Privacy Policy

Effective Date: June 18, 2026 · Last Updated: June 18, 2026

1. Who We Are

This Privacy Policy describes how Viraly Post ("Viraly Post," "we," "our," or "us") collects, uses, shares, and protects your information when you visit viralypost.com, use our application at app.viralypost.com, or otherwise interact with our services (collectively, the "Services").

Viraly Post is operated by VIRALY POST LTDA, a Brazilian limited liability company registered under CNPJ 65.654.417/0001-13, with registered office at Rua São Vicente de Paula, 81, Agronômica, Florianópolis, Santa Catarina 88025-330, Brazil.

For data protection matters and to exercise your privacy rights (including GDPR, UK GDPR, CCPA, or LGPD rights), contact us at contact@viralypost.com.

2. Information We Collect

2.1. Information You Provide

• Account information: name, email address, password (hashed), and profile preferences.
• Payment information: billing name, billing address, and the last four digits of your payment card. Full card data is processed and stored by Stripe, Inc., our payment processor. We never see or store your full card number.
• Content you upload: images, videos, captions, scheduled posts, hashtags, and any other content you create or upload to Viraly Post.
• Communications: messages you send to our support, feedback, and survey responses.

2.2. Information Collected Automatically

• Device information: browser type, operating system, screen resolution, language, time zone.
• Usage data: pages visited, features used, clicks, scroll behavior, session duration, referring URL.
• Log data: IP address, access times, error logs.
• Cookies and similar tracking technologies: see Section 7.

2.3. Information from Third Parties

When you connect a third-party social media account (Instagram, TikTok, LinkedIn, YouTube, X, Facebook, Threads, Pinterest, Bluesky, Reddit, and others), we receive limited information from those platforms as described in Section 3.

3. Social Media Account Access

3.1. What we access

When you connect a social account, we receive (depending on the platform and the permissions you grant):

• An OAuth access token (an encrypted credential that lets us post on your behalf without storing your password)
• Your profile name, profile picture, and public account ID
• The minimum permissions required to publish, schedule, or retrieve analytics, typically: read profile, publish posts, read post performance

3.2. What we DO NOT access

• Your social media password, we never see or store passwords for any third-party platform
• Your direct messages or private conversations (unless explicitly required for a feature you enable, in which case you will be informed)
• Personal data of your followers, friends, or contacts beyond what each platform's API publicly exposes

3.3. How tokens are stored

OAuth access tokens are stored encrypted at rest using industry-standard encryption (AES-256). They are decrypted only at the moment a publishing or analytics operation is executed on your behalf.

3.4. Revoking access

You can revoke our access at any time by (a) disconnecting the account inside Viraly Post, or (b) revoking the app's permission directly in the settings of the third-party platform (e.g., Instagram → Settings → Apps and Websites).

4. How We Use Your Information

We use your information for the following purposes:

• Provide the Services: create your account, schedule posts, publish content on your behalf to platforms you have connected, retrieve performance analytics.
• Process payments: via Stripe.
• Communicate with you: send transactional emails (account confirmation, billing receipts, password resets), product updates, and (with your consent) marketing emails. You can opt out of marketing at any time.
• Improve the Services: understand which features are used, identify bugs, optimize the user interface.
• Security and fraud prevention: detect abuse, prevent unauthorized access, comply with legal obligations.
• Legal compliance: comply with tax laws, respond to lawful requests from authorities.

5. How We Share Information

We do not sell or rent your personal data. We share data only as described below:

5.1. Service Providers (Processors)

Provider	Purpose	Data shared
Stripe	Payment processing, subscription management	Name, email, billing address, payment card data
Vercel	Website and application hosting	IP address, browser data, page visits (server logs)
Google (LLC)	Web analytics (Google Analytics 4), authentication (Sign in with Google, if you use it)	Pseudonymous usage data, device info, hashed identifiers
Microsoft	Behavioral analytics, heatmaps, session recordings (Microsoft Clarity)	Pseudonymous interaction data, device info, page screenshots
Meta Platforms, Inc.	Advertising performance measurement (Meta Pixel)	Pseudonymous browsing data, conversion events
Transactional email provider (Postmark, Resend, or equivalent)	Transactional email delivery (account confirmation, billing, password reset)	Email address, message content

All service providers are contractually bound to use your data only for the purposes we specify and to protect it with appropriate security measures.

5.2. Social Media Platforms

When you schedule a post, the content (images, videos, captions) is transmitted to the corresponding platform (Instagram, TikTok, etc.) using their official API. Once transmitted, the content is governed by that platform's own terms and privacy policy.

5.3. Legal Requests

We may disclose your information when required by law, court order, or to protect our rights, your safety, or the safety of others.

5.4. Business Transfers

If Viraly Post is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6. Analytics & Tracking Services

6.1. Google Analytics 4

We use Google Analytics 4 to understand how visitors use our website. Google Analytics uses cookies and similar technologies to collect pseudonymous data such as pages visited, time spent, traffic source, and device type. IP addresses are anonymized before storage. For more information, see Google's Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.

