VWA digital agencyinsights
Sign in
← Back to home

Privacy policy

Last updated: 30 August 2026

1. Who we are

VWA Insights (insights.vwa.agency) is a reporting platform by VWA digital agency, based in the Netherlands. We develop the platform solely to share marketing reports with our clients.

VWA digital agency is the data controller for users' account and platform data. For the marketing data we retrieve on a client's behalf from their own platforms, VWA acts as a data processor; the client is the controller for that data. We record these arrangements in a data processing agreement with the client.

2. What data we process

We process four kinds of data:

  • Account data of signed-in users — name, email address, and (hashed) password of VWA staff and authorised clients, used solely for authentication and access management.
  • Marketing data from client platforms — aggregated statistics from Google Analytics 4, Google Search Console, Google Ads, YouTube, Microsoft Clarity, the Meta Graph API (Facebook & Instagram), and LinkedIn (organic page statistics and LinkedIn Ads). This is always aggregated reporting data, never personal data of end users or website visitors. For each client we only retrieve the platforms the client has authorised themselves via OAuth.
  • OAuth tokens — encrypted access and refresh tokens that our platform uses on the client's behalf to retrieve the above data daily. Tokens are stored encrypted at rest (AES-256) and are not visible in the user interface or in logs.
  • Content the client publishes — for clients who use the content calendar, we store the posts the client has created and approved themselves (text, images/videos, and the chosen publication moment). We publish this content at the client's request to their own Facebook page and/or Instagram business account. We only publish posts the client has created and approved within the platform.

3. Purpose of processing

The data is used solely to generate dashboards, AI reports, and strategic advice for the client in question. We do not sell data, do not use it for advertising, and do not share it with third parties for other purposes.

For the content calendar we use the Meta Graph API (Facebook & Instagram) solely to publish content the client has created and approved themselves, at their own request, to their own Facebook page and/or Instagram business account. We post nothing without the client's explicit approval, we do not modify or delete existing posts that were not created through our platform, and we do not use publishing access for advertising or any other purpose. The client can revoke the Meta connection at any time via the settings of their Facebook business portfolio; after that we can no longer publish anything.

4. Use of Google API Services (Limited Use clause)

VWA Insights uses the following Google API services: Google Analytics Data API (analytics.readonly), Google Search Console API (webmasters.readonly), Google Ads API (adwords), and YouTube Analytics API (yt-analytics.readonly). These are used in read-only mode only. We make no changes to Google Ads accounts (no campaign, ad, budget, or bidding changes).

The use of information received through Google API services complies with the Google API Services User Data Policy, including the Limited Use requirements. In concrete terms:

  • We use Google data solely to show the dashboards and reports the client asks for.
  • We do not transfer Google data to third parties, except where necessary to provide the service, to comply with applicable law, or as part of a merger or acquisition with explicit consent.
  • We do not use Google data for advertising purposes, credit checks, or building profiles.
  • No human reads Google data, except (a) with the user's explicit consent, (b) for security purposes, (c) to comply with the law, or (d) where data has first been anonymised for internal quality and debugging purposes.

5. AI sub-processors

To generate reports, advice, and analyses, VWA Insights uses the business AI APIs of Anthropic (Claude), Google (Gemini), and OpenAI. These parties act as sub-processors under paid, commercial agreements. In concrete terms:

  • No training by default. Under these providers' business APIs, submitted data is not used to train their AI models by default.
  • Limited, temporary processing. Where providers process or retain data temporarily, their business retention periods apply (typically up to 30 days). Exceptions may apply for specific features and legal or security obligations.
  • No end-client PII. The AI chain is designed not to forward identifying personal data of our clients' customers; we minimise and anonymise what goes to the providers.
  • Data Processing Agreement (DPA). Each provider offers a Data Processing Agreement that VWA applies on behalf of its clients. Available on request via our contact form.

6. Storage and security

Data is stored on servers in the EU (the Netherlands). OAuth tokens and API credentials are encrypted with AES-256. Access to the production database is limited to administrators of VWA digital agency. Connections run over HTTPS.

7. Retention period

Marketing reporting data is retained for as long as the client relationship lasts. When the collaboration ends, we delete client data within 30 days, unless the client explicitly requests longer retention.

8. Revoking access

A client can revoke the granted OAuth access at any time via myaccount.google.com/permissions. After that we can no longer retrieve new data through Google API services. Previously retrieved aggregated reporting data is retained until an explicit deletion request.

9. Deletion request

To request deletion of your account, retrieved data, or related reports, you can contact us via the contact form below. We delete all requested data within 30 days.

10. Cookies

We use functional session cookies to keep signed-in users logged in. In addition, we anonymously measure how VWA Insights itself is used in order to improve the platform (Google Analytics and Microsoft Clarity).

We place these statistics cookies only after you have given consent via the cookie notice (Google Consent Mode v2). If you decline, no statistics cookies are placed and we measure nothing that identifies you personally. We do not collect personal data of visitors, use no advertising pixels, and do not share these statistics with third parties for advertising.

11. Changes

We may update this privacy policy. The “last updated” date at the top of this page indicates when that last happened. For significant changes we actively inform signed-in users.

12. Contact

For questions about this privacy policy or requests for access, correction, or deletion:

VWA digital agency
Get in touch via our contact form.