Privacy Policy

1. Data Controller

The data controller responsible for your personal information is ИП Дрозд Илья Павлович, TIN (INN) 212885886929, OGRNIP 323210000044935, registered at: 428014, Россия, Чувашская Республика — Чувашия, г. Чебоксары, ул. Запрудная, д. 2.

We process personal data in accordance with internationally recognized privacy standards, including the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) for users located in the European Union and European Economic Area (EU/EEA), and applicable data protection laws of the Russian Federation (Federal Law No. 152-FZ "On Personal Data").

Privacy contact: The functions of the person responsible for organizing the processing of personal data are performed by ИП Дрозд Илья Павлович.

For questions regarding the processing of your personal data, you can contact us at: Email: support@viralmaxing.com, Telegram: viralmaxing_support_bot.

2. Data We Collect

We collect the following categories of personal data:

2.1. Registration Data

• Email address
• First and last name
• Password hash (we do not store the plaintext password)
• Time zone

2.2. Data from Third-Party Services (OAuth)

When you sign in or connect social media accounts, we receive data within the scope of the permissions you grant:

• Google / YouTube: identifier, email, avatar, channel name, access tokens for read-only channel data and analytics
• Yandex: identifier, email, avatar
• Telegram: identifier, username, language, premium status
• Apple: identifier, email, and name when provided by Apple
• Instagram: identifier, username, account type, profile, media, and analytics data; access to comments and messages is requested separately only when you enable the corresponding feature

Connecting a social account is a separate action taken by you. Viralmaxing receives and stores access tokens and uses them only within the permissions displayed by the relevant platform at connection, for authentication, reading profile data, providing analytics, or another feature you explicitly enable. Viralmaxing does not receive your social account password through an OAuth connection.

2.3. Payment Data

• Last 4 digits of your card number
• Transaction history (amounts, dates, status)
• Subscription data (plan, billing period, status)

Full card details (card number, CVV, expiration date) are never stored on our servers. Payment processing is handled by BePaid (primary, for international cards) and CloudPayments (for Russian cards).

2.4. Content and Activity

• Scripts, posts, videos, and images you create
• Search queries and saved search sessions
• Account settings and preferences
• Connected social media account information

2.5. Technical Data

• IP address
• Browser type and version
• Device information
• Service interaction data (product analytics)

2.6. Sources of Data

We collect data directly from you, automatically when you use the Service, and from services you choose to connect, payment providers, and other vendors involved in providing the Service.

2.7. Children

The Service is not intended for children under 16, and we do not knowingly collect their personal data. Users aged 16 to 18 may use the Service only where permitted by applicable law and with any parental or guardian authorization required by that law. If you believe a child has provided personal data contrary to this section, contact us at support@viralmaxing.com.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

3.1. General Legal Bases

• Consent: for optional analytics cookies, marketing communications, and other processing for which we separately request consent
• Performance of a contract: to register and authenticate users, provide subscription services, process payments, generate content, and provide analytics for accounts connected at the user's request
• Legitimate interest: to ensure service security, prevent fraud, and improve the quality of the service based on analytics

3.2. Additional Bases for EU/EEA Users (GDPR)

• Consent (Art. 6(1)(a) GDPR): for optional analytics cookies, marketing communications, and other processing for which we separately request consent
• Performance of a contract (Art. 6(1)(b) GDPR): to register and authenticate users, provide services, process payments, generate content, and provide analytics for accounts connected at the user's request
• Legitimate interest (Art. 6(1)(f) GDPR): to ensure security, prevent fraud, and improve the service, subject to the balancing and other safeguards required by law

3.3. For California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). We do not sell your personal information as defined by the CCPA. We do not use or share sensitive personal information for purposes other than those permitted by the CCPA. For details on your specific rights, see Section 11.3 below.

4. How We Use Your Information

• To provide and maintain the functionality of the service
• To associate the content you create with your account
• To securely process payments
• To process content through AI services (generation, transcription)
• To provide analytics for your social media accounts
• To send transactional notifications (verification codes, payment notifications)
• To improve the service based on aggregated analytics data

5. Automated Data Processing

The service uses automated data processing technologies, including artificial intelligence (AI), in the following cases:

• AI content generation: script texts, prompts, and descriptions are sent to OpenRouter and the model provider selected for the request to generate or analyze content. Provider handling depends on the applicable provider terms and technical settings
• Content analytics (VM Score): automated assessment of viral potential based on engagement metrics (views, likes, comments). The result is a numerical score from 0 to 100 that does not affect your access to the service
• Transcription: audio and video files are sent to third-party services for automatic conversion to text

We do not make decisions that have legal effects on you based solely on automated data processing. VM Score is an informational metric and does not affect your access to service features, the ranking of your content, or your terms of service. If you believe that automated processing has produced an erroneous result, you may contact our support team for a human review.

Viralmaxing does not operate or train its own general-purpose foundation model and does not sell personal data for training such models. Third-party providers process AI requests as described above and under their applicable terms and settings.

6. Data Sharing with Third Parties

We do not sell personal data. Data is shared with the following categories of recipients solely to perform the functions of the service:

Recipients and model providers may change as the Service evolves. We require vendors to process data only for the contracted services and apply contractual or other transfer safeguards where applicable law requires them.

7. Social Media Integrations

While an integration is active, Viralmaxing may access the platform API within the permissions you granted for authentication, account connection, reading available data, providing analytics, or another feature you explicitly enable. Logging out of Viralmaxing, uninstalling the application, or ceasing to use the Service does not by itself disconnect an integration or revoke platform-side access.

Disconnecting an integration in Viralmaxing stops further use of the stored token. To revoke access fully on the platform side, remove Viralmaxing in that platform's connected-app settings.

YouTube

Used to read your channel data and provide analytics. Viralmaxing requests the youtube.readonly and yt-analytics.readonly permissions and does not request permission to upload or publish videos. By authorizing through Google, you agree to the YouTube Terms of Service and Google Privacy Policy. Our use of Google API data complies with the Limited Use requirements.

Instagram

Used to read professional-profile, media, and insights data. Viralmaxing does not request permission to publish content. Access to comments and messages is requested separately only after you enable the corresponding feature.

Media Resources and Templates

Viralmaxing provides access to a library of media resources (memes, images, music, fonts, templates). These resources are sourced from publicly available sources, user contributions, or under permissive licenses. We do not guarantee that all provided resources are free from copyright restrictions. Users are responsible for independently verifying rights before commercial use.

8. Cookies and Analytics

We use cookies and similar tracking technologies. Cookies are divided into the following categories:

8.1. Necessary Cookies

Functional cookies (authentication, session, user preferences) are essential for the operation of the service and do not require separate consent. The service cannot function properly without them.

8.2. Analytical Cookies

Analytical cookies are activated only after you provide explicit consent through the cookie consent banner displayed on your first visit. These include:

• PostHog — product analytics to understand how users interact with the service. Profiles are created only for authenticated users (identified_only mode)
• Google Analytics — web analytics for traffic analysis and marketing channel effectiveness. Used only in the production environment

8.3. Consent Management

You can withdraw your consent to analytical cookies at any time through the cookie settings on the website or by clearing cookies in your browser. Upon your next visit, the cookie consent banner will be displayed again. Declining analytical cookies does not affect the functionality of the service. When consent is withdrawn, we immediately cease collecting analytical data and delete previously set analytical cookies.

9. Data Storage and Protection

We use reasonable technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and restricted access to production systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Retention Periods

We retain each category of personal data only for as long as reasonably necessary to provide the Service, fulfill the purposes described in this Policy, maintain security, resolve disputes, enforce agreements, and meet legal, tax, and accounting obligations. Retention is determined by the nature and sensitivity of the data, the duration of the user or workspace relationship, applicable limitation periods, legal requirements, and the settings or expiry rules of connected platforms and vendors. OAuth tokens are used while the relevant connection remains active and authorized and cease to be used after disconnection, revocation, or expiry.

10. Cross-Border Data Transfers

When using the service, your data may be processed outside your country of residence by third-party services (AI providers, payment processors, cloud storage). Where applicable law requires a transfer mechanism, we use an available recognized mechanism and assess the safeguards relevant to the transfer.

For EU/EEA users, those mechanisms may include an adequacy decision, the European Commission's Standard Contractual Clauses, or the EU-U.S. Data Privacy Framework where the recipient is certified, together with supplementary measures where required.

11. Your Rights

11.1. General Rights

Subject to applicable law, you may have the following rights regarding your personal data:

• Right of access: obtain information about what personal data we process about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to deletion: request deletion of your data (learn more on the data deletion page)
• Right to restrict processing: request restriction of processing of your data in certain circumstances
• Right to withdraw consent: withdraw previously given consent to the processing of personal data at any time

We respond to requests within the periods required by applicable law.

11.2. Additional Rights for EU/EEA Users (GDPR)

If you are located in the EU/EEA, you additionally have the following rights:

• Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used, and machine-readable format
• Right to object (Art. 21 GDPR): object to the processing of your data based on legitimate interest
• Right not to be subject to automated decision-making (Art. 22 GDPR): not be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you
• Right to lodge a complaint: file a complaint with the data protection supervisory authority in your country of residence

Response time for EU/EEA user requests is 30 (thirty) calendar days from receipt (Art. 12 GDPR). In exceptional cases, the period may be extended by an additional 60 days with notification.

11.3. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the CCPA and CPRA:

• Right to know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your data
• Right to delete: request deletion of your personal information, subject to certain exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out of sale/sharing: we do not sell or share your personal information as defined by the CCPA
• Right to non-discrimination: you will not receive discriminatory treatment for exercising any of your CCPA rights
• Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes beyond those permitted by the CCPA

To exercise your CCPA rights, contact us at support@viralmaxing.com. We will respond to verifiable consumer requests within 45 days, which may be extended by an additional 45 days with notice.

12. Applicable Law

This Privacy Policy is governed by the laws of the Russian Federation, including Federal Law No. 152-FZ "On Personal Data."

For users located in the EU/EEA, this Policy is supplemented by the provisions of the GDPR (Regulation (EU) 2016/679). In the event of a conflict between the provisions of this Policy and the GDPR, the GDPR provisions shall prevail for EU/EEA users.

For users located in California, this Policy is supplemented by the provisions of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). In the event of a conflict, the CCPA/CPRA provisions shall prevail for California residents.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with the date of the update. Where required by applicable law, we will provide additional notice of material changes by email or through the Service before they take effect.

14. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, please contact us:

Email: support@viralmaxing.com
Telegram: viralmaxing_support_bot