Privacy Policy for ViralGrow

1.Information We Collect

1.1 Personal Data

• Account information: name, email address (collected during sign-up via Google OAuth or email)
• Payment information: handled directly by Polar, our merchant of record. We do not collect or store your card details on our servers — Polar (and its payment processor, Stripe) receives the payment data directly.
• Connected social account data: when you connect your TikTok, Instagram, or YouTube account via OAuth, we receive your username, display name, and an access token to schedule and post content on your behalf. We store these access tokens securely and use them solely to publish content you have approved.

1.2 Content Data

• Product descriptions, images, and other content you provide to generate posts
• AI-generated content (slideshows, videos, captions) created by the Service on your behalf
• Post analytics (views, likes, comments, retention) fetched via the platforms' official APIs

1.3 Usage Data

• Strictly necessary cookies that keep you signed in (see section 5)
• Usage data such as pages visited, setup steps reached, features used, and errors, collected without cookies (see section 5)
• The answers you give while setting up an influencer (for example your app's link or description), saved as you go so you can pick up where you left off and so we can see which steps are unclear

2.How We Use Your Data

• To create and manage your account
• To generate AI-powered content based on your product description
• To schedule and publish content to your connected social accounts
• To fetch and display analytics for your posted content
• To process payments and manage subscriptions (via Polar)
• To improve the Service and develop new features
• To communicate with you about your account and the Service

3.Connected Social Account Integration

When you connect a TikTok, Instagram, or YouTube account:

• We request only the permissions necessary to schedule and publish content and to fetch analytics
• Content is only published to your account when you explicitly approve it or have enabled scheduled publishing
• You can disconnect any account at any time from your dashboard settings
• We do not access your direct messages, follower lists, or any data beyond what is needed for content scheduling and analytics

4.Data Sharing and Sub-processors

We do not sell, trade, or rent your personal information. We share data only with the following categories of sub-processors, each used solely to deliver the Service:

• Polar (merchant of record) and its payment processor Stripe — for billing, subscription management, and tax handling
• TikTok, Meta (Instagram), and Google (YouTube) — via their official APIs, to publish your approved content and fetch analytics
• PostForMe — official-API publishing partner that brokers our integration with the social platforms
• AI service providers (Anthropic, Google Gemini, Replicate) for content generation — only your product description and brand prompt are sent, never your personal data, payment data, or social account credentials
• Supabase — for database and authentication infrastructure
• Hetzner (Germany) — server hosting
• An SMTP relay provider — for transactional email delivery
• As required by law or to protect our legal rights

5.Cookies and Analytics

• We only use cookies that are strictly necessary: the sign-in cookies that keep you logged in, and short-lived cookies used while you connect a social account. We do not use advertising or tracking cookies, and we do not use third-party ad pixels.
• We measure how the Service is used with a self-hosted instance of Umami, an open-source, cookieless analytics tool that we run ourselves. It sets no cookies and stores nothing on your device. Visitors are counted using a hashed value derived from the IP address and browser that changes regularly. We see pages visited, referrers, country, device type, and actions taken in the Service (for example which setup step was reached).
• When you are signed in, these events are linked to your account ID (not your name or email address). Some events are recorded by our servers, for example sign-up, subscription changes, and posts generated or published.
• We use this only to understand where the Service is unclear and to improve it, based on our legitimate interest (GDPR Art. 6(1)(f)). Analytics data is never sold, shared with advertisers, or combined with data from other websites.
• You can object at any time by emailing sam@viralgrow.ai, and we will exclude your account from analytics.
• Analytics data is kept for up to 25 months.

6.Data Retention

• Account data is retained as long as your account is active
• You can request deletion of your account and all associated data by contacting us at sam@viralgrow.ai
• AI-generated content and analytics data are deleted when you delete your account
• Billing records held by Polar may be retained by Polar for the period required by their own privacy policy and applicable tax / financial-reporting law

7.Data Security

We implement reasonable security measures to protect your data, including encrypted storage for access tokens, secure HTTPS connections, and database access controls. However, no method of transmission over the internet is 100% secure.

8.Children's Privacy

ViralGrow is not intended for users under 16. We do not knowingly collect data from children.

9.Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to analytics (see section 5)
• Disconnect your social accounts at any time
• Export your data
• Lodge a complaint with a data protection authority (e.g. the Dutch Autoriteit Persoonsgegevens) if you are an EU resident

10.Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the Service.

11.Contact

For questions about this Privacy Policy, contact us at:
Email: sam@viralgrow.ai