Privacy

Last updated: October 21, 2026

This Privacy Policy explains which personal data we process in connection with the viral.app website, the viral.app SaaS service, and the viral.app Importer browser extension, for which purposes, on which legal basis, and which rights you have.

1. Controller

The controller for the processing described here is:

FMD Labs GmbH
Ernst-Haeckel-Platz 5/6
07745 Jena
Germany

Commercial register: Local Court (Amtsgericht) of Jena, HRB 523255
Represented by its managing directors: Felix Meier, Mike Schneider, Dennis Zollmann
Email: hello@viral.app
Phone: +49 151 22821132

2. Hosting and Server Log Files

Our website and the service run on Vercel Inc. (USA) for the web applications and on our own servers at Hetzner Online GmbH (data centers in Germany and Finland) for databases, data processing, real-time chat, and caching. We use Cloudflare, Inc. (USA) for object storage (for example, uploaded files, media, and backups) and to protect access to internal services. We have data processing agreements pursuant to Art. 28 GDPR with these providers; transfers to the USA are based on the EU-U.S. Data Privacy Framework.

When you visit our pages, our servers automatically process the following data (server log files): IP address, date and time of access, page or file requested, amount of data transferred, browser type and version, operating system, and referrer URL. The processing is based on Art. 6 (1)(f) GDPR; our legitimate interest lies in the technical provision, stability, and security of the service. Log files are deleted as soon as they are no longer required for these purposes, usually after 30 days at the latest, unless they are needed to investigate specific security incidents.

3. Cookies, Similar Technologies, and Your Consent

We use cookies and similar technologies, such as local storage and session storage in your browser. Storing information on your device or reading it from there requires your consent under Sec. 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), unless it is strictly necessary to provide a service you have expressly requested (Sec. 25 (2) no. 2 TDDDG). We group these technologies into four categories: Necessary, Analytics, Marketing, and External media. The tables in this section list every cookie and storage entry by category, with provider, purpose, and storage period; Section 4 describes the analytics, marketing, and external media services and their legal bases.

Your choice

You make your choice in our consent banner or in the cookie settings, on our website and in the application. Both run on viral.app, so one choice applies to both in the browser you use. You can accept or reject all optional categories or choose them individually; Necessary is always active.

Which rule applies depends on the country you visit us from. Our hosting provider (Section 2) determines it from your IP address; we store only the country and region code, as part of the consent record. If the country cannot be determined, the first rule applies:

• In the European Economic Area, the United Kingdom (including Gibraltar, Guernsey, Jersey, and the Isle of Man), Switzerland, Brazil, and Québec, Analytics, Marketing, and External media stay off until you consent. The legal basis is your consent (Sec. 25 (1) TDDDG, Art. 6 (1)(a) GDPR).
• In all other countries, these categories are active until you turn them off under "Your privacy choices". The legal basis there is our legitimate interest in the purposes described in Section 4 (Art. 6 (1)(f) GDPR); turning a category off counts as your objection. We treat the Global Privacy Control signal of your browser as an objection to Analytics and Marketing.

You can change or withdraw your choice at any time with effect for the future: with "Cookie settings" under "Privacy" in the footer of our website and on the sign-up pages (in the countries without prior consent, the entry reads "Your privacy choices"), and under "Cookie settings" in the general user settings of the application. If you withdraw consent for a category, the page reloads and we delete that category's cookies on viral.app; cookies that providers set on their own domains can be deleted in your browser settings. In the countries with prior consent, your choice is valid for 12 months, after which we ask again; in the other countries, a category you turned off stays off until you change it. We also ask again if categories or providers change.

Consent records

When you save a choice, we store a record of it in our database (Hetzner Online GmbH, Germany): a random browser ID, which is also stored in the c15t cookie; your choice for each category; the action (accept all, reject all, or your own selection) and where you made it (for example, in the banner or in the settings); the time; the version of our consent policy and its fingerprint (a checksum); the consent model (prior consent or objection) and the jurisdiction applied; the country and region code; your browser's language; and, once you sign in in that browser, your user account. The record contains neither your IP address nor your user agent. The legal basis is Art. 6 (1)(c) GDPR in conjunction with Art. 7 (1) GDPR (proof of consent) and our legitimate interest in documenting your choices and defending against claims (Art. 6 (1)(f) GDPR). We keep a record for the validity of the choice (12 months) plus three years (the regular limitation period) and then delete it.

