Last Updated: 20.10.2026
This Privacy Policy ("Policy") explains how ViralUp ("Company", "we", "our", or "us") collects, uses, and protects personal information from users ("Users") of the ViralUp AI application ("Application").
By downloading, accessing, or using the Application, you agree to the practices described in this Policy.
ViralUp AI is designed to minimize the collection of personal data. The Application may collect the following information:
No sensitive personal information such as identity numbers, payment card details, or precise location data is collected by the Application.
The collected data may be used for the following purposes:
The Application allows users to generate videos using artificial intelligence technologies.
User prompts, generation settings, and related data may be temporarily processed by AI systems to generate requested videos.
This data is used only for processing the requested generation task and improving service performance.
ViralUp AI does not sell user personal data for money and does not rent it.
We use Meta advertising tools (the Meta Pixel and the Meta Conversions API) to measure our ads. Under some US state privacy laws, such as the California Consumer Privacy Act, disclosing identifiers and website activity to an advertising partner for this purpose can count as "sharing" personal information for cross-context behavioral advertising, or as "selling" or "targeted advertising" in some states. You can opt out at any time, as described in "Your US Privacy Choices" in Section 8.
User data may also be shared in the following circumstances:
The Application relies on the following sub-processors to function. Each is listed with its purpose, hosting region, and the safeguard relied on for international transfers where applicable. ViralUp maintains a Data Processing Addendum (DPA) on file with each named processor or relies on the processor's standard Terms of Service where a DPA is not separately negotiated (as noted).
When a user opts in (Section 6) ViralUp also interacts with YouTube (Google LLC), TikTok for Developers, and Meta Graph API (Instagram and Facebook) on behalf of the user. These are not sub-processors of ViralUp in the GDPR sense, but data controllers in their own right. See Section 6 for the OAuth-scoped data ViralUp accesses on the user's behalf.
All sub-processors operate under their own privacy policies. ViralUp maintains a Data Processor Register (see docs/processors-registry.md in our public repository) and updates this list when a sub-processor is added, replaced, or retired. Material changes are surfaced via the "Last Updated" date at the top of this page.
ViralUp lets users optionally connect their own social media accounts (YouTube, TikTok, Instagram, Facebook) so that AI-generated videos can be published to those channels on the user's behalf. Connection is initiated by the user via OAuth and can be revoked at any time.
ViralUp's use of information received from YouTube APIs, and any other Google APIs, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When a user connects a YouTube channel, ViralUp accesses:
YouTube user data accessed through this integration is used only to display connected-channel information, to upload user-initiated content, and to show the user performance insights for their own content. ViralUp does not:
Storage and retention: OAuth refresh tokens for connected YouTube channels are stored encrypted at rest (AES-256-GCM) in our database. They are used to refresh access tokens for uploading videos the user has scheduled in ViralUp and for fetching performance insights for the user's own content. ViralUp stores YouTube authorization tokens only for as long as your YouTube account remains connected and in active use. On an in-app Disconnect, ViralUp attempts programmatic Google revocation immediately and deletes the local authorized data as soon as possible and within 7 calendar days. During that seven-day retry window, an unconfirmed provider grant remains fenced and reported; at the local deadline, credential fields are deleted and any unconfirmed provider outcome is recorded as credential-free orphan evidence. A user-requested ViralUp account deletion follows the same seven-calendar-day local-data deadline. Revocation through Google security settings, or any authorization that becomes unrefreshable, is detected and deleted as soon as possible and within 30 calendar days. The separate idle-consent cleanup remains at 180 days without genuine use.
How to revoke access: Users can revoke ViralUp's access to their YouTube channel at any time via the Google Permissions page or the "Disconnect" button on the ViralUp Connect Socials screen (account menu or sidebar). Google-setting revocation is detected by the next refresh attempt and follows the 30-day unrefreshable-grant deadline; in-app Disconnect starts immediate programmatic revocation and follows the seven-day local-data deadline. Videos already uploaded to YouTube are not affected and remain owned by the user on their channel.
Use of the YouTube integration is additionally subject to the YouTube Terms of Service. In addition to ViralUp's own privacy practices, Google's handling of your data is governed by the Google Privacy Policy.
When a user connects a TikTok account, ViralUp accesses the user's display name and avatar (for dashboard display), the permission to publish videos on the user's behalf, and read-only access to the account's public statistics (follower, like, and video counts) and video list (per-video view, like, comment, and share counts) to show performance insights (scopes: user.info.basic, user.info.stats, video.publish, video.upload, video.list). OAuth tokens are stored encrypted at rest. Revoke access via TikTok account settings or the "Disconnect" button in ViralUp.
