Privacy Policy

The personal data controller

The data we collect

A. Account data (through Google OAuth)

• The full name and email address provided by Google
• The profile picture (avatar)
• A unique user identifier

B. Service usage data

• The media files and content uploaded for processing (stored temporarily, max. 30 minutes)
• Processing parameters (the type of service used, the options and settings chosen)
• The credit transaction history (amount, date, service used)
• Technical activity logs (errors, response times)

C. Payment data

• We do not store bank card data — payments are processed exclusively through Stripe
• We store: the transaction amount, the date, the payment status and the Stripe transaction ID

D. Technical data (collected automatically)

• The IP address (anonymised after 30 days)
• The browser type and operating system
• The page visited and the access timestamp
• Essential session cookies

E. Connected social media accounts — Viralio Scheduler

Viralio Scheduler (the post-scheduling app, available at scheduler.viralio.ro) processes additional data only if you choose to connect an account on TikTok, YouTube, Facebook or Instagram. The connection is made through official OAuth authorisation on that platform — for TikTok through the TikTok Login Kit. We never receive and never store the password of your account.

• Access and refresh tokens issued by the platform, stored encrypted and used solely to publish the material you schedule
• The account’s public identifier (for TikTok: open_id), the display name and the avatar — obtained through the