Privacy Policy

1. Scope & Privacy Principles #

This Privacy Policy explains how ViralMag Inc. ("ViralMag", "we", "us", or "our") collects, uses, discloses, and protects information gathered when you access our website, use our SaaS web application, API services, or interact with our customer support teams.

Depending on how you interact with ViralMag:

• Data Controller: For account registration details, billing contact info, and website telemetry, ViralMag acts as a Data Controller under applicable data protection laws (including the EU General Data Protection Regulation / GDPR).
• Data Processor: For product briefs, scripts, uploaded brand kits, audio tracks, and exported video content created inside your workspace, ViralMag acts as a Data Processor on behalf of your organization.

2. Information We Collect #

We limit data collection to what is strictly necessary to deliver a world-class AI video rendering service:

A. Information You Provide Directly

• Account Information: Full name, business email address, company name, workspace role, hashed authentication credentials, and communication preferences.
• Workspace Assets & Input Content: Product descriptions, feature specifications, brand voice guidelines, uploaded images, logos, video assets, script prompts, and custom voice cloning samples.
• Payment Details: Billing address, VAT/tax identification number, and payment method metadata. Note: Credit card payments are processed directly by our PCI-DSS Level 1 compliant payment provider (Stripe); ViralMag does not store raw credit card numbers.
• Support & Feedback: Correspondence, support tickets, survey responses, and feedback forms submitted to our support team.

B. Information Collected Automatically

• System & Usage Telemetry: Log records including IP addresses, browser types, operating systems, page load latency, feature usage metrics, and error stack traces needed to maintain platform stability.
• Cookies & Local Storage: Essential session tokens (`vm_session`) and preferences (`vm_theme`). Analytics cookies are set strictly upon explicit user consent (see our Cookie Policy).

3. How We Process Your Data #

We process your data strictly under valid legal bases under GDPR (Contractual Necessity, Legitimate Interests, Legal Obligation, or Consent):

4. AI & Asset Data Protection Policy #

Many AI platforms harvest user inputs for model training. ViralMag operates under a zero-training data policy:

5. Subprocessors & Third-Party Service Providers #

We share data only with trusted third-party subprocessors essential to operating ViralMag. Each subprocessor undergoes rigorous security vetting and is bound by standard Data Processing Addenda (DPAs):

6. International Data Transfers #

ViralMag operates globally. When personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland is transferred outside those regions, we ensure appropriate safeguards:

• Execution of standard EU Standard Contractual Clauses (SCCs) with all international subprocessors.
• Adherence to the EU-U.S. Data Privacy Framework (DPF) principles.
• Support for regional data residency configuration for Enterprise accounts upon request.

7. Data Retention & Deletion #

We retain workspace data for as long as your workspace account remains active:

• Account Closure: Upon workspace cancellation or deletion request, active workspace assets enter a 30-day grace window, after which all media files, scripts, and database records undergo permanent cryptographic deletion.
• Financial Records: Transactional billing history is retained for up to 7 years to satisfy tax and accounting obligations.
• Self-Service Export: You may export rendered videos, scripts, and analytics data directly from workspace settings at any time prior to account closure.

8. Your Legal Rights (GDPR & CCPA/CPRA) #

Depending on your geographic location, you possess comprehensive legal rights regarding your personal data:

• Right of Access: Request a copy of all personal data held about you.
• Right to Rectification: Correct inaccurate or incomplete workspace information.
• Right to Erasure ("Right to be Forgotten"): Request hard deletion of your personal records.
• Right to Restrict or Object: Limit processing or opt out of direct marketing communications.
• Right to Data Portability: Obtain your data in a structured, machine-readable JSON format.
• Non-Discrimination: We will never discriminate against you for exercising your privacy rights.

9. Data Protection Officer & Contact #

If you have questions regarding this Privacy Policy or wish to exercise your legal privacy rights, please contact our dedicated Data Protection Officer (DPO):