Privacy Policy

1. Data We Collect

ViralUp AI is designed to minimize the collection of personal data. The Application may collect the following information:

Account Information

• Email address (if the user creates an account)

User Generated Content

• Text prompts entered by users
• Video generation settings
• Content generated through the AI video generation features

Technical Information

• Device type
• Operating system version
• App performance data
• Crash reports

No sensitive personal information such as identity numbers, payment card details, or precise location data is collected by the Application.

2. How We Use Collected Data

The collected data may be used for the following purposes:

• Creating and managing user accounts
• Generating AI videos based on user prompts
• Improving AI model performance and application features
• Analyzing app performance and fixing technical issues
• Providing user support
• Preventing abuse, fraud, or misuse of the Application

3. AI Processing

The Application allows users to generate videos using artificial intelligence technologies.

User prompts, generation settings, and related data may be temporarily processed by AI systems to generate requested videos.

This data is used only for processing the requested generation task and improving service performance.

4. Data Sharing

ViralUp AI does not sell or rent user personal data.

User data may be shared only in the following circumstances:

• With trusted third-party service providers required to operate the Application (such as cloud infrastructure or AI processing services)
• When required to comply with legal obligations or law enforcement requests
• To protect the security and integrity of the Application or its users

5. Third Party Services (Sub-Processors)

The Application relies on the following sub-processors to function. Each is listed with its purpose, hosting region, and the safeguard relied on for international transfers where applicable. ViralUp maintains a Data Processing Addendum (DPA) on file with each named processor or relies on the processor's standard Terms of Service where a DPA is not separately negotiated (as noted).

Hosting and Infrastructure

• Vercel Inc. (USA) - Application hosting, edge network, CDN, serverless functions. Processes IP address, User-Agent, request payloads, server logs. Safeguard: Standard Contractual Clauses (SCCs); Vercel DPA on file.
• Google Cloud / Firebase (USA, EU multi-region) - Authentication, Firestore database, Cloud Storage, Cloud Functions. Processes account credentials, user profile data, application state, video assets. Safeguard: SCCs; Google Cloud DPA on file.

Payments and Billing

• LemonSqueezy (Paddle Inc.) (USA, merchant of record) - Subscription billing, payment processing, tax handling, refunds. Processes payment method, billing address, transaction history, customer email. Safeguard: SCCs; LemonSqueezy DPA on file.

Analytics and Attribution

• PostHog Inc. (EU region: eu.i.posthog.com) - Product analytics, session replay, feature flags. Processes user actions, page views, device fingerprint (anonymized), hashed identifiers. Safeguard: EU data residency; PostHog DPA on file.
• Google Analytics 4 (Google LLC) (USA) - Web analytics, conversion attribution. Processes IP address (truncated), client identifiers, conversion events. Safeguard: SCCs; Google Ads Data Processing Terms on file. Consent-gated per Consent Mode v2 for EU/EEA/UK/CH visitors.
• Meta Platforms (Facebook Pixel + Conversions API) (USA / EU mixed) - Conversion tracking, lookalike audience seeding for Meta ads. Processes hashed email, client identifiers (fbp/fbc cookies), conversion events. Safeguard: SCCs; Meta Business Tools Terms of Service. Consent-gated for EU/EEA/UK/CH visitors.
• TikTok (ByteDance Ltd. - Pixel + Events API) (USA / Singapore / Ireland) - Conversion tracking, lookalike audience seeding for TikTok ads. Processes hashed email, client identifiers (ttp/ttclid), conversion events. Safeguard: SCCs; TikTok Business Tools Terms of Service. Consent-gated for EU/EEA/UK/CH visitors.

Observability and Operations

• Sentry (Functional Software Inc.) (EU region: de.sentry.io) - Error tracking, performance monitoring, optional error-linked session replay. Processes error stack traces, user uid (no email), browser metadata. Safeguard: EU data residency; Sentry DPA on file.
• Resend Inc. (USA) - Transactional email delivery (verification, receipts, dunning, lifecycle). Processes email address, subject, body. Safeguard: SCCs; Resend DPA on file.
• Slack Technologies (Salesforce Inc.) (USA) - Internal operations alerting (refund alerts, error noise, user feedback notifications). Processes only internal context payloads; never user-identifying free-text fields. Safeguard: SCCs; Salesforce DPA on file.

