Privacy Policy

1. Introduction

Viralytics (“we”, “us”, “our”) operates getviralytics.com and the Viralytics analytics platform. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and what rights you have regarding your personal data.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Viralytics Service
• Send transactional emails, including payment receipts, sync notifications, and weekly analytics reports
• Analyze usage patterns and user behavior in aggregate to understand what features work well and where we should invest in improvements
• Respond to support requests and communicate with you about your account
• Detect, investigate, and prevent fraudulent activity, abuse, or violations of our Terms of Service
• Comply with applicable legal obligations

We do not sell your personal data. We do not use your data for advertising targeting, and we do not share your data with third parties for their own marketing purposes.

4. Third-Party Services

We work with the following trusted third-party providers to operate the Service. Each provider handles data in accordance with their own privacy policies:

5. Data Retention

We retain your account data and associated creator tracking data for as long as your account is active. If you close your account or request deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal, compliance, or fraud prevention purposes.

You may request deletion of your data at any time by contacting us at privacy@getviralytics.com. How we protect your data, including the access tokens for accounts you connect, is described in Data Security below.

6. Cookies

We use essential cookies to operate the Service. These cookies are required for authentication (keeping you logged in) and session management. Without them, the Service cannot function correctly.

We do not use advertising cookies, tracking pixels, or any third-party analytics cookies that follow you across the web. We do not participate in cross-site tracking or behavioral advertising networks.

7. Your Rights (GDPR)

If you are located in the European Union or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (“right to be forgotten”)
• Right to data portability — request an export of your data in a machine-readable format
• Right to restrict processing — request that we limit how we use your data in certain circumstances
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, please contact us at privacy@getviralytics.com. We will respond to your request within 30 days.

8. Children's Privacy

Viralytics is a professional SaaS platform not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will promptly delete that information.

If you believe we may have collected information from a child under 16, please contact us at privacy@getviralytics.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For material changes — those that significantly affect how we handle your data — we will notify you by email using the address associated with your account.

We encourage you to review this policy periodically. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

Viralytics Publish (Scheduling & Publishing)

Viralytics also offers Viralytics Publish, a scheduling tool that lets you connect your own social-media accounts and publish your own short-form videos to them. When you use Viralytics Publish, we handle:

• the OAuth access and refresh tokens you authorize through each platform's official login (Instagram Graph API, Facebook Graph API, TikTok Content Posting API, YouTube Data API), used only to publish to the accounts you connect;
• basic account identifiers (user IDs, usernames, open IDs) those platforms return;
• the videos, captions, and metadata you choose to schedule and publish.

We use this data only to publish the content you submit to the accounts you connect, at your direction. Tokens are encrypted at rest by our database provider and can be read only by our server-side code; uploaded videos are kept as described in Data Security. You can revoke our access to any account at any time from that platform's own settings, and we delete the associated token as described below. We do not sell your data, and our use of information received from TikTok and Meta APIs adheres to each platform's developer terms and limited-use requirements.

Instagram Data (Meta Platform Terms)

If you connect an Instagram account to Viralytics Publish, we access a deliberately narrow slice of your Instagram data through Instagram's official API with Instagram Login:

• Your Instagram profile — the Instagram user ID and username of the professional account you connect. We use them to show you which account is connected and to address the publish request to the right account.
• Permission to publish on your behalf — the ability to post the videos and captions you yourself schedule in Viralytics. We never post anything you did not create and schedule.
• An access token — issued by Instagram when you approve the connection. It is stored in our database, encrypted at rest, and readable only by our own server-side publishing code.

Retention. We keep this data only while your Instagram account is connected. When you disconnect the account, or when you request deletion, the stored token is destroyed and the connection record is removed. We do not use Instagram data for advertising or profiling, we do not sell or rent it, and we do not share it with any third party except the infrastructure providers listed above that host our database. Our use of information received from Meta APIs follows Meta's Platform Terms and Developer Policies, including their limited-use requirements.

How to revoke access. Remove Viralytics from Instagram (Instagram app → Settings → Website permissions → Apps and websites). Instagram notifies us and we delete the stored token and stop publishing on that account. You can also email us to disconnect it.

How to request deletion. Use Instagram's data deletion request, which reaches us at getviralytics.com/api/instagram/data-deletion and returns a confirmation code you can check any time at getviralytics.com/instagram-data-deletion. You can also simply email support@getviralytics.com and we will delete the connected account record, the stored access token, and any posts scheduled for that account.

Facebook Pages (Meta Platform Terms)

If you connect a Facebook Page to Viralytics Publish, you log in with Facebook and choose which of the Pages you manage to share with us. Through the Facebook Graph API we access only:

• The list of Pages you shared — each Page's ID, name and profile picture, and your role on it (whether you may create content). We use these to show you which Pages are connected, to let you pick where a video goes, and to skip Pages you are not allowed to post to.
• A Page access token for each Page — issued by Facebook when you approve the connection. It is stored in our database, encrypted at rest, and readable only by our own server-side publishing code. We also store your app-scoped Facebook user ID so we can honour Facebook's removal and deletion requests. We do not store your personal Facebook access token, your friends, your posts, or any other profile information.
• Permission to publish to your Page — used only to post the videos and descriptions you yourself choose on the Post to Facebook page, at the moment you press Publish. We never post anything you did not create and submit.

Retention and sharing. We keep this data only while the Page is connected. When you remove Viralytics from Facebook or request deletion, the stored Page tokens are destroyed and the Page records are removed. We do not sell or rent Facebook data, we do not use it for advertising, profiling or any purpose other than publishing your videos, and we do not share it with any third party except the infrastructure providers listed above that host our database. Our use of information received from Meta APIs follows Meta's Platform Terms and Developer Policies.

