Legal
This Privacy Policy explains how Where Beagles Dare! Ltd (“we”, “us”, “our”) collects, uses, and protects personal data when you use Vidual (“the Service”), accessible at vidual.app, app.vidual.app, vidualinbox.com, my.vidual.app, and via the Vidual iOS app.
We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Where Beagles Dare! Ltd is the data controller for personal data processed through Vidual. We are based in Oxford, England.
Registered address: Unit 6 Heritage Business Centre, Belper, Derbyshire DE56 1SW, United Kingdom.
Company registration number: 11038022.
VAT number: GB307323727.
Contact: hello@vidualapp.com
We use personal data to:
We do not sell your personal data. We do not use your data for advertising purposes. We do not share your data with third parties for their own marketing.
We share data only with trusted third-party service providers who process data on our behalf:
All processors are subject to data processing agreements and required to handle data in accordance with UK GDPR. The full, current list of sub-processors is published at vidual.app/subprocessors.html, and our processing terms are set out in our Data Processing Agreement.
By default, we retain your account data for as long as your account is active, and project records, messages, files, and Owner’s Cards are kept as a permanent archive — this is core to Vidual’s purpose as a build record and provenance system.
This default does not override data-subject erasure rights or a controller’s deletion instruction. Where we act as a processor, the customer (as controller) may direct deletion of personal data at any time, and where you are an individual exercising your rights you may request erasure. We honour such requests subject to any legal and accounting retention we are required to apply.
If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or accounting purposes. Anonymised, aggregated data may be retained for analytics.
Under UK GDPR you have the right to:
To exercise any of these rights, please contact us at hello@vidualapp.com. We will respond within 30 days.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
We take data security seriously. All data is transmitted over HTTPS. We use passwordless authentication via passkeys and magic links — passwords are never stored. Database access is restricted and encrypted at rest. We conduct regular security reviews of our infrastructure.
However, no method of transmission over the internet is 100% secure. If you believe your account has been compromised, please contact us immediately.
In the event of a personal data breach, we notify affected customers (as controllers) without undue delay, and we report the breach to the Information Commissioner’s Office (ICO) within 72 hours where we are legally required to do so. Where we act as a processor, we also assist customers in meeting their own breach-notification obligations.
Our service is hosted on infrastructure primarily located within the UK and European Economic Area. Where data is processed outside the UK/EEA (e.g. by Anthropic in the USA), we ensure appropriate safeguards are in place under UK GDPR. Depending on the recipient, this is the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework (UK extension) where the recipient is certified.
Vidual uses essential cookies and local storage only — for authentication tokens and user preferences. We do not use tracking cookies or advertising cookies.
Our pages load fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). To deliver those fonts, Google receives the visitor’s IP address; no cookies are set in doing so. See our Cookie Policy for full detail.
Vidual is a business tool and is not directed at children under 16. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
When a brand connects their Instagram Professional account to Vidual Inbox, we process Instagram Direct Message data on behalf of that brand to provide customer communication services.
This data is processed solely to display conversations in Vidual Inbox and enable the brand to reply. It is never used for advertising, profiling, analytics beyond basic conversation metrics, AI training, or any purpose beyond the inbox service.
Message data is retained until the brand deletes the conversation, disconnects the Instagram integration, or deletes their Vidual Inbox account. Upon any of these events, all associated Instagram message data is deleted without undue delay.
Vidual Inbox only enables replying to existing conversations initiated by the customer. We never initiate outbound messaging to Instagram users who have not messaged the brand first.
When a brand receives an erasure request from a customer, they can delete the customer record from Inbox, which removes all conversation data including Instagram messages. Instagram users can also block the brand on Instagram at any time, which prevents further communication.
When a brand connects their Gmail account to Vidual Inbox, Vidual receives an OAuth access and refresh token from Google for the limited purpose of sending email on the brand’s behalf. This section explains exactly what we access and how we use it.
Vidual Inbox requests a single Google API scope:
https://www.googleapis.com/auth/gmail.send — permission to send mail through the connected Gmail account on the brand’s behalfWe additionally request the standard openid and email scopes solely to identify which Gmail address has been connected, so we can display it in Settings.
We do not request, access, read, modify, store, or otherwise process:
The Gmail integration is used solely to deliver outbound customer-support replies that the brand composes inside Vidual Inbox. When the brand types a reply in Vidual and clicks send, Vidual passes that reply to the Gmail API, which delivers it to the customer from the brand’s connected Gmail address. The reply appears in the brand’s Gmail Sent folder, exactly as if they had sent it from Gmail directly.
The connected Gmail address itself (e.g. support@yourbrand.com) is shown in Settings so the brand can confirm which account is connected.
Vidual’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with keys held in our hosting environment’s secure secret store. Tokens are never logged, never transmitted to third parties, and never exposed in our application’s frontend or API responses. We send replies over HTTPS using Google’s official Gmail API endpoints.
Outbound replies and any attachments the brand attaches are processed transiently to build the message that is delivered to Gmail. We retain a record of the replies the brand has sent (as part of the conversation history they see in Vidual Inbox) but we do not retain a separate copy of the data inside the Gmail mailbox itself; that is the brand’s and Google’s.
OAuth tokens are retained for as long as the Gmail integration is connected. When a brand disconnects Gmail in Vidual Inbox Settings, we immediately revoke the refresh token at Google and delete all stored tokens from our database. When a brand deletes their Vidual Inbox account, all OAuth tokens are deleted as part of the account deletion process.
Disconnecting Gmail does not affect previously sent replies — those remain in the Vidual Inbox conversation history and in the brand’s Gmail Sent folder.
Brands can revoke Vidual’s access to their Gmail account at any time, either by clicking Disconnect in Vidual Inbox Settings, or directly at myaccount.google.com/permissions.
We may update this Privacy Policy from time to time. We will notify account holders of material changes by email or in-app notification. The current version is always available at vidual.app/privacy.html.
Questions about this policy?
Contact us at hello@vidualapp.com or write to:
Where Beagles Dare! Ltd, Unit 6 Heritage Business Centre, Belper, Derbyshire DE56 1SW.