Privacy Policy

VidVop — operated by Kwiqflick Ltd

Last updated: September 2026

1. Who we are

VidVop is an AI agent platform for small businesses, operated by Kwiqflick Ltd, a company registered in England and Wales. VidVop enables businesses to install and configure AI agents that handle communications and workflows on their behalf.

For the purposes of data protection law, Kwiqflick Ltd is the data controller for your account data and platform usage data. When VidVop's AI agents process your business communications (such as emails or messages), Kwiqflick Ltd acts as a data processor on your behalf — you remain the data controller for your own business data.

To contact us about this policy or your data:

• Email: privacy@vidvop.com
• Website: vidvop.com

2. What data we collect

Account data

When you create a VidVop account, we collect your name, email address, and business name. If you subscribe to a paid plan, our payment processor (Stripe) handles your payment details — we do not store card numbers or bank details on our servers.

Connected service credentials

When you connect your email (Gmail or Microsoft Outlook), calendar (Google Calendar or Outlook Calendar), or messaging accounts (WhatsApp, SMS via Twilio), we store encrypted authentication tokens that allow VidVop to access these services on your behalf. These tokens are encrypted at rest using AES-256-GCM encryption. We store only the minimum credentials required — we do not store your email password or the passwords to any connected service.

Business communications

When your AI agents process emails, messages, or calendar events, VidVop temporarily accesses and processes that content to carry out the agent's task (for example, reading an email to generate a reply, or checking calendar availability to confirm a booking). Message content and email metadata are stored in our database to enable agent functionality, audit logging, and debugging.

Agent configuration data

The instructions, settings, and behavioural configuration you provide for your AI agents are stored in our database. This includes any custom prompts, routing rules, contact lists, and workflow configurations.

Usage and log data

We collect technical logs including API call records, agent activity logs, error logs, and performance data. This data is used for platform reliability, debugging, and monitoring.

Media and attachments

If you use features involving photo or document processing (such as MMS photo replies or WhatsApp media), media files are downloaded from the messaging provider and stored in VidVop's own storage to ensure availability beyond the messaging provider's retention period.

3. How we use your data

We use your data for the following purposes:

• Providing the service — running AI agents that process your business communications, manage your calendar, send messages, and perform the tasks you configure them to do.
• Account management — authenticating your access, managing your subscription, and communicating with you about your account.
• Platform reliability — monitoring system performance, debugging issues, preventing abuse, and maintaining security.
• Product improvement — understanding how the platform is used to improve features and fix problems. We do not use your business communications content to train AI models.
• Measuring our advertising (only with your consent) — if you accept advertising cookies, we tell Meta (Facebook/Instagram) when a visitor signs up or makes a first purchase, so we can see which of our adverts work and avoid showing you adverts for things you already have. See Cookies below for exactly what is shared.

We do not sell your data to third parties. Your business communications — emails, messages, calendar, documents — are never used for advertising, never shared with an advertising network, and never used to build an advertising profile of you or your customers.

SMS messaging. If you opt in to VidVop's SMS personal-assistant service, we use your mobile number solely to send and receive the messages you have asked for. No mobile information — including your phone number and SMS opt-in — is shared with or sold to third parties or affiliates for marketing or promotional purposes. You can opt out at any time by replying STOP. Full details are in our SMS Terms.

4. Third-party services that process your data

VidVop uses the following third-party services to operate the platform. Each processes data only as necessary to provide their specific function:

International transfers

Some of our third-party processors are based in the United States. Where your data is transferred outside the UK, we rely on appropriate safeguards including standard contractual clauses and, where applicable, the processor's certification under recognised data protection frameworks.

5. How we protect your data

• All authentication tokens for connected services (Gmail, Outlook, Twilio, etc.) are encrypted at rest using AES-256-GCM encryption.
• All data in transit is encrypted via HTTPS/TLS.
• Database access is protected by Row Level Security (RLS), ensuring each tenant can only access their own data.
• Webhook endpoints validate cryptographic signatures on every inbound request to prevent spoofing.
• Access to production systems is restricted and logged.

Staff access to your data

To provide support and improve the product, authorised VidVop staff can view your agent configurations (the instructions and settings you create for your agents), the messages you send when setting up or adjusting an agent, and product-usage metadata (such as which agents you have, how often they run, and your credit and billing status).

Authorised VidVop staff cannot read the contents of your emails, calendar events, spreadsheets, contacts, uploaded files, WhatsApp or SMS messages, or your conversations with your personal assistant (VidVop). Our internal tools are built so this content is excluded at the database query level — it is never loaded into the staff console — and every staff access to your account is recorded in an audit log.

We will not change this boundary (for example, to make assistant conversations visible to staff) without updating this policy and notifying you first.

6. How long we keep your data

• Account data is retained for as long as your account is active, and deleted within 30 days of account closure.
• Agent activity logs are retained for 90 days for debugging and audit purposes, then archived or deleted.
• Connected service tokens are deleted immediately when you disconnect a service or close your account.
• Conversations with your assistant — on the web, WhatsApp and text message — are retained for 90 days from the last message in that conversation, then deleted automatically. You can delete any web conversation yourself at any time from the assistant page.
• Other message content and media are retained for as long as your account is active to support agent functionality and audit. On account closure, this data is deleted within 30 days.

7. Your rights

Under UK data protection law (UK GDPR), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to any legal obligation to retain it).
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@vidvop.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.

8. Cookies

VidVop uses essential cookies for authentication and session management. These are always active because the service cannot work without them.

With your consent, we also use two optional kinds of cookie. We ask for your consent through a banner on your first visit — these cookies are only set if you choose “Accept”, and declining does not affect your use of the service in any way.

• Analytics — Google Analytics. Helps us understand how visitors use our website so we can improve it. Sets cookies such as _ga to measure site usage.
• Advertising measurement — Meta Pixel. Lets us see whether our adverts on Facebook and Instagram lead to signups, so we can spend our advertising budget sensibly, and avoid showing you adverts for a product you already use. Sets the _fbp and _fbc cookies. With this consent we also send Meta a server-side copy of three events — that you signed up, that you verified your account, and your first payment (amount and currency) — together with a scrambled (hashed) version of your email address so Meta can match the event to an advert you saw. Meta cannot read the email address back from the hash. We never send Meta the content of your business communications.

You can change or withdraw your choice at any time: Manage cookie preferences. Withdrawing stops both the analytics and advertising cookies immediately, and no further events are sent to Meta.

9. AI processing

VidVop uses AI models provided by Anthropic (Claude) to power its agents. When an agent processes your data (for example, reading an email to draft a reply), the content is sent to Anthropic's API for processing. Anthropic does not use data submitted via their API to train their models. VidVop does not use your business communications to train any AI models.

AI-generated outputs (such as draft emails or extracted data) are produced by the AI model based on your agent's configuration and the content provided. These outputs may occasionally contain errors. VidVop provides tools for you to review and configure agent behaviour, but you remain responsible for the accuracy and appropriateness of communications sent on your behalf.

10. Children

VidVop is a business platform and is not directed at individuals under the age of 18. We do not knowingly collect data from children.

11. Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via email or through the platform. The “last updated” date at the top of this page indicates when this policy was last revised.