Privacy policy

Account data: your name, email, mobile number and password (stored only as a secure hash) when you sign up, or your Google profile if you use Google sign-in. We verify one of your email or phone with a one-time code.

Unfinished sign-ups: if you submit the sign-up form (and accept the Terms) but don't finish verifying, we keep what you entered for up to 30 days so you can pick up where you left off, then delete it. Nothing you type is stored before you submit the form.

Consent records: when you give or withdraw consent (for example to marketing messages) we record the wording you agreed to, when, and from which IP address and device, as proof.

Brand data: the website you scan and the brand information, images, videos and content you generate or upload.

Connection tokens: the authorization tokens that let us publish to the social accounts you connect.

Conversations with Vee: what you write or say to Vee, our assistant, in the app or on WhatsApp, the files and photos you attach, and Vee's replies, so the chat keeps its history and Vee can act on it.

WhatsApp: if you connect WhatsApp, your WhatsApp number and name, and the messages, voice notes, photos and videos you send Vee there (voice notes are transcribed; photos and videos you send can be added to your library).

Likeness and voice (Digital Twin): only if you choose to create a digital twin or an avatar, the photos, video and voice recording you provide, the avatar built from them and a cloned voice. They are used only to make content for your own business, after your explicit consent, and you can delete them at any time.

Billing data: your subscription and payment status. Payments are processed by our payment provider (Paddle); we do not store your full card details.

Usage and device data: basic logs, IP address and device or browser information needed to operate and secure the service.

Analytics: only if you accept analytics cookies, how you use the site and the app (pages, clicks, and for signed-in users a recording of in-app sessions, linked to your account), to understand and improve the product. If you choose essential cookies only, none of this is collected. See the cookie policy.

To provide the service you request (learn your brand, generate, schedule and publish content): performance of a contract.

To operate, secure, debug and improve the product: our legitimate interests.

To process payments and prevent fraud: contract and legal obligation.

To send service messages about your own account, such as verification codes, receipts, "your posts are ready", publish results and your weekly analytics summary: contract and legitimate interests. You can switch off the optional ones in Account settings or with the link in each message.

To send marketing (tips, product news and offers) by email, SMS or WhatsApp: only with your prior, separate opt-in, which you can withdraw at any time with one click. Marketing messages are labelled as advertising, as required by Israel's Communications Law (section 30A).

If you start signing up but don't finish, we may send you one reminder to complete it, and nothing more unless you opted in to marketing.

We do not sell your personal data, and we do not use your private brand content to train third-party foundation models beyond what is needed to generate your content.

We share data with vetted providers only to deliver the service. Current sub-processors include: Anthropic and OpenAI and Google (Gemini) for AI text and image generation; Replicate and HeyGen for video and avatar generation; ElevenLabs for voiceovers and cloned voices; Cloudinary for media hosting and delivery; Supabase for our database; Render for hosting; Google for sign-in (OAuth); Paddle for billing; Resend for email; Twilio for SMS; Meta (WhatsApp Business Platform) for WhatsApp messages; Cloudflare for bot protection (Turnstile); Zernio for publishing to some social networks; Zyte, Jina and Apify for reading the websites and public social profiles you ask us to scan; Pexels for stock imagery; and, only with your consent to analytics or marketing cookies, PostHog and Microsoft Clarity for product analytics and Google (Analytics, Tag Manager) and Meta (Pixel) for measuring our ads. Each processes data only to perform its function under its own terms.

The social networks you connect (for example Instagram, TikTok, LinkedIn, X, Threads, YouTube, Facebook, Reddit) receive the content and tokens needed to publish on your behalf.

When you connect an Instagram professional account or a Facebook Page, you log in with Instagram or Facebook (Meta) and choose which permissions to grant. We receive only what you grant: the account's ID, username, name, profile picture and follower count; the posts we publish for you and their insights (reach, views, likes, comments, saves); comments on your posts; and direct messages sent to your account.

We use this data only to provide Viralyc to you: to publish and schedule the content you approve, to show you how your posts perform, and to let you read and reply to comments and messages from inside Viralyc. We do not sell it, do not use it for advertising profiles, do not share it with anyone other than the sub-processors above as needed to run the service, and do not use it to train AI models.

Access tokens are stored encrypted. We keep this data while the account stays connected. When you disconnect it in Viralyc, remove Viralyc in your Instagram or Facebook settings (Apps and websites), or your business or account is deleted from Viralyc, we delete the tokens and profile data straight away.

To request deletion of your Instagram or Facebook data: remove Viralyc under Settings → Apps and websites in Instagram or Facebook and choose to send a deletion request (we then show you a confirmation code and a status page), disconnect the account on Viralyc's Connect page, or email [email protected].

Our providers may process data outside your country, including in the United States and the EU. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We keep your data while your account is active and as needed to provide the service. Unfinished sign-ups are deleted after 30 days, and WhatsApp messages waiting to be handled after 14 days.

When you delete content we remove it from active systems. When you delete your account (Account → Your data), we delete your businesses, posts, media, Vee chats and files, digital twins and cloned voices, connected networks, WhatsApp link and your account at once, and cancel your subscription; short-lived database backups expire on a rolling basis.

We keep only what we must: billing records held by Paddle as the law requires, and a one-way hash of the phone number and email that used the free trial, so a free trial stays one per person. The hash can't be turned back into your number or email.

We use industry-standard measures including encryption in transit, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Under the EU/UK GDPR and Israel's Privacy Protection Law you may access, correct, export, restrict or delete your data, and object to certain processing. You can also withdraw consent and lodge a complaint with your local authority.

If you are a California resident, the CCPA/CPRA gives you rights to know, delete, correct and opt out of sale or sharing of personal information. We do not sell personal information.

In Account → Your data you can download a copy of your data (one file) and delete your account and everything in it, at any time. For any other request, email [email protected].

Viralyc is for businesses and is not directed to children under 16. We do not knowingly collect data from children.

We may update this policy; material changes will be posted here with a new date. Questions or requests: [email protected].