Privacy Policy
1. Overview
This Privacy Policy explains how Viralify ("Viralify", "we", "us") collects, uses, shares, and protects personal information when you use our website, apps, and services (the "Platform"). It applies to everyone whose information we handle: visitors who simply browse our website, whether or not they ever create an account, and the clippers and brands who use the Platform. By using the Platform you understand the practices described here. This Policy is incorporated into our Terms of Service.
2. Visitors to our website
You do not need an account for us to receive information about you. If you only browse our website, we collect the pages and content you view, the approximate location we derive from your IP address, your browser and device type, and how you arrived — for example from one of our ads, from a search result, or through a referral link. If you book an intro call with us, we also receive the name and email address you enter when booking. We use this information to understand how our site is found and used, to keep it secure, and to measure our advertising. Where that involves storing anything on your device, section 7 explains what we store and when we ask your permission first.
3. Information we collect
Account information: identifiers and profile information from the social accounts you connect (such as TikTok, Instagram, YouTube, or Google), including username, user ID, display name, and avatar; and, if you register by email, your email address. Wallet and payment information: your Solana wallet address and the on-chain records of your payouts, and tax information where we are required to collect it. Content and performance data: the clip URLs you submit and the public performance metrics we collect for them, such as view counts, likes, comments, and shares, gathered from public posts and from social platform interfaces. For Instagram accounts you connect through Instagram login, this also includes your profile details, media list, and insights provided by Meta's Instagram API, such as views, reach, interactions, follower counts, and aggregated audience demographics, which we refresh on a schedule while the account stays connected. Usage and device data: pages and features you use, actions you take, approximate location derived from your IP address, and browser, device, and cookie information.
4. How we use your information
We use your information to: (a) provide, operate, and maintain the Platform; (b) verify that you own the social accounts and clips you connect; (c) track views and calculate, verify, and pay your earnings; (d) detect, investigate, and prevent fraud, abuse, and policy violations; (e) provide support and communicate with you about your account, payouts, and campaigns; (f) comply with legal, tax, and accounting obligations; and (g) measure and improve the Platform.
5. Legal bases (where the GDPR applies)
Where the EU or UK GDPR applies, we rely on the following legal bases: performance of our contract with you (to run your account, track views, and pay you); our legitimate interests (to secure the Platform, prevent fraud, and improve our service); your consent, where we ask for it; and compliance with our legal obligations. Where we rely on consent, you can withdraw it at any time.
6. Advertising and the Meta pixel
We advertise Viralify on Meta's platforms, including Facebook and Instagram. To understand which of our ads work, we use the Meta pixel, a small piece of Meta's code that runs on our website. Once you accept it, the pixel sets the _fbp cookie and tells Meta which pages you viewed and whether you took an action such as signing up or booking a call, so that Meta can connect that back to an ad you clicked. The pixel does not load, and _fbp is not set, until you accept it in the cookie banner. For the pixel, Viralify and Meta are joint controllers under Article 26 of the GDPR: we decide together that this information is collected and sent, so we share responsibility for that step. We are responsible for asking your permission and for telling you what happens, and Meta is responsible for what it does with the information afterwards, which is governed by Meta's own terms and privacy policy. The essence of that arrangement is set out in Meta's Controller Addendum, and you can ask us about it using the contact details below.
7. Cookies and similar technologies
We use cookies and similar technologies. "Similar technologies" mainly means information stored in your browser's local storage: it is not a cookie, but we treat it the same way and list it here for that reason. Strictly necessary items keep you signed in, remember your language and your light or dark theme, secure the Platform, and record your cookie choice itself; these are set without consent because the Platform cannot work without them. We also store a referral or invite code in your browser as soon as you arrive through a referral or invite link (viralify_referral_code and viralify_invite_code), so that whoever referred you is credited correctly if you later sign up. We store viralify_has_submitted to remember whether you have submitted a clip before, and vf-lead-fired so that the same booking is not counted twice. Information kept in local storage does not expire on its own the way a cookie does: it stays until you or we clear it, or until you clear your browser data.
8. Your cookie choices
Optional items are only used if you agree to them. The main one is the Meta pixel described in section 6, which sets _fbp and _fbc. Other technologies described in this Policy, such as the error monitoring and session recording covered in section 9, are used for limited purposes and are explained in their own sections. You can change or withdraw your choice at any time using "Cookie settings" in the footer; withdrawing deletes _fbp and _fbc and stops the pixel loading again. We ask again at most once a year. Blocking cookies in your browser also works, though some features may not.