6.2. Microsoft Clarity

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first- and third-party cookies and other tracking technologies to determine the popularity of products and services and online activity. Additionally, we use this information for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

6.3. Meta Pixel

We use the Meta Pixel (provided by Meta Platforms, Inc.) to measure the effectiveness of our advertising on Facebook and Instagram, and to build audiences for retargeting. The Meta Pixel collects information about your visit, the actions you take, and your device. For more information, see Meta's Privacy Policy and adjust your ad preferences at facebook.com/ads/preferences.

7. Cookies

Cookies are small text files stored on your device that allow websites to remember information about your visit. We use the following categories:

• Strictly necessary cookies: required for the site to function (session, authentication, security). These cannot be disabled.
• Analytics cookies: Google Analytics (_ga, _ga_*), Microsoft Clarity (_clck, _clsk).
• Advertising cookies: Meta Pixel (_fbp, fr) for ad measurement and retargeting.

You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.

8. Data Retention

• Account data: kept while your account is active and for up to 24 months after deletion, for legal and tax compliance.
• Content you upload: kept while your account is active. Deleted within 30 days after account deletion.
• OAuth tokens: deleted immediately upon disconnection of the social account or account deletion.
• Payment records: retained as required by tax and accounting laws (typically 5 years in Brazil).
• Analytics data: Google Analytics, 14 months. Microsoft Clarity, 13 months. Server logs, 90 days.

9. Security

We implement industry-standard technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) for all data transmitted between your device and our servers
• Encryption at rest (AES-256) for sensitive data including OAuth tokens and passwords
• Access controls limiting employee access on a need-to-know basis
• Regular security audits and dependency updates
• Incident response procedures in case of a data breach

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. International Data Transfers

Viraly Post is operated from Brazil and serves customers worldwide, primarily in the United States and the United Kingdom. Our service providers (Stripe, Google, Microsoft, Meta, Vercel) operate global infrastructure. By using our Services, you understand and consent that your data may be transferred to, processed in, and stored in countries outside your country of residence, including Brazil, the United States, and the European Union.

For transfers from the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Addendum, or our service providers' EU-U.S. Data Privacy Framework certification where applicable. Brazil has been recognized by the European Commission as a country with adequate protection under the LGPD.

11. Your Privacy Rights

11.1. Rights under GDPR (European Union) and UK GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights regarding your personal data:

• Right of access, request a copy of the personal data we hold about you
• Right to rectification, correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"), request deletion of your data, subject to legal retention obligations
• Right to data portability, receive your data in a structured, machine-readable format
• Right to object, object to processing based on legitimate interests or for direct marketing
• Right to restriction of processing, request that we limit how we process your data
• Right to withdraw consent, where processing is based on consent, you may withdraw it at any time
• Right not to be subject to automated decision-making, including profiling that produces legal effects
• Right to lodge a complaint with your local supervisory authority, in the UK, the Information Commissioner's Office (ICO); in the EU, your national Data Protection Authority

We will respond to verifiable requests within 30 days (extendable by 60 additional days for complex requests, as permitted by GDPR Article 12).

11.2. Rights under CCPA / CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know, what personal information we collect, use, disclose, and sell or share
• Right to delete, request deletion of your personal information
• Right to correct, request correction of inaccurate personal information
• Right to opt out of "sale" or "sharing", we do not sell personal information in the traditional sense, but the use of certain advertising cookies (e.g., Meta Pixel) may be considered "sharing" under CCPA. You can opt out by sending an email to contact@viralypost.com with the subject line "Do Not Sell or Share My Personal Information"
• Right to limit use of sensitive personal information
• Right to non-discrimination, we will not deny services, charge different prices, or provide a different quality of service for exercising your CCPA rights

California residents may also designate an authorized agent to make a request on their behalf, in compliance with California law. We will respond to verifiable requests within 45 days, extendable by another 45 days when necessary.

11.3. Rights under LGPD (Brazilian Residents)

If you are a Brazilian resident, you have the rights guaranteed by the Lei Geral de Proteção de Dados (Law 13.709/2018), including access, correction, deletion, portability, and the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). We will respond within 15 days.

11.4. How to Exercise Your Rights

Regardless of your location, to exercise any of the rights above, email contact@viralypost.com from the email address associated with your account, or describe the request and provide a reasonable way to verify your identity. We do not charge a fee for the first request in a 12-month period. Excessive or repetitive requests may incur a reasonable fee where permitted by law.

12. Children's Privacy

Viraly Post is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected personal data from a minor, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when it was most recently revised. Material changes will be communicated by email or through a prominent notice on our website at least 30 days before they take effect.

14. Contact Us

For questions, requests, or concerns about this Privacy Policy or your personal data:

• Email: contact@viralypost.com
• Support: contact@viralypost.com
• Postal address: VIRALY POST LTDA, Rua São Vicente de Paula, 81, Agronômica, Florianópolis, Santa Catarina 88025-330, Brazil