Necessary

Necessary technologies are those without which our website, the application, or a function you request would not work. We use them on the basis of Sec. 25 (2) no. 2 TDDDG; the processing of the data is based on Art. 6 (1)(b) GDPR where it serves the contract with you, and otherwise on our legitimate interest in a functioning and secure service (Art. 6 (1)(f) GDPR). They include:

• sign-in and session management (sessions expire after 7 days without use), securing sign-in flows with connected services, sign-up, and invitation links;
• your consent choice and the settings you choose yourself, such as language, light or dark mode, layout, and notices you have closed;
• protection of our free tools against abuse: a cookie counts searches in the free video library, and Cloudflare Turnstile (Cloudflare, Inc., USA; see Section 2) checks whether a request comes from a person;
• error monitoring with Sentry (Functional Software, Inc., USA, processing in Germany), which reports errors on the website and in the application with IP address and user ID and sets no cookies; transfers to the USA are based on the EU-U.S. Data Privacy Framework;
• our self-hosted support chat (Section 12), which sets its cookies only once you open it;
• the Cal.com booking calendar on our booking pages (Section 12), which you use to book an appointment;
• videos you open in the viral.app dashboard, which play in the platforms' own players (TikTok, Instagram and Facebook, YouTube) as part of the analytics service you use;
• the referral cookie of our affiliate program: if you arrive via a partner's referral link, a cookie from Affonso (ZASolution, Fellbach, Germany) records for 60 days which partner referred you, so that the partner receives its commission. The cookie is necessary for the affiliate program that your referral link belongs to. If you take part in the affiliate program yourself, we share your name and email address with Affonso (Art. 6 (1)(b) GDPR).

When the booking calendar or a platform player loads, the provider receives your IP address and browser information and may set its own cookies.

After you sign in, we store your first name and the sign-in method you used (Google, passkey, or email) in your browser's local storage, so that the sign-in page can greet you by name and mark the method you used last. This copy is kept in your browser on that device and remains there until you remove it on the sign-in page or delete the site data in your browser. The legal basis is Sec. 25 (2) no. 2 TDDDG and our legitimate interest in making sign-in easier (Art. 6 (1)(f) GDPR).

Analytics, marketing, and external media

These categories run only as described under "Your choice"; Section 4 describes the services. They store or read the following:

Analytics

Marketing

External media

You can also block or delete cookies in your browser settings at any time and block analytics and marketing technologies with browser extensions. If you block necessary cookies, parts of the service may not work.

4. Web Analytics, Attribution, Marketing, and External Media

We use the following services to measure the use of our website and application and the success of our advertising, to advertise our service, and to show external content. Where they store or read information on your device, they run only in the categories you allow (Section 3); in the countries without prior consent, "with your consent" in this section means until you turn the category off. You can withdraw your consent at any time with effect for the future. Some processing takes place on our servers or the providers' servers without access to your device, regardless of your choice in the banner; we name it below together with its legal basis. You can object to it at any time (Section 19), for example by email to hello@viral.app. Transfers of analytics and marketing data to the USA are based on the EU-U.S. Data Privacy Framework.

Analytics

With your consent in the Analytics category, we use PostHog (PostHog Inc., USA, EU cloud) for usage statistics, heatmaps, and web vitals (page load performance). In the application, PostHog also records sessions; all typed input and all text on the screen are masked, and the payout, bank, tax, and chat areas are excluded from recordings entirely. When you are signed in, the statistics are linked to your account (email address, name, role, and account creation date) and your organization. We also store campaign parameters (UTM parameters), the landing page, and the referring website in cookies for up to 90 days and link them to your account when you sign up.

Without your consent in the Analytics category, PostHog still receives page views and events, but without cookies or any other storage on your device (cookieless mode). To count visits in aggregate, PostHog uses your IP address and user agent on its servers to derive a pseudonymous hash that changes daily. In addition, our servers send PostHog events about actions in our product; this involves no access to your device. The legal basis for both is our legitimate interest in measuring the reach and use of our website and application (Art. 6 (1)(f) GDPR).

