Privacy Policy

1. Information We Collect

1.1 Account Information

When you create a Viraly account, we collect your name, email address, and authentication credentials. If you sign in via a third-party provider (e.g. Google), we receive the profile information permitted by that provider.

1.2 Workspace & Brand Data

To deliver our Service, we store data you provide about your company: company name, brand name, website URL, logo URL, tagline, brand colors, fonts, tone of voice, and any content you create, schedule, or publish via Viraly.

1.3 Social Account Credentials

When you connect a social media account (e.g. X/Twitter, LinkedIn, Instagram), we store the OAuth tokens required to publish on your behalf. We access only the permissions you explicitly grant and never read your personal messages or followers.

1.4 Media & Content

Images and videos you upload to Viraly are stored securely in Amazon S3 in the EU (Ireland) region and served via CloudFront CDN. We do not use your content for training AI models.

1.5 Usage & Technical Data

We automatically collect IP addresses, browser type, device information, pages visited, features used, and session duration to improve the platform and ensure security.

1.6 AI Interaction Data

Messages exchanged with the Viraly AI Agent are stored to maintain conversation history within your workspace. This data is not shared with third parties and is not used to train third-party AI models.

2. How We Use Your Information

• Provide, operate, and improve the Viraly platform
• Generate AI-powered content, content plans, and image suggestions
• Publish social media posts on your behalf via connected accounts
• Scan your website to extract brand signals (logo, colors, fonts, tone)
• Send transactional notifications (billing, account, service updates)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal and regulatory obligations

We do not sell, rent, or trade your personal data to any third party. We do not use your data for advertising purposes.

3. Data Sharing & Disclosure

3.1 Service Providers (Sub-processors)

We work with trusted third-party providers who process data strictly on our behalf and under our instructions. These include: Amazon Web Services (cloud hosting, Ireland EU region), Supabase (database infrastructure), OpenAI (AI content generation), and Stripe (payment processing). All providers are bound by data processing agreements and GDPR-compliant transfer mechanisms.

3.2 Social Platforms

Content you schedule for publishing is transmitted to the respective social media platforms (X, LinkedIn, Instagram) via their official APIs on your explicit instruction.

3.3 Legal Requirements

We may disclose data when required by law, court order, or to protect the rights and safety of Viraly and its users.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, with advance notice provided.

4. Data Storage & Security

All data is stored in the European Union (AWS eu-west-1, Ireland). We implement the following security measures:

• Data encrypted at rest (AES-256)
• All data in transit encrypted using TLS 1.3
• Role-based access control (RBAC) and multi-factor authentication
• Regular security audits and automated vulnerability scanning
• Audit logs for data access and modifications
• Automated backups with encrypted storage

5. GDPR Compliance

Viraly is fully compliant with the EU General Data Protection Regulation (GDPR — Regulation (EU) 2016/679). We process personal data on the following lawful bases:

• Contractual necessity — to provide the Service you signed up for
• Legitimate interests — platform security, fraud prevention, and service improvement
• Legal obligation — compliance with applicable law (e.g. billing records)
• Consent — for optional features such as analytics cookies

We provide Data Processing Agreements (DPAs) to customers who require them. Contact us at support@viraly.im to request one.

6. Your Rights

As a user in the EEA or UK, you have the following rights under GDPR:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and all associated data
• Portability — export your data in a machine-readable format
• Restriction — limit how we process your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, email us at support@viraly.im. We will respond within 30 days.

7. Data Retention

• Active account data: retained for the duration of your subscription
• Deleted accounts: personal data deleted within 30 days of account deletion
• Billing records: retained for 7 years as required by tax regulations
• AI conversation history: retained until deleted by the user or account deletion
• Media assets: deleted from S3 within 30 days of account deletion

8. Cookies

We use cookies to operate and improve our Service. For full details, see our Cookie Policy.

9. International Data Transfers

All personal data is stored and processed within the European Union. Where we engage sub-processors outside the EEA (e.g. OpenAI, USA), we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework where applicable.

10. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email at least 30 days before they take effect. Continued use of the Service constitutes acceptance of the updated policy.

12. Contact Us