9. Monitoring, error reporting, and server logs
To keep the Platform working and secure we use an error-monitoring service, Sentry. When something goes wrong it records what happened so that we can find and fix it, and it is configured not to attach your IP address, your cookies, or your request headers. The same service also records a small sample of browsing sessions — a fraction of all sessions, and sessions where an error occurred — so that we can see what led up to a problem; these recordings are configured to mask text and block images by default, so balances, wallet addresses, and clip content do not appear in them. Separately, our hosting provider keeps standard server logs of requests made to our site, including IP addresses, for security and troubleshooting, and this happens for every request, independently of anything you do on the site.
10. How we share information
We do not sell your personal information. We share information with: (a) the brands whose campaigns you join, primarily as aggregated or campaign-level performance data, and, where relevant to a submission, the handle and clips tied to that campaign; (b) payment and blockchain infrastructure providers, including our wallet provider, to create wallets and process payouts; (c) service providers who host, support, and secure the Platform, under confidentiality obligations and only as needed; (d) authorities, courts, or others where we are required to by law or to protect our rights, users, or the Platform; and (e) partner platforms in cases of confirmed fraud or terms violations. We may also share information as part of a corporate transaction such as a merger or acquisition. The service providers we rely on today are Privy (embedded wallets), Supabase (database and authentication), Vercel (hosting), Sentry (error monitoring and session recording, as described in section 9), Resend (email we send you about your account), Cal.com (booking intro calls, which receives the name and email address you enter when booking), and Meta (advertising, as described in section 6).
11. Blockchain and the public ledger
Payouts are recorded on the Solana blockchain, which is public, permanent, and outside our control. Your wallet address and transaction amounts are visible on the public ledger and cannot be changed or deleted once confirmed. Please keep this in mind when receiving payouts.
12. Social platform APIs (including YouTube and Google)
When you connect a social account, we access only the data we need to verify ownership and measure your clips. Our access to and use of Google and YouTube data complies with the YouTube Terms of Service and the Google Privacy Policy. You can review or revoke our access through your account settings on the relevant platform (for Google, via the Google Security Settings page) or by disconnecting the account in Viralify, and you can ask us to delete data we obtained through a platform's interface.
13. Data retention
We keep personal information only for as long as needed for the purposes described in this Policy, including to run your account, pay you, meet legal, tax, and accounting obligations, resolve disputes, and prevent fraud and abuse. Information we collect for advertising, monitoring, and security — pixel and advertising data, server logs, and session recordings — is kept for six months and then deleted. Some information we have to keep even if you ask us to delete it, as section 16 explains. When information is no longer needed, we delete or anonymise it. Records written to the blockchain are permanent by nature and cannot be deleted.
14. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent. Residents of the EU, EEA, and UK have these rights under the GDPR. Residents of California have rights under the CCPA and CPRA, including the right to know, delete, correct, and opt out of the sale or sharing of personal information (we do not sell your personal information).
15. How to make a request
To make a request, email us at hello@viralify.gg and tell us what you would like us to do. Requests are free. We will reply within one month; if your request is complicated we may need up to two further months, and we will tell you within the first month if that happens. We may ask you for information to confirm who you are before we act, so that we do not hand over or delete someone else's data by mistake. If you have never created an account you can still make a request, but we may hold only a browser identifier with no way to link it to you as a person, so please tell us as much as you can about how and when you used the site; if we genuinely cannot identify you from what we hold, we will explain that rather than guess.
16. Limits on deletion
Deletion has limits. We cannot delete records we are legally required to keep, such as payout, tax, and accounting records, or the limited record of accounts banned for fraud that stops a banned account simply being created again. Payouts written to the blockchain are permanent and outside our control. We will delete everything else, and we will tell you what we kept and why.
17. Complaints
You also have the right to complain to a data protection authority. Ours is the Office of the Commissioner for Personal Data Protection in Cyprus, and you may also complain to the authority in the country where you live.
18. International transfers
We and our providers may process and store your information in countries other than the one you live in, including countries whose data-protection laws differ from yours. Where required, we use appropriate safeguards, such as standard contractual clauses, to protect your information when it is transferred.
19. Children's privacy
The Platform is intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information without appropriate consent, we will delete it.
20. Security
We use administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security. Please keep your login and wallet credentials confidential.
21. Third-party links
The Platform may link to websites and services we do not operate or control, including social platforms. This Policy does not apply to them, and we are not responsible for their privacy practices. Review their policies before providing information.
22. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, give notice through the Platform or by email. Your continued use of the Platform after the changes take effect means you accept the updated Policy.