Marketing

With your consent in the Marketing category, the Meta Pixel, the LinkedIn Insight Tag, the Reddit Pixel, the X Pixel, and the ChatGPT Ads pixel load, and we store the ad click IDs from the ad link you used (for example, va_gclid or va_fbclid) in cookies for 90 days, so that a later sign-up or purchase can be reported to the respective ad network.

We load the Google Ads tag for all visitors, on our website after your first interaction with the page, in Google Consent Mode v2 ("advanced" mode). Without your consent in the Marketing category, it sets no cookies and sends Google only cookieless pings with the page, the time, and browser information, with ad identifiers redacted; your IP address is transmitted as part of the connection. Google uses these pings to model conversions. The legal basis is our legitimate interest in measuring our advertising (Art. 6 (1)(f) GDPR). With your consent, the tag also sets cookies and transmits ad identifiers.

Regardless of your choice in the banner, our servers report sign-ups, newly created organizations, checkouts, and subscription events to the ad networks listed below, with the data named there and any ad click IDs we have stored for you. We also upload the hashed email addresses of our registered users to Meta Custom Audiences once a day. The legal basis is our legitimate interest in measuring our advertising and advertising our service (Art. 6 (1)(f) GDPR).

• Meta (Meta Platforms Ireland Ltd., Dublin, Ireland): Meta Pixel, Conversions API, and Custom Audiences, including hashed email address, name, country and postal code, user ID, IP address, user agent, and browser and click identifiers. We are jointly responsible with Meta for collecting these data and transmitting them to Meta (Art. 26 GDPR); Meta alone is responsible for processing them afterwards.
• Google Ads (Google Ireland Limited, Dublin, Ireland): Google tag (see above) and server-side conversions with click identifiers.
• Reddit (Reddit, Inc., USA): Reddit Pixel and server-side events with click identifiers, hashed email address, user ID, IP address, and user agent.
• LinkedIn (LinkedIn Ireland Unlimited Company, Dublin, Ireland): LinkedIn Insight Tag and server-side events with click identifiers and hashed email address, name, IP address, and user ID, plus company and country.
• ChatGPT Ads (OpenAI Ireland Ltd., Dublin, Ireland): ChatGPT Ads pixel and server-side events with click identifiers, hashed email address, name, and user ID, plus IP address, user agent, and country.
• X (X Internet Unlimited Company, Dublin, Ireland): X Pixel and server-side events with click identifiers, hashed email address, IP address, and user agent.

External media

Articles on our website embed posts and videos from YouTube, TikTok, Instagram, X, Facebook, LinkedIn, and Pinterest. They load only with your consent in the External media category, or when you click "Load once" on the placeholder, which loads only that item. We embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com). When an embedded item loads, the provider receives your IP address and browser information and may set its own cookies. The legal basis is your consent (Sec. 25 (1) TDDDG, Art. 6 (1)(a) GDPR), which for "Load once" covers that one item. Some of these providers are based in the USA; Section 16 applies to transfers there.

5. Registration, Customer Account, and Contract Performance

When you sign up for viral.app or use the service, we process the data you provide: name, business email address, company details, login data, and contract, plan, and billing data. The processing takes place to conclude and perform the contract (Art. 6 (1)(b) GDPR). Where contact persons of a business customer are concerned, the processing is based on our legitimate interest in communicating with our business customers (Art. 6 (1)(f) GDPR). Providing the registration and contract data is necessary to conclude and perform the contract; without it, we cannot conclude or perform the contract.

For sign-in, we offer a sign-in link or one-time code by email, passkeys, and sign-in with a Google account (Google Ireland Limited); with Google sign-in, we receive the email address and basic profile data stored with Google (Art. 6 (1)(b) GDPR). You can optionally enable browser push notifications; they are delivered through your browser's push service (for example, Google, Mozilla, Apple) on the basis of your consent (Art. 6 (1)(a) GDPR), which you can withdraw at any time in your browser settings.

If you connect viral.app to third-party applications through our programming interfaces (for example, with an API key or by connecting an AI assistant), we transmit the requested data to that application at your request. The respective provider is responsible for further processing there.

6. Research on Business Customers at Registration

When you create an organization, we research publicly available information on the internet based on your name, email address, company, and country (using the search service Firecrawl, SideGuide Technologies, Inc., USA) and have a short summary created from it (using our AI service, see Section 10). We use the result internally to better serve new business customers and share it in our internal communication tool Slack. The legal basis is our legitimate interest in serving and qualifying business customers (Art. 6 (1)(f) GDPR). You can object to this processing at any time (see Section 19). To analyze the product you enter at registration (using our AI service, see Section 10), and to prefill details such as name and logo from a website you enter in the organization or project settings, we also read that website via Firecrawl (Art. 6 (1)(b) GDPR).

