian consent to use our Services.

12.3. Removal of Children's Information

If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us at privacy@vistasocial.com. We will promptly delete such information from our systems.

12.4. California Users Under 18

If you are a California resident under 18 and a registered user of our Services, you may request removal of content or information you posted publicly. To make such a request, contact us at privacy@vistasocial.com with "California Minor Content Removal" in the subject line.

Please note that removal does not ensure complete deletion, as content may remain in backup copies or if removal is not required by law.

13. THIRD-PARTY LINKS AND INTEGRATIONS

Our Services may contain links to third-party websites, applications, and services, including social media platforms.

13.1. Third-Party Websites

We are not responsible for the privacy practices of third-party websites. When you click on a link to a third-party site, you are subject to that site's privacy policy and terms of service.

13.2. Social Media Platforms

When you connect social media accounts to our Services, your use of those platforms is governed by their privacy policies:

• Facebook/Instagram: https://www.facebook.com/privacy/policy/

• Twitter/X: https://x.com/en/privacy

• LinkedIn: https://www.linkedin.com/legal/privacy-policy

• TikTok: https://www.tiktok.com/legal/page/us/privacy-policy/en

• Pinterest: https://policy.pinterest.com/en/privacy-policy

• YouTube: https://policies.google.com/privacy

• Reddit: https://www.reddit.com/policies/privacy-policy

• Bluesky: https://bsky.social/about/support/privacy-policy

• Threads: https://help.instagram.com/515230437301944

13.3. Social Media Features

Our Services may include social media features, such as "Like" buttons and widgets. These features may collect your IP address and browsing activity and may set a cookie. Your interactions with these features are governed by the privacy policy of the company providing them.

14. YOUTUBE API SERVICES

Our YouTube integration is built on YouTube API Services. Our application uses YouTube API Services to collect data regarding video performance and channel analytics.

14.1. How We Use YouTube API Services

When you connect a YouTube channel to Vista Social, we use YouTube API Services to:

• Publish, schedule, and manage videos and Shorts, including titles, descriptions, tags, thumbnails, and privacy settings

• Collect data regarding video performance, such as views, watch time, likes, and shares

• Collect channel analytics, such as subscriber counts, audience demographics, and traffic sources

• Read, moderate, and reply to comments on your videos through our engagement and inbox features

We access YouTube data only for the channels you authorize, and only for the features you use.

14.2. YouTube Terms of Service and Google Privacy Policy

By using this application, users are agreeing to be bound by the YouTube Terms of Service. You can learn more about how Google manages data by visiting the Google Privacy Policy at http://www.google.com/policies/privacy.

Our use of information received from YouTube API Services also complies with the YouTube API Services Terms of Service and the YouTube API Services Developer Policies. Vista Social's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14.3. Storage and Retention of YouTube Data

We store data retrieved through YouTube API Services only for as long as needed to provide the features you use, and we refresh or delete it in line with the YouTube API Services Terms of Service and the YouTube API Services Developer Policies. Authorization tokens are stored in encrypted form and are used only to make requests on your behalf. We do not sell YouTube data, and we do not use it to target advertising.

14.4. Revoking Access to Your YouTube Data

You can revoke our access to your YouTube data at any time:

• Disconnect the channel in your Vista Social account settings, which removes the stored authorization and stops any further data collection

• Revoke access through the Google security settings page at https://security.google.com/settings/security/permissions

To request deletion of YouTube data we already hold, email privacy@vistasocial.com. See the "Data Retention" and "How to Exercise Your Rights" sections above for more detail.

15. CALIFORNIA PRIVACY RIGHTS

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

15.1. Notice of Collection

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers: Name, email address, IP address, account ID, device ID

• Customer Records: Billing address, payment information, phone number

• Commercial Information: Purchase history, subscription information, service usage

• Internet Activity: Browsing history, search history, interactions with our Services

• Geolocation Data: General location based on IP address

• Audio/Visual Information: Profile pictures, images, videos uploaded to Services

• Professional Information: Job title, company name, work email

• Inferences: Preferences, characteristics, behavior patterns

15.2. Your California Rights

California residents have the right to:

• Know: Request information about the categories and specific pieces of personal information we have collected, the sources, purposes, and categories of third parties we share it with.

