Legal
Privacy policy
How Viralix handles personal data. Last updated 22 October 2026.
This document describes how Viralix works today. It is a draft for the operator's legal review before launch and is not legal advice.
Viralix helps businesses and creators plan, publish, answer and measure their social media. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it and what choices you have. "We", "us" and "Viralix" mean the operator of the Viralix service at viralix.art. You can reach us at support@viralix.art.
1. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, email address, a hashed password (or your Google account identifier if you sign in with Google), time zone, role in a workspace | You |
| Connected account data | Access tokens (stored encrypted), profile name, handle and picture, the posts we publish for you, comments and messages you receive, performance metrics and audience statistics the platform provides | Facebook, Instagram, YouTube and TikTok, within the permissions you approve |
| Content you add | Images and videos, captions, hashtags, notes, ideas, labels and settings | You and your teammates |
| People who contact you | The name, handle, platform identifier and messages of people who comment on or message your connected accounts, and any tags or notes you add | The platforms, because you connected the account |
| Usage and security data | IP address, browser type, session records, request and error logs, audit entries of actions taken in a workspace | Your device and our servers |
| Communications | Emails you send us and the service emails we send you (verification codes, invitations, notifications) | You and us |
We do not collect your social media passwords. You sign in on the platform's own page and the platform gives us a token that allows only the actions you approved.
2. Why we use it, and our legal bases
- To provide the service you asked for: publishing and scheduling content, showing your inbox, running the automations you set up, showing analytics, sending notifications. Basis: performing our contract with you.
- To keep the service secure and working: preventing abuse, investigating errors, rate limiting, keeping an audit trail. Basis: our legitimate interest in running a safe service.
- To communicate with you: service emails, replies to support requests and notices about changes. Basis: contract and legitimate interest.
- To meet legal obligations, such as responding to lawful requests. Basis: legal obligation.
We do not sell personal data, we do not use it for advertising, and we do not use platform data to train machine learning models without your explicit opt-in.
3. Data from Meta, Google and TikTok
Data we receive from Facebook, Instagram, YouTube and TikTok is used only to provide the features you use, under each platform's developer terms. It is not used for any other purpose and is not transferred to anyone except as described in this policy.
- Google and YouTube. Viralix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By using Viralix to access YouTube you also agree to the YouTube Terms of Service, and the Google Privacy Policy applies to data Google handles. YouTube data is refreshed or deleted at least every 30 days. You can revoke Viralix's access at any time in your Google account permissions.
- Meta (Facebook and Instagram). We use the data only for the features you use and delete it when you disconnect the account and choose to delete its data, or when you remove Viralix in Facebook or Instagram settings. See data deletion.
- TikTok. We use the data only to send your content to TikTok and show your results. You can remove Viralix from your TikTok account settings at any time.
4. Who we share it with
- Service providers (sub-processors) that host or help run Viralix, under contracts that limit them to our instructions. They are listed on the sub-processors page.
- The platforms you connect, because publishing a post or sending a reply means sending it to that platform.
- Your teammates, according to the roles you give them in a workspace.
- Authorities, only when we are legally required to and, where allowed, after telling you.
- A successor, if Viralix is merged or sold, with the same protections for your data.
5. International transfers
Our providers operate in several countries, so your data may be processed outside the country where you live. For example, our database is hosted in Tokyo, Japan. Where required, we rely on appropriate safeguards such as standard contractual clauses.
6. How long we keep it
| Data | Retention |
|---|---|
| Account, workspace, posts and publications | For the life of the account or workspace |
| Inbox messages | Up to 2 years, or until you disconnect a channel and choose to delete its data |
| Daily analytics | Up to the history limit of your plan (at most 730 days) |
| Automation run logs | 30 days |
| Raw webhook events | 7 days |
| Activity log | 1 year (security audit log 2 years) |
| YouTube API data | Refreshed or deleted within 30 days |
| Deleted workspaces | Soft-deleted for 30 days, then purged |
When you delete your account, access tokens are removed immediately, other personal data is purged within 30 days, and backups age out within 35 days.
7. Security
We protect data with encryption in transit, encryption of platform access tokens at rest, tenant separation and role-based access. Read more on the security page. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.
8. Your rights
Depending on where you live, you may have the right to access, correct, export and delete your personal data, to restrict or object to some processing, to withdraw consent you gave, and to complain to your data protection authority. You can do most of this yourself in Settings. For anything else, email support@viralix.art from the address on your account; we may ask you to confirm your identity and we respond within 30 days. We do not discriminate against you for using these rights. We do not "sell" or "share" personal data as those terms are used in US state privacy laws.
9. Cookies
We use only the cookies needed to keep you signed in and protect your session. We do not use advertising or analytics cookies. Details are in the cookie policy.
10. Children
Viralix is for professional use and is not directed to anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
If we make a material change we will tell you by email or in the app before it takes effect. The date at the top shows when this policy was last updated.
12. Contact
Viralix, support@viralix.art.