7. UGC and Creator Analytics (Platform Features)

The core feature of viral.app is the analysis of publicly available content and metrics from social media platforms (for example, TikTok, Instagram, YouTube, Facebook, Snapchat), for example on videos, accounts, and their performance. This may involve processing personal data of creators (for example, username, profile information, published content, reach and engagement metrics). This data comes from publicly accessible sources of the respective platforms; we use specialized service providers to retrieve it.

Where we process this data on behalf of our customers (for example, tracking the accounts and campaigns selected by the customer), the respective customer is the controller under data protection law and we act as processor on the basis of our Data Processing Agreement, which also contains the full description of the processing. This also applies to creator profiles and compensation data that our customers create in viral.app; to that extent, informing the creators concerned pursuant to Art. 13 and 14 GDPR is the responsibility of the respective customer as controller. Where we process data under our own responsibility (for example, cross-customer features such as trend and discovery views based on public data), we rely on our legitimate interest in providing and improving the service (Art. 6 (1)(f) GDPR). We keep customer environments strictly separate and do not use a customer's non-public data (for example, tracked accounts, prompts, search queries) to generate results for other customers. This does not affect the use of aggregated and anonymized data without any personal reference, from which no conclusions can be drawn about individual customers or creators, to operate and improve the service.

viral.app Importer browser extension

viral.app Importer lets you add social accounts and videos found on a web page to your organization's tracking. When you open the extension, it reads the current tab's URL and title locally in your browser. While you are signed in, it also scans the page's hyperlinks, including links to embedded social posts, when you open it or request another scan. It identifies supported social accounts and videos locally. It does not scan hyperlinks while you are signed out or monitor pages as you browse with the popup closed.

The extension sends the social platform, account usernames and video identifiers it finds to viral.app to check which items your selected organization already tracks. This check happens before you choose what to import and can run again when you switch organizations, refresh results or finish an import. An import sends the selected items, their social links, tracking options, tags and destination organization to viral.app. The scan does not transmit the source page's title, full HTML, page text or unrelated links. The current page's URL is used locally to identify a supported social account or video where applicable.

Importer receives your user profile, authorized organizations, tracked status, tags and plan usage from viral.app. It stores these details, the current page information, scan results, selections, import progress and OAuth access token in the extension's browser session storage. This storage is cleared when the browser closes or the extension updates. A rotating OAuth refresh token is kept in the extension's local storage so sign-in can continue across browser restarts; the extension does not use browser sync storage. Requests to viral.app use HTTPS. Server logs may contain IP addresses and request information as described in Section 2.

Signing out removes the stored tokens and account-specific data; the collected result list can remain for the rest of the browser session. The extension's "Change access" option lets you change which organizations it may access. You can revoke access in your viral.app account's security settings. Signing out, revoking access or uninstalling the extension does not delete records already imported into an organization. Those records are subject to Section 14; deletion requests are handled as described in Section 18.

The processing for sign-in and account access follows the legal bases described in Section 5. The local storage is necessary to provide the extension's requested functions (Sec. 25 (2) no. 2 TDDDG). For data processed on behalf of an organization, including imported accounts and videos, the controller and processor roles described in this Section 7 apply. Hosting providers and providers that retrieve public platform data process the data needed for these functions as described in Sections 2, 7, 15 and 16.

viral.app Importer's use and transfer of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use data obtained through the extension only to provide or improve its import and tracking functions, including their operation and security. We do not sell this data or use or transfer it for personalized advertising, creditworthiness assessments or lending. Transfers to service providers are limited to what these functions require; other disclosures are limited to legal obligations or protection against fraud and abuse. These restrictions also cover data derived from extension data and take precedence over the general analytics, marketing and recipient descriptions elsewhere in this policy.

8. Creator Accounts and Creator Marketplace

Creators aged 18 or older can create their own account, maintain a profile, apply for jobs posted by brands, communicate with brands, and receive payouts. For this, we process the information you provide, in particular name, email address, profile photo, date of birth, gender, phone number, address, country, languages, topics and content formats, education, connected social media accounts with their public metrics, selected videos, as well as applications and messages. The legal basis is the performance of our user relationship with you (Art. 6 (1)(b) GDPR).