• Delete: Request deletion of your personal information, subject to certain exceptions.

• Correct: Request correction of inaccurate personal information.

• Opt-Out: Opt out of the "sale" or "sharing" of personal information or use for targeted advertising.

• Limit Use of Sensitive Information: Limit the use and disclosure of sensitive personal information. We do not ask for sensitive personal information and we do not use it to infer characteristics about you. Where it appears in content our customers upload or in content from their connected social accounts, we use it only to provide the Services on that customer's instructions, as described in Section 2.4.

• Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights.

15.3. Sale and Sharing of Personal Information

We do not "sell" personal information in the traditional sense. However, we may "share" personal information for targeted advertising purposes through:

• Analytics and advertising cookies

• Pixels and tracking technologies

• Audience matching services (such as Facebook Custom Audiences)

To opt out, click the "Do Not Sell or Share My Personal Information" link on our website or adjust your cookie preferences.

Sharing information with an authorized reseller at your direction, which you authorize by signed agreement as described in Section 4.8, is not a "sale" or "share" of personal information under California law.

15.4. How to Exercise Your Rights

To exercise your California privacy rights:

• Email: privacy@vistasocial.com

• Subject line: "California Privacy Rights Request"

• Include: Your name, email address, and specific request

We will acknowledge your request within 10 business days and respond within 45 days (may be extended by 45 days if necessary).

15.5. Verification

We will verify your identity by matching the information you provide with information we have on file. For more sensitive requests, we may require additional verification.

15.6. Authorized Agents

You may designate an authorized agent to make requests on your behalf. The agent must provide written authorization, and we may require you to verify your identity directly.

15.7. Shine the Light Law

California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, contact us at privacy@vistasocial.com with "California Shine the Light Request" in the subject line.

15.8. Minors Under 16

We do not knowingly sell or share personal information of California residents under 16 years of age.

15.9. Categories of Third Parties

In the preceding 12 months, we have disclosed personal information to the following categories of third parties:

• Service providers and subprocessors, including cloud hosting, payment processing, email delivery, customer support, analytics, and security vendors

• Social media platforms you connect to your account

• Authorized resellers and channel partners, where you purchased through them and signed an agreement authorizing the sharing, beginning on the Effective Date of this policy

• Advertising and analytics partners

• Legal, regulatory, and governmental recipients, where required

• Parties to a merger, acquisition, or sale of assets

16. OTHER U.S. STATE PRIVACY RIGHTS

16.1. Colorado, Connecticut, Virginia, and Utah Residents

If you are a resident of Colorado, Connecticut, Virginia, or Utah, you have rights similar to California residents, including:

• Right to confirm whether we process your personal data

• Right to access your personal data

• Right to correct inaccuracies in your personal data

• Right to delete your personal data

• Right to obtain a copy of your personal data in a portable format

• Right to opt out of: - Targeted advertising - Sale of personal data - Profiling in furtherance of decisions that produce legal or similarly significant effects

To opt out of targeted advertising or the sale of personal data, click the "Do Not Sell or Share My Personal Information" link on our website or adjust your cookie preferences. We also honor Global Privacy Control (GPC) signals, as described in Section 5.5. For the other rights listed above, use the process in Section 16.2.