AI and Video Generation

• OpenAI L.L.C. (USA) - Text generation, script processing for video concept synthesis. Processes prompts (user-supplied content), generated text outputs. Safeguard: SCCs; OpenAI Enterprise DPA on file. OpenAI does not train on API data per their policy.
• Google AI (Gemini) (USA) - Image generation, multi-modal AI processing. Processes prompts (user-supplied content), generated image outputs. Safeguard: SCCs; Google Cloud Vertex AI DPA on file. Gemini API does not train on customer data per Google policy.
• ElevenLabs Inc. (USA) - Voice generation (text-to-speech). Processes text prompts and voice IDs. Generated audio is returned to ViralUp; ElevenLabs retains usage logs per their privacy policy. Safeguard: SCCs; ElevenLabs DPA on file.
• Kling AI (Kuaishou Technology Co., Ltd.) (China) - AI video generation (the core scene-rendering pipeline). Processes text prompts, reference images (user-uploaded or sample-content), returns generated video. Hosted in China. EU users: data is transferred to China; safeguard relies on Kling AI's standard terms (no SCC-equivalent available). ViralUp does NOT send user-identifying fields (no email, uid, or account context) to Kling AI; only the prompt + image payload. See Section 4 for the lawful basis (legitimate interest in providing the requested service). Users who object can disable video generation by not invoking the create or preview flow.
• ZapCap Ltd. (UK) - Automated caption generation for generated videos. Processes audio track and returns SRT/VTT caption file. Safeguard: UK GDPR adequacy decision (no SCCs required for UK transfers); ZapCap standard terms.
• Fal AI (fal.ai) (USA) - Auxiliary AI processing pipeline. Processes prompts and reference assets. Safeguard: SCCs; Fal AI standard terms.

Connected Platform APIs (user-initiated)

When a user opts in (Section 6) ViralUp also interacts with YouTube (Google LLC), TikTok for Developers, and Meta Graph API (Instagram) on behalf of the user. These are not sub-processors of ViralUp in the GDPR sense, but data controllers in their own right. See Section 6 for the OAuth-scoped data ViralUp accesses on the user's behalf.

All sub-processors operate under their own privacy policies. ViralUp maintains a Data Processor Register (see docs/processors-registry.md in our public repository) and updates this list when a sub-processor is added, replaced, or retired. Material changes are surfaced via the "Last Updated" date at the top of this page.

6. Connected Social Media Accounts (YouTube, TikTok, Instagram)

ViralUp lets users optionally connect their own social media accounts (YouTube, TikTok, Instagram) so that AI-generated videos can be published to those channels on the user's behalf. Connection is initiated by the user via OAuth and can be revoked at any time.

YouTube

ViralUp's use of information received from YouTube APIs, and any other Google APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When a user connects a YouTube channel, ViralUp accesses:

• The channel ID, channel title, and channel avatar (used only to display the connected channel in the ViralUp dashboard).
• Permission to upload videos to the connected channel as YouTube Shorts on the user's behalf.
• Read-only access to the channel's public statistics (subscriber, view, and video counts) and the channel's video list with per-video view, like, and comment counts, used to show the user performance insights for their own content.

YouTube user data accessed through this integration is used only to display connected-channel information, to upload user-initiated content, and to show the user performance insights for their own content. ViralUp does not:

• Transfer YouTube user data to third parties except as required to provide the service to the user who connected the channel.
• Use YouTube user data for advertising or behavioral targeting.
• Allow humans to read YouTube user data except for security or abuse investigation, support requests, or legal compliance.

Storage and retention: OAuth refresh tokens for connected YouTube channels are stored encrypted at rest (AES-256-GCM) in our database. They are used to refresh access tokens for uploading videos the user has scheduled in ViralUp and for fetching performance insights for the user's own content. ViralUp stores YouTube authorization tokens only for as long as your YouTube account remains connected and in active use. Tokens are deleted immediately when you disconnect your YouTube account or delete your ViralUp account, and are automatically revoked and deleted after 180 days without use.

How to revoke access: Users can revoke ViralUp's access to their YouTube channel at any time via the Google Permissions page or the "Disconnect" button on the ViralUp Settings > Social Accounts page. Upon revocation, ViralUp deletes the stored access tokens and channel metadata. Videos already uploaded to YouTube are not affected and remain owned by the user on their channel.

Use of the YouTube integration is additionally subject to the YouTube Terms of Service. In addition to ViralUp's own privacy practices, Google's handling of your data is governed by the Google Privacy Policy.

TikTok

When a user connects a TikTok account, ViralUp accesses the user's display name and avatar (for dashboard display), the permission to publish videos on the user's behalf, and read-only access to the account's public statistics (follower, like, and video counts) and video list (per-video view, like, comment, and share counts) to show performance insights (scopes: user.info.basic, user.info.stats, video.publish, video.upload, video.list). OAuth tokens are stored encrypted at rest. Revoke access via TikTok account settings or the "Disconnect" button in ViralUp.

Instagram

When a user connects an Instagram account (Business or Creator account, linked to a Facebook Page), ViralUp accesses the linked Instagram username, avatar, and the permission to publish content on the user's behalf via the Meta Graph API. OAuth tokens are stored encrypted at rest. Revoke access via Meta Business Settings or the "Disconnect" button in ViralUp.

7. Data Retention

Personal data is retained only as long as necessary to provide the services of the Application.

If a user deletes their account or requests deletion, associated personal data will be removed unless retention is required by law.

Generated AI content may be stored temporarily for processing and service improvement.

8. User Rights

Users have the following rights regarding their personal data:

• Right of Access – Request information about collected data
• Right of Correction – Request corrections to inaccurate data
• Right of Deletion – Request deletion of personal data

Your right to erasure (GDPR Article 17): You can request the deletion of your account and associated personal data by clicking "Delete account" in Settings. Your account is marked for deletion immediately, with a 7-day undo window. Any active subscription is set to cancel and is terminated when the deletion executes; remaining paid time is not refunded. After the grace period, we automatically delete your data from Firebase Authentication, our databases and file storage, revoke the access our app holds to any connected social accounts, and delete your product analytics profile (PostHog). Measurement signals shared with our advertising partners (Meta, TikTok) consist of hashed event data only; we do not upload audience lists, and once transmitted these platforms process that data as independent data controllers under their own terms, so you can also exercise your rights directly with them. Our web analytics (Google Analytics) and error telemetry (Sentry) are configured without names, email addresses, or other direct identifiers (a pseudonymous ID only) and are deleted automatically at the end of their retention windows. If you submit an explicit personal data erasure request (in addition to, or instead of, routine account deletion), we will also forward corresponding deletion requests to these platforms on your behalf. Billing records at our payment providers are retained in anonymized form for tax-law compliance per GDPR Article 17(3)(e); transactional email delivery logs are retained by our email sub-processor under its data-processing agreement. Total SLA: 30 days from your request per GDPR Article 12(3).

Users may also exercise these rights by contacting: contact@viralup.ai

9. Data Security

ViralUp uses commercially reasonable security measures to protect user data. However, no method of transmission or storage over the internet can be guaranteed to be completely secure.

Users acknowledge this risk when using the Application.

10. Children's Privacy

ViralUp AI is not intended for individuals under the age of 13.

We do not knowingly collect personal information from children under 13. If such data is discovered, it will be deleted promptly.

11. Policy Updates

This Privacy Policy may be updated periodically to reflect changes in the Application or legal requirements.

Updates will be published within the Application or on the relevant distribution platform.

Continued use of the Application after updates constitutes acceptance of the revised Policy.

12. Contact Information

For any questions regarding this Privacy Policy, please contact:

ViralUp
Email: contact@viralup.ai