When a user connects an Instagram Professional account through Instagram Login, ViralUp accesses its username and avatar plus permission to publish content on the user's behalf. During Meta App Review, a strict ViralUp administrator may explicitly connect or reconnect a designated test account with the additional Insights permission to display that account's profile, media, audience, and performance data in the owner dashboard. Ordinary users' Instagram analytics are not requested until that feature is approved and publicly activated. After activation, an existing user must explicitly reconnect the same account before ViralUp requests the additional analytics permission. OAuth tokens are stored encrypted at rest. Revoke access via Instagram or the "Disconnect" button in ViralUp.
When a user connects a Facebook Page, ViralUp accesses the Page identity and the permissions needed to publish content on the user's behalf. During Meta App Review, a strict ViralUp administrator may explicitly connect or reconnect a designated test Page through a separate Login for Business configuration that requests Page Insights permissions. Ordinary users' Facebook analytics are not requested until that feature is approved and publicly activated. After activation, an existing user must explicitly reconnect the same Page before ViralUp requests the additional analytics permissions. OAuth tokens are stored encrypted at rest. Revoke access via Meta Business Settings or the "Disconnect" button in ViralUp.
Personal data is retained only as long as necessary to provide the services of the Application.
If a user deletes their account or requests deletion, associated personal data will be removed unless retention is required by law.
Generated AI content may be stored temporarily for processing and service improvement.
Users have the following rights regarding their personal data:
Your right to erasure (GDPR Article 17): You can request the deletion of your account and associated personal data by clicking "Delete account" in Settings. Your account is marked for deletion immediately, with a 7-day undo window. Any active subscription is set to cancel and is terminated when the deletion executes. Account deletion does not itself request a refund. Any refund request already open is resolved under the Refund Policy before destructive deletion begins; remaining paid time is otherwise not refunded. After the grace period, we automatically delete your data from Firebase Authentication, our databases and file storage, revoke the access our app holds to any connected social accounts, and delete your product analytics profile (PostHog). Measurement signals shared with our advertising partners (Meta, and TikTok until 01.10.2026) consist of hashed event data only; we do not upload audience lists, and once transmitted these platforms process that data as independent data controllers under their own terms, so you can also exercise your rights directly with them. Our web analytics (Google Analytics) and error telemetry (Sentry) are configured without names, email addresses, or other direct identifiers (a pseudonymous ID only) and are deleted automatically at the end of their retention windows. If you submit an explicit personal data erasure request (in addition to, or instead of, routine account deletion), we will also forward corresponding deletion requests to these platforms on your behalf. Billing records at our payment providers are retained in anonymized form for tax-law compliance per GDPR Article 17(3)(e); transactional email delivery logs are retained by our email sub-processor under its data-processing agreement. Total SLA: 30 days from your request per GDPR Article 12(3).
Residents of certain US states, including California, have the right to know what personal information we collect, to access, correct, and delete it, and to opt out of the sale or sharing of personal information and of targeted advertising. We do not knowingly sell or share the personal information of consumers under 16.
Do Not Sell or Share My Personal Information: You can opt out on our Privacy Choices page. If you are signed in, we save your choice to your account so it also applies to events we send from our servers.
Global Privacy Control: We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale and sharing for that browser, and for your account when you are signed in.
When you opt out, we send purchase and other measurement events to Meta only with Meta's Limited Data Use setting, which restricts how Meta may use that data. We will not discriminate against you for exercising these rights. You may use an authorized agent, and we may verify a request by email. We respond to requests within 45 days.
Users may also exercise these rights by contacting: contact@viralup.ai
ViralUp uses commercially reasonable security measures to protect user data. However, no method of transmission or storage over the internet can be guaranteed to be completely secure.
Users acknowledge this risk when using the Application.
ViralUp AI is not intended for individuals under the age of 13.
We do not knowingly collect personal information from children under 13. If such data is discovered, it will be deleted promptly.
This Privacy Policy may be updated periodically to reflect changes in the Application or legal requirements.
Updates will be published within the Application or on the relevant distribution platform.
Continued use of the Application after updates constitutes acceptance of the revised Policy.
For any questions regarding this Privacy Policy, please contact:
ViralUp
Email: contact@viralup.ai