16.2. How to Exercise Your Rights

To exercise these rights, contact us at privacy@vistasocial.com with the subject line "[State] Privacy Rights Request" and include:

• Your name and email address

• Your state of residence

• The specific right you wish to exercise

16.3. Appeals Process

If we deny your request, you have the right to appeal our decision. To appeal:

1. Email privacy@vistasocial.com with "Privacy Rights Appeal" in the subject line

2. Include your original request and the reason for the appeal

3. We will respond within 45 days

If you are not satisfied with our response, you may contact your state Attorney General:

• Colorado: Colorado Attorney General - https://coag.gov/

• Connecticut: Connecticut Attorney General - https://portal.ct.gov/AG

• Virginia: Virginia Attorney General - https://www.oag.state.va.us/

• Utah: Utah Attorney General - https://attorneygeneral.utah.gov/

16.4. Nevada Residents

Nevada residents have the right to opt out of the sale of certain personal information. We do not currently sell personal information as defined under Nevada law. If you have questions, contact us at privacy@vistasocial.com.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

17.1. Notice of Changes

When we make changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this policy

• Post the updated policy on our website

• For material changes, we will provide additional notice by: - Sending an email to the address associated with your account - Displaying a prominent notice on our Site or Services - Requesting your consent where required by law

17.2. Your Continued Use

Your continued use of our Services after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with the updated policy, please stop using our Services and contact us to close your account.

17.3. Material Changes

We will provide at least 30 days' notice before any material changes take effect. Material changes include:

• Changes to the categories of personal information we collect

• Changes to how we use or share your information

• Changes to your rights or choices

• Changes to our data retention practices

17.4. Archived Versions

Previous versions of this Privacy Policy are available upon request. Contact us at privacy@vistasocial.com to request an archived version.

18. HOW TO CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Privacy Inquiries:
Email: privacy@vistasocial.com
Response Time: We acknowledge privacy requests within 10 business days and respond within 45 days, which may be extended by another 45 days where necessary.

Security Issues:
Email: security@vistasocial.com

Data Protection Inquiries (EEA/UK):
For GDPR-related inquiries, contact our privacy team at privacy@vistasocial.com

Supervisory Authority (EEA/UK Residents):
If you are located in the EEA or UK and have a complaint about our data practices, you have the right to lodge a complaint with your local data protection authority.

Accessibility:
If you need this Privacy Policy in an alternative format due to a disability, please contact us at privacy@vistasocial.com and we will work with you to provide the policy in an accessible format.

19. ADDITIONAL INFORMATION

19.1. Related Policies

This Privacy Policy should be read in conjunction with our:

• Terms of Service: https://vistasocial.com/terms

• Acceptable Use Policy: https://vistasocial.com/usage-policy

• Data Processing Addendum: https://vistasocial.com/gdpr

• Security Center: https://vistasocial.com/security

19.2. Language

This Privacy Policy is provided in English. If we provide a translation, the English version will control in the event of any conflict.

19.3. Governing Law

This Privacy Policy is governed by the laws of the State of New York, without regard to its conflict of laws principles.

19.4. Severability

If any provision of this Privacy Policy is found to be unenforceable or invalid, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will remain in full force and effect.

19.5. No Waiver

Our failure to enforce any right or provision of this Privacy Policy will not be considered a waiver of those rights.

20. DEFINITIONS

For purposes of this Privacy Policy:

• "Personal Information" or "Personal Data" means information that identifies, relates to, describes, or can be reasonably linked to you, directly or indirectly.

• "Services" means our social media management platform, including our website, mobile applications, APIs, and related services.

• "Site" means our website at https://vistasocial.com and any associated subdomains.

• "You" or "User" means the individual accessing or using our Services.

• "We," "Us," or "Our" means Vista Social LLC.

• "Process" or "Processing" means any operation performed on personal information, including collection, use, storage, disclosure, and deletion.

• "Third Party" means any person or entity other than you or Vista Social.

• "Cookie" means a small text file placed on your device to collect information about your browsing activities.

• "De-identified Data" means information that cannot reasonably be used to identify you.

• "Aggregate Data" means information about groups or categories of users that does not identify individuals.

• "Authorized Reseller" or "Channel Partner" means a third party authorized by Vista Social to resell access to our Services, who acts as your reseller of record for commercial and billing purposes.