How to revoke access. On Facebook, go to Settings & privacy → Settings → Business Integrations (or Apps and Websites) and remove Viralytics Publish. Facebook notifies us at getviralytics.com/api/facebook/deauthorize and we immediately revoke the stored Page tokens and stop publishing to those Pages.

How to request deletion. When you remove the app, Facebook lets you send a data deletion request, which reaches us at getviralytics.com/api/facebook/data-deletion. We delete the connected Page records and their tokens and give you a confirmation code you can check at getviralytics.com/facebook-data-deletion, which also explains these steps. You can also simply email support@getviralytics.com and we will delete your Facebook Page connections within 30 days.

YouTube and Google User Data

Viralytics Publish uses YouTube API Services to let you connect your own YouTube channel and upload videos to it. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

When you connect a channel, you sign in with Google and approve two permissions. Here is what we access and why:

• Your channel's basic details (read-only access, youtube.readonly) — your channel ID, channel title, handle and thumbnail picture. We use them only to show you which channel is connected and to send each upload to the right channel. We do not read your watch history, subscriptions, comments, playlists or analytics.
• Uploading videos (youtube.upload) — we upload only the videos you choose on the Post to YouTube page, with the title, description and visibility (public, unlisted or private) you set, and only when you press Publish. We never upload anything you did not submit, and we do not edit or delete videos on your channel.
• OAuth tokens — Google issues an access token and a refresh token when you approve the connection. We store them in our database, access-restricted to our own server-side code, and use them only to upload videos on your behalf when you ask us to. See Data Security for how these tokens are protected.

Sharing and use. We do not sell YouTube or Google user data, we do not use it for advertising, and we do not share it with anyone except the infrastructure providers listed above that host our service and database. Videos you upload are copied to our file storage so they can be transferred to YouTube; how long we keep them is explained in Data Security.

Viralytics' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention. We keep your channel details and tokens only while the channel is connected. If you revoke access in your Google account, the next time our server tries to use the connection Google tells us the access was revoked, and we delete the stored tokens and stop using the channel. When you ask us to delete your data, we delete the connected-channel record and its stored tokens.

How to revoke access. You can remove Viralytics' access to your Google account at any time at myaccount.google.com/permissions. Once revoked, we can no longer upload to your channel.

How to request deletion. Email support@getviralytics.com from the address on your Viralytics account and we will delete your connected YouTube channel record and its stored tokens.

Data Security (How We Protect Sensitive Data)

The most sensitive data we hold is the access to accounts you connect to Viralytics Publish: the OAuth access and refresh tokens issued by Google (YouTube), Instagram, Facebook and TikTok, plus the basic account details those platforms return. We protect this data, and all Google user data, as follows.

• Encryption in transit. Our website and API are served only over HTTPS. Every connection between our servers, our database and the Google, Meta and TikTok APIs is encrypted with TLS.
• Encryption at rest. Tokens and account records are stored in a Postgres database hosted by Supabase, which encrypts all stored data at rest (AES-256). Uploaded video files are stored in Supabase Storage, which is encrypted at rest in the same way.
• Server-side access only. Tokens are read only by our own server-side code, using a secret database key that exists only on our servers (in our hosting provider's encrypted environment settings) and is never sent to your browser. The table that holds tokens has row-level security turned on with no public access rules, so it cannot be read with the keys our web app uses in the browser. Our app never returns tokens to the browser: the screens that list your connected accounts receive only the account name, picture and status. The one exception is TikTok's web posting flow, which keeps your short-lived TikTok access token (valid for under 24 hours) in a secure, HttpOnly cookie in your own browser that page scripts cannot read; disconnecting deletes it.
• Isolation between customers. Every connected account belongs to one workspace, and our server checks that you are a member of that workspace before it uses or lists any account. Other users cannot see or use your connections or tokens.
• Limited staff access. Access to our production database, hosting accounts and admin tools is limited to a small number of authorized team members (the founder and our support staff), and is used only to operate the service and to answer support or deletion requests you send us.
• Minimal permissions. We ask each platform only for the permissions needed to identify the account you connect and publish the videos you choose. For YouTube that is youtube.upload and youtube.readonly, nothing more.
• Token retention and deletion. We keep a token only while the account stays connected. When you remove Viralytics from Instagram or Facebook, the platform notifies us and we delete the stored tokens. When you revoke our access at myaccount.google.com/permissions, Google rejects the token the next time our server uses it, and we delete the stored tokens then. When you send a data deletion request (through Instagram, Facebook, or by email), we delete the connected-account record and its tokens.
• Uploaded videos. To publish a video, we copy it into our file storage so the platform can fetch it. Each file is saved under a randomly generated name inside your workspace's folder, and the folder is not publicly listed; the file can be downloaded by anyone who has its exact link, because Instagram, Facebook and TikTok must be able to fetch it without logging in. We do not yet delete these copies automatically after publishing. Email us and we will delete them, together with the rest of your data, within 30 days.
• No sale or advertising use. We never sell tokens or any data received from Google, Meta or TikTok, never use it for advertising, and never use it for any purpose other than publishing the content you choose.
• If something goes wrong. If we learn of unauthorized access to your data, we will revoke or delete the affected tokens, investigate, and notify affected users and regulators as required by applicable law.

Questions about security, or want your connected accounts and their tokens deleted? Email support@getviralytics.com.

10. Contact

For privacy-related questions, requests, or concerns, please contact us at:

privacy@getviralytics.com