• Account information. The email address and role of each user, and the organizations and brands the user belongs to. Users are invited by an administrator. We sign users in with a one-time code sent to their email address and do not use passwords.
• Content you provide. Brand settings, keywords, target URLs, social media posts and media you create or upload, messages you send to the in-app assistant, and other settings.
• Connected social media accounts. When you connect social media accounts for posting, the connection is made through our posting partners (WoopSocial and Ayrshare). We store the account identifiers we need, such as the handle, display name and profile image, together with post and engagement data used to publish and report. If you give us API credentials for a social media platform, we store them and pass them to Ayrshare to post on your behalf.
• Public information about brands. To provide monitoring, we collect publicly available information about the brands our customers register: public social media posts and news articles (through Talkwalker), comments on your connected accounts, search results, search suggestions and AI search answers. We also store screenshots of search result pages. Public posts can include the author's public name or handle.
• Technical information. Cookies that keep you signed in and remember your language, and server logs used for security and troubleshooting. Logs include IP addresses, browser user agents, requested URLs, and the email addresses of people who sign in, request a login code or are invited. We do not use advertising or analytics cookies.

Universal AIO uses the Google Ads API for one internal purpose: to retrieve monthly search volumes (Keyword Planner historical metrics) for keywords we manage.

• Who connects. Only our own system administrator connects our company's Google Ads account, through Google's OAuth consent screen. We do not ask customers or other users to sign in with Google, and we do not access their Google accounts.
• Scopes requested. https://www.googleapis.com/auth/adwords (Google Ads), openid and email.
• Data we access. The email address of the Google account that grants access; the Google Ads accounts that account can access (account ID, account name, and whether it is a manager or test account); and keyword search volume statistics that the Google Ads API returns for keywords we submit. We only read data. We do not create, change or delete anything in Google Ads accounts.
• Data we store. The OAuth refresh token (encrypted with AES-256-GCM), the email address of the authorizing Google account, the selected Google Ads account ID and the list of accessible accounts, and the resulting search volume figures, including monthly values. Search volume figures are aggregate keyword statistics, not personal information. Access tokens are not stored.
• How we use it. We use the account information only to keep the connection working. We use the search volume figures to estimate search demand for the keywords we manage, and to plan and evaluate the Service's search visibility activities for those keywords, such as how much search activity to run for each keyword. The figures appear as aggregate numbers in the Service's dashboards.
• Sharing. We do not sell this data, use it for advertising, or use it to train artificial intelligence or machine learning models. The authorizing account's email address, the token and the list of accounts are available only to our system administrators and are processed only by our hosting provider (Cloudflare). Search volume figures are shown to authorized users of the Service (our staff, and the partner or customer staff responsible for those keywords), and our staff may analyze them with the AI providers listed in section 4.
• Retention and deletion. We keep the refresh token, the authorizing email address and the list of accessible accounts only while the connection is active. When our administrator disconnects, we ask Google to revoke the token and delete these items. The selected Google Ads account ID and the search volume figures are kept after disconnection as part of our keyword records, and the figures are updated monthly while the connection is active. We delete them on request to contact@versefactory.ai. Access can also be revoked at any time at https://myaccount.google.com/permissions.

Universal AIO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• To provide, operate and maintain the Service, including monitoring, search visibility activities, reports and analyses.
• To sign you in and keep the Service secure.
• To publish social media posts and replies that you create or approve, or that the Service creates when you turn on automatic posting.
• To communicate with you about the Service, such as login codes and invitations.
• To comply with legal obligations.

We do not sell personal information.

We use the following service providers to run the Service. They process data on our behalf for these purposes only.

• Cloudflare: hosting, database, file storage and logs.
• Resend: sending login and invitation emails.
• OpenAI: generating analyses, post drafts, reply suggestions and in-app assistant answers from Service content, including public posts and comments, and monitoring how AI assistants answer about brands.
• Anthropic: AI analysis used by our staff to operate the Service, and monitoring how AI assistants answer about brands where enabled.
• WoopSocial and Ayrshare: connecting social media accounts and publishing posts.
• Talkwalker: collecting public social media posts and news mentions.
• Google: the Google Ads API (described above), and web fonts loaded from Google Fonts, which receives your IP address when a page loads.

The authorizing Google account's email address, the OAuth token and the list of Google Ads accounts are not sent to OpenAI or Anthropic. These providers may process data outside Japan, including in the United States.

Apart from the service providers above, we share information only:

• with your consent;
• with other users of your organization or brand, according to their roles;
• with the reseller or OEM partner that provides the Service to your organization, whose administrators can view and manage the organizations they are responsible for;
• when you create a public report link (anyone with the link can view that report);
• through file links: uploaded media and search result screenshots are served at hard-to-guess URLs that do not require sign-in, so anyone who has such a URL can view the file; or
• when required by law, or when needed to protect the rights and safety of users or the public.

We keep information for as long as needed to provide the Service or as required by law. When a customer's contract ends, we delete or anonymize the customer's account information and content on request. Login codes expire after 10 minutes.

The Service is served only over HTTPS. Access is limited by role. Google OAuth tokens and our Google OAuth client secret are encrypted at rest. No method of storage or transmission is completely secure, but we work to protect your information.

You can ask us to disclose, correct, delete or stop using your personal information, as provided by the Act on the Protection of Personal Information of Japan, by contacting contact@versefactory.ai. Your organization's administrators can disconnect connected social media accounts, or you can ask us to do so.

The Service is for businesses and is not directed to children.

We may update this policy. When we do, we will change the effective date above and, for significant changes, notify users through the Service or by email.

株式会社Versefactory.AI
Email: contact@versefactory.ai

See also our Terms of Service.