Privacy Notice

Who is responsible

The controller for these services is VERCOD, upravljanje spletnih portalov, d.o.o., Spodnja Polskava 100, 2331 Pragersko, Slovenia. Registration number: 7534132000; tax number: 97387452. Contact info@vercod.com or +386 69 737 737 for privacy questions or requests.

Separate customer applications and products, including HVAC.TOP and CyberCheck, may have their own notices and controllers. Where VERCOD processes a business customer's data on that customer's instructions, the customer determines the purpose and a separate processing agreement applies. This notice does not replace those documents.

Website, inquiries and technical data

The contact form processes your name, business contact details, organization, inquiry category, message and any optional telephone, domain or package information you provide. It sends the inquiry by email; the form does not save message content in the website database. Email systems retain the correspondence.

Requests to our infrastructure can generate IP addresses, timestamps, requested paths, browser information and security or error records. We use these to deliver the website, prevent abuse and diagnose faults. Do not put passwords, access tokens, sensitive personal data or confidential customer files in the public contact form.

User accounts, licenses and MT5

The user portal stores your name, email address, hashed password, verification and account status, session information, license requests, licenses and records of accepted terms and download choices. License and activation records can include MT5 account/server identifiers, installation identifiers, robot versions, timestamps, IP addresses and technical results.

Depending on the robot version and enabled settings, the MT5 service receives technical licensing telemetry. Extended account, position and trade telemetry is a separate optional choice in the portal. Withdrawing that choice stops future collection through that feature; contact us if you also want existing data erased. We do not need your broker password to issue a license. Product-specific MT5 terms and notices remain applicable.

Social Vercod is VERCOD's self-hosted Postiz deployment for authorized users to prepare content, manage a publication calendar, publish to connected channels and view available channel statistics. It stores application account and organization details, team permissions, drafts, uploaded media, schedules, publication results and connected-channel information.

Connecting a platform uses that platform's authorization screen. We receive the access and refresh tokens needed to perform the features you authorize, not your Google or other platform password. A platform is connected only after you authorize it; adding one does not grant access to your other accounts.

For Google/YouTube, Social Vercod uses YouTube API Services. Its authorization request is limited to userinfo.profile, youtube.readonly, youtube.upload and yt-analytics.readonly. Profile ID, name and picture identify the connecting Google user. Channel identifiers, metadata and statistics display the selected channel and available analytics. Upload access publishes the videos and optional thumbnails you select. This integration does not request Google email access, monetary reports or partner/CMS management. Your separate Social Vercod account still uses its own login email.

Older Google connections may retain broader permissions previously approved by you. Updating the application does not revoke those grants; revoke the old access in Google Account settings and reconnect to grant only the current scopes. Coordinate this with scheduled posts. Review the destination channel, visibility and content before publishing. Authorized workspace members may access content according to their roles.

Purposes and legal bases

We process account, licensing and service data to perform our agreement with you or take steps you request before an agreement. We rely on consent where required for optional telemetry and optional integrations; an OAuth permission is also the platform's technical authorization and is not a blanket consent to unrelated uses.

Necessary security, fault investigation and business communication may be based on our legitimate interests, taking your rights into account. Records required by applicable law are processed to meet those obligations. If required account or authorization data are not provided, the relevant feature cannot operate; optional features are not required simply to browse the website.

Limits on Google data use

We use Google API data for the connected, user-facing Social Vercod functions described here, subject to the Google API Services User Data Policy and its Limited Use requirements. We do not sell these data, use them for advertising profiles or credit decisions, or use them to train general-purpose AI models.

Human access is limited to support you authorize, necessary security investigations or legal obligations. Transfers are limited to the authorized service functions and the exceptions permitted by Google's policy. Connecting YouTube does not authorize sending Google account or analytics data to unrelated AI or advertising services.

Google API Services User Data Policy

Recipients and international processing

Authorized VERCOD personnel and infrastructure, hosting, email and maintenance providers may process the data necessary to operate and support the services. Social platforms receive the content and requests you choose to send to them. We may disclose data where legally required or necessary to address a security incident; we do not sell personal data.

Google/YouTube and other platforms have their own privacy policies and may process data outside the European Economic Area. Any transfer for which VERCOD is responsible must have an applicable legal basis and required safeguards, such as an adequacy decision or contractual safeguards. Contact us for information about the recipients and safeguards relevant to your service.

Retention and backups

Inquiries are kept in the email system for the business purpose and any applicable legal or dispute-handling obligations. Account and license records are kept while needed to provide the service and meet those obligations. Closing an account is not necessarily immediate erasure of every audit or contractual record.

The MT5 portal has scheduled retention rules for technical and trading telemetry and IP-address records. Current categories and periods are shown below. They do not describe every server log or backup, and withdrawing telemetry permission is separate from requesting historical deletion.

Social drafts and uploaded media are kept for your workspace until removed or the relevant service is ended. Google/YouTube data are limited to the authorized purpose and applicable platform retention rules, not retained indefinitely for unrelated uses. Use the deletion procedure below to request removal of stored integration data.

Restricted backups are used for recovery, not ordinary access. An erasure request must also be accounted for in affected backups and subsequent restores. Where a backup cannot be selectively edited, it must be securely removed or excluded from restoration of erased data; we do not describe channel disconnection as automatic deletion of all backup copies.

IP addresses in covered MT5 records: 90 days
MT5 technical telemetry events: 180 days
MT5 extended trading snapshots and trades: 365 days

Disconnect, revoke access and request deletion

You can revoke Social Vercod's Google access in your Google Account connections/security settings. You can also disconnect a channel in Social Vercod. Revocation prevents future authorized API access but does not by itself erase data already stored in the application or delete videos on YouTube.

To request deletion, email info@vercod.com with the subject "Social Vercod data deletion", your application email and the channel or workspace concerned. Do not send passwords, tokens or identity documents unless a necessary secure identity check is arranged. You may request deletion without deleting your Google account.

We verify that the request is authorized and remove the relevant stored YouTube API data as soon as possible and within seven calendar days of a valid deletion request, including handling affected recovery copies. This is a support-managed process, not a claim that disconnecting a channel automatically purges every record. Requests concerning other personal data are handled within the applicable GDPR deadlines.

Deleting data held by Social Vercod does not delete content held by YouTube. Manage or delete published videos separately in YouTube Studio. Data that must be retained under law are restricted to that purpose and any applicable exception will be explained.

Security, cookies and external content

We use HTTPS, access controls and restricted operational access. Website account passwords are hashed. Authorization credentials must not be shared in support messages or public repositories. No service can promise absolute security; report suspected unauthorized access promptly.

The corporate website uses necessary session and request-security mechanisms. Social Vercod also uses authentication/session storage and may load profile images or content from connected platforms, which exposes connection information such as your IP address to those providers. Google handles its own sign-in cookies. See the cookie notice for the distinction between these services.

Cookie notice

Your rights and changes to this notice

Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. Contact info@vercod.com. You may complain to the Slovenian Information Commissioner or your competent supervisory authority.

These services are intended for authorized business use, not directed at children. We do not use the described services to make solely automated decisions producing legal or similarly significant effects about you. New purposes, providers or optional features must be assessed and disclosed before they are introduced. The date above identifies this notice; existing product-specific agreements are not silently replaced.

Slovenian Information Commissioner