Privacy Policy

"ViralGenie", "we" and "us" means the ViralGenie service and the company that operates it, acting as the data controller for the personal data described here. This policy covers our website, app, and services. External sites we link to have their own policies.

We are a United States service and this policy is written to US law first — including state privacy laws such as the California Consumer Privacy Act (CCPA). If you use the service from the UK or EU, we honor the rights the UK/EU GDPR gives you, as described in section 8.

• Account details — email address and a securely hashed password, or the basic profile Google returns if you sign in with Google. We never see your Google password.
• What you make — briefs, scripts, narration, footage selections, timelines, rendered videos, and channel settings.
• Billing details — plan, credit balance, and payment history. Card numbers go directly to our payment provider (Whop) and never touch our servers.
• Technical data — IP address, browser and device type, timestamps, and error traces.
• Support and beta communications — messages you send us, and waitlist or beta-programme signups.

We do not ask for, and you should not submit, sensitive personal data (health, biometrics, precise location, data about children) — the service does not need it.

Directly from you (signup, briefs, settings, support messages); automatically as you use the service (technical logs, usage events); and from third parties you connect — Google when you sign in with Google, and Whop for payment status.

• To provide the service — producing your videos, running your account, processing payments. Basis: performing our contract with you.
• To keep the service safe — abuse prevention, security monitoring, debugging. Basis: legitimate interests.
• To improve production — aggregate analysis of render times, failure points, and feature use. Basis: legitimate interests.
• To communicate with you — service notices always; product updates only with your consent, and you can opt out any time. Basis: contract / consent.
• To comply with law — tax, accounting, and lawful requests. Basis: legal obligation.

Producing a video means sending parts of your brief to specialist processors, each receiving only what its job needs, under contracts that restrict their use of it:

• Supabase — accounts, database, file storage.
• Vercel — hosting and delivery.
• Anthropic and OpenAI — research, scripting, creative direction.
• ElevenLabs — narration and sound effects.
• fal.ai — generated imagery.
• Storyblocks, Pexels and Pixabay — stock footage.
• Serper — web research lookups.
• Google — sign-in, if you choose it.
• Whop — checkout, subscriptions and payments.

Beyond processors: professional advisers under confidentiality; authorities where the law requires or to protect people from harm; and a buyer or successor if the business is sold, with notice to you. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

Your private inputs — briefs, scripts you paste, uploads, and channel data — are not used to train models, ours or anyone else's. Providers process them only to return a result; where a provider offers a no-training setting for business use, we use it.

Produced videos (Outputs) may be used to train and improve our own systems — that is how every video makes the next one better. Outputs are never sold or shared for advertising, and this is covered by the license in our Terms, section 8.

We use only the cookies needed to sign you in, keep your session secure, and remember your settings — strictly-necessary and functional cookies. We do not use advertising trackers or cross-site analytics cookies. Because there is nothing optional to consent to, there is no cookie banner; if that changes, a consent choice will appear first.

You can ask us to: access the personal data we hold about you; correct it; delete it; give you a copy in a portable format; restrict or object to certain processing; and withdraw consent where processing rests on consent. US state laws add the right to know, delete, and correct, and the right not to be discriminated against for exercising them — and since we do not sell or share data for behavioral advertising, there is nothing to opt out of.

Email privacy@viralgenie.com and we will action it — no forms. We may need to verify you own the account first. California residents may also designate an authorized agent. If you are in the UK or EU and are unhappy with our answer, you can complain to your data-protection regulator — though we would appreciate the chance to resolve it first.

We and our providers operate primarily in the United States, and your data is processed there. If you use the service from outside the US — for example the UK or EU — your data is transferred to the US under recognized safeguards such as standard contractual clauses with our processors.

• Account, content and channel data: while your account is open, then deleted within 30 days of account deletion.
• Billing records: kept as long as tax and accounting law requires.
• Technical logs: rotated on a short cycle, typically within 90 days.
• Backups: age out on their own schedule shortly after deletion from live systems.

Data is encrypted in transit and at rest with our providers; access is limited to people who need it; keys and credentials are stored outside the codebase. No service is perfectly secure — if a breach affects your data, we will notify you and the relevant authorities promptly, as the law requires.

ViralGenie is not directed at children under 13 and we do not knowingly collect their data. If you believe a child's data has reached us, email us and we will delete it.

Material changes to this policy will move the date at the top and be notified to account holders by email or in the service. Privacy questions and rights requests: privacy@viralgenie.com. See also our Terms of Service.