Brands that use viral.app can see your profile in the creator search, in particular name, age (calculated from your date of birth), gender, languages, country, topics, social media accounts with metrics, and selected videos. A brand only receives your address and further contact details once you work with it or release them yourself. To suggest suitable jobs to you and suitable creators to brands, we automatically match profiles and jobs and have short explanations of the fit created by our AI service (see Section 10); we automatically rank applications for the respective brand by how well they fit the job (for example, country, age, languages, topics, and reach); the decision on any collaboration is made solely by you and the respective brand. The legal basis is the performance of the user relationship (Art. 6 (1)(b) GDPR) or our legitimate interest in a functioning marketplace (Art. 6 (1)(f) GDPR).

We store messages and files you exchange with a brand on our servers; they are visible to the brand involved and may be analyzed by its AI assistant (see Section 10). If you allow a brand to use your content for ads (for example, via TikTok or Meta), the information required for this is transmitted to the respective platform. To the extent we or the payout service provider are legally required to report creators' earnings to tax authorities (German Platform Tax Transparency Act implementing the EU DAC7 directive), we process and transmit the necessary information, such as tax identification number, date of birth, address, and earnings (Art. 6 (1)(c) GDPR). Where we enable ratings, they are visible to the users involved. You can delete your creator account yourself in your account settings, unless an ongoing collaboration or payout history prevents this; in that case, please contact hello@viral.app.

9. Creator Payouts and Disclosure to Payment Service Providers

viral.app can calculate payout amounts for creators based on performance data. When our customer approves a payout, we transmit the data required for it (for example, name or user ID of the payee, email address, payout amount, description, and underlying performance data) to the payout service provider chosen by the customer, currently Talentir GmbH (Talentir LLC), Stockerstrasse 38, 8002 Zurich, Switzerland (CHE-146.889.750). Our customer sets up the connection via an interface it authorizes; the binding payout order is placed in the payout service provider's environment. The legal basis is the performance of the contract with our customer (Art. 6 (1)(b) GDPR) or our legitimate interest in handling the payout processes commissioned (Art. 6 (1)(f) GDPR).

The payout service provider processes the data on the basis of its own contractual relationship with the customer or the payee, partly on behalf of the customer and partly under its own responsibility (for example, for identity and anti-money-laundering checks and the execution of payments); its privacy policy applies. There is an adequacy decision of the European Commission for transfers to Switzerland (Art. 45 GDPR).

10. AI-Powered Features

For AI-powered features, we use Google's Gemini API on the paid tier; the contracting party is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. These features include in particular:

• automated tagging and analysis of videos based on criteria configured by the customer (video content including the audio track),
• our assistant (Copilot), which processes data of the respective organization on request, including uploaded files and messages with creators, and reads public websites on request (via Firecrawl, see Section 6),
• translating chat messages between brands and creators,
• extracting tracking lists from uploaded files,
• matching creator profiles and jobs, including short explanations of the fit,
• analyzing the product entered at registration (Section 6),
• summarizing the research on new business customers (Section 6).

Google processes the transmitted data as our processor and does not use it to train its models on the paid tier. To detect abuse, Google stores inputs and outputs for up to 55 days. Persons are not identified on the basis of biometric characteristics. Data may be processed in third countries, in particular the USA; the transfer is based on the EU-U.S. Data Privacy Framework. Where the processing takes place on behalf of our customers, Section 7 applies; otherwise, the legal basis is the performance of the contract (Art. 6 (1)(b) GDPR) or our legitimate interest in providing the features efficiently (Art. 6 (1)(f) GDPR). Payouts are calculated by fixed rules, without AI.

For the comment sentiment of our free TikTok tools (TikTok Comment Exporter and TikTok Audience Analytics), we use the Jev API of TypeSafe AI, Inc., 255 California St, Suite 1300, San Francisco, CA 94117, USA. We send only the text of public TikTok comments, without usernames or other profile data, and store the resulting label (positive, neutral, or negative) with the cached comments for up to 30 days. TypeSafe processes the text on our behalf in the USA and does not use it to train or fine-tune its models. The legal basis is our legitimate interest in offering the free tools (Art. 6 (1)(f) GDPR); Section 16 applies to the transfer to the USA.

To translate chat messages between brands and creators, we also use the Jev API of TypeSafe to detect the language of a message. We send only the message text; TypeSafe processes it on our behalf in the USA and does not use it to train or fine-tune its models. Where the processing takes place on behalf of our customers, Section 7 applies; otherwise, the legal basis is the performance of the user relationship (Art. 6 (1)(b) GDPR); Section 16 applies to the transfer to the USA.

11. Subscription Payment Processing

For subscription billing, we use Polar Software, Inc., 3500 South DuPont Highway, Dover, DE 19901, USA, as merchant of record. Polar is your contractual partner for the purchase and payment process and processes your payment data as an independent controller; Polar's privacy policy applies in this respect. We send Polar your name, email address, user and organization ID, IP address, and information about the origin of the order. We ourselves do not receive or store complete payment data, only order and billing information (Art. 6 (1)(b) GDPR). Transfers to the USA are based on the EU Standard Contractual Clauses.

12. Support, Communication, Appointment Booking, and Video Calls

When you contact us (for example, by email or via our support chat, which we run with self-hosted software on our own infrastructure), we process your information to handle your request; in the application's support chat, we also transmit information about your account, your organization, and your plan for this purpose. The legal basis is Art. 6 (1)(b) GDPR where the request concerns a contractual relationship, and otherwise Art. 6 (1)(f) GDPR (legitimate interest in responding to inquiries).

We send transactional emails (for example, sign-in links, system notifications) with email software we run on our own servers at Hetzner Online GmbH, delivered through Amazon Simple Email Service (Amazon Web Services EMEA SARL, Luxembourg; data center in Frankfurt, Germany). While we switch over, some of them are still sent via Resend (Plus Five Five, Inc., USA). We send product emails and our newsletter via Loops (Astrodon Corporation, USA). Transfers to the USA are based on the EU-U.S. Data Privacy Framework. Business accounts receive our newsletter about viral.app and creators receive emails about matching jobs and their profile (Art. 6 (1)(f) GDPR, Sec. 7 (3) of the German Act Against Unfair Competition, UWG); you can object at any time via the unsubscribe link in every email or at hello@viral.app, without any costs other than the transmission costs at the basic rates.

To book demo appointments, we embed the booking calendar of Cal.com (Cal.com, Inc., USA). When you book an appointment, Cal.com and we process your name, email address, the information you enter in the booking form, and the appointment; we transmit the booking to our system to prepare the call. The legal basis is the performance of pre-contractual measures at your request (Art. 6 (1)(b) GDPR).

We hold calls with prospects, customers, and partners via Google Meet (Google Ireland Limited) and record them with Google Meet's note-taking feature and Circleback (Circleback AI, Inc., USA), which also create transcripts and summaries, to document what was discussed and agreed (Art. 6 (1)(f) GDPR; transfers to the USA are based on the EU-U.S. Data Privacy Framework). If you would rather not be recorded, just let us know; we delete recordings, transcripts, and summaries once they are no longer needed for the business relationship.

If you report illegal content in the service to us (see our Terms of Service and Creator Terms of Use), we process your information, the reported content, and the communication with those involved in order to review the report and decide on measures. The legal basis is compliance with our obligations under the Digital Services Act (Art. 6 (1)(c) GDPR) or our legitimate interest in a safe service (Art. 6 (1)(f) GDPR).

13. Social Media Profiles

We maintain company profiles on X, LinkedIn, Instagram, TikTok, and YouTube. When you visit these profiles, the respective platform processes your data under its own responsibility in accordance with its privacy policy. Where the platforms provide us with aggregated page statistics, we are jointly responsible with them (Art. 26 GDPR); the platforms provide the essential terms of these arrangements. In addition, we process your messages and comments to us in order to respond to them (Art. 6 (1)(f) GDPR).

14. Retention Periods

We only process personal data for as long as necessary for the respective purposes. In detail:

• Account and organization data is stored for as long as your account exists. After a paid contract ends, we make your data available for export upon request made within 30 days. You can request the deletion of your account at any time; creators can also delete their account themselves (Section 8).
• Billing-related data is retained in accordance with statutory retention periods (6, 8, or 10 years pursuant to Sec. 257 of the German Commercial Code (HGB) and Sec. 147 of the German Fiscal Code (AO)).
• Security logs of actions in the service (for example, user ID, IP address, action) are stored for 365 days; details are trimmed after 90 days.
• Sign-in links and one-time codes are valid for 5 minutes; sessions expire after 7 days without use.
• Internal processing events are deleted after 2 days and generated data exports after 7 days. Copies of the media of tracked videos (video files, and for slideshows their images and sound) that we store for playback, previews and AI analysis are usually deleted within 60 days after they were stored.
• Cookies and similar technologies are stored for the periods listed in the tables in Section 3.
• Consent records are kept for the validity of the choice (12 months) plus three years and then deleted (Section 3).
• Newsletter data is stored until you unsubscribe.

15. Recipients and Processors

We only disclose personal data as described in this policy or where there is a legal basis for it. Categories of recipients are in particular: hosting and infrastructure providers, service providers for retrieving public platform data, payout service providers, providers of AI and research services, payment processors (merchant of record), email delivery providers, communication and collaboration tools for internal workflows, and analytics and marketing providers. Where these service providers process data on our behalf, data processing agreements pursuant to Art. 28 GDPR are in place.

16. Transfers to Third Countries

Where we transfer data to countries outside the EU or EEA, this is done on the basis of an adequacy decision of the European Commission (for example, Switzerland; the USA under the EU-U.S. Data Privacy Framework for certified providers) or on the basis of the EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR, supplemented by any necessary additional measures. We provide details for the respective services; we will provide a copy of the safeguards upon request.

17. Data Security

We take appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse, and unauthorized access, and we review them regularly, taking into account the state of the art, the costs of implementation, and the nature, scope, and purposes of the processing. Data transmitted between your browser and our website or the service is encrypted (TLS).

To protect the service and its users against attacks, misuse, and fraud, for example unauthorized access, automated extraction, multiple or shared accounts, or manipulated metrics, we evaluate account, usage, and log data as well as payment and payout details available to us, and may review accounts that recognizably belong together. The legal basis is Art. 6 (1)(f) GDPR; our legitimate interest lies in the security and integrity of the service and in preventing fraud. Measures such as blocking an account are decided by a person.

18. Your Rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR, see Section 19)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal message to hello@viral.app is sufficient to exercise your rights. If your request concerns data that we process on behalf of a customer (Section 7), we will forward it to the respective customer. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the authority responsible for us is the Thuringian State Commissioner for Data Protection and Freedom of Information (Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit), Postfach 900455, 99107 Erfurt, Germany.

19. Right to Object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6 (1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims. You can object to processing for direct marketing purposes at any time without giving reasons.

20. Information for Specific Countries

United States

We do not sell personal data for money. Under the privacy laws of some US states, our ad pixels and our server-side conversion reporting (Section 4) may count as "sharing" personal data for cross-context behavioral advertising or as processing for targeted advertising. You can opt out under "Your privacy choices", which you find under "Privacy" in the footer of our website, or by sending the Global Privacy Control signal, which we honor; this switches off the ad pixels and ad click cookies in that browser. To also stop the server-side reporting about your account, write to hello@viral.app. You can also ask us at hello@viral.app to tell you which personal data we hold about you, and to delete or correct it. We will not discriminate against you for exercising these rights.

Brazil

If the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, LGPD) applies to the processing of your data, you have the rights under Art. 18 LGPD, in particular confirmation of the processing, access, correction, anonymization, blocking or deletion, portability, information about the entities with which we share data and about the option to refuse consent, and withdrawal of consent. To exercise them, write to hello@viral.app. In Brazil, Analytics, Marketing, and External media run only with your consent (Section 3). You can also lodge a complaint with the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

United Kingdom

If you are in the United Kingdom, the UK GDPR applies to our processing of your data alongside the GDPR, and you have the rights described in Section 18 under it as well. You can lodge a complaint with the Information Commissioner's Office (ICO).

Switzerland

If you are in Switzerland, the revised Swiss Federal Act on Data Protection (revFADP) applies alongside the GDPR, and you have corresponding rights under it, in particular the right of access. You can turn to the Federal Data Protection and Information Commissioner (FDPIC).

21. Changes to This Privacy Policy

We update this Privacy Policy when the legal situation, the service, or the data processing changes. The current version is always available on our website; we also inform registered users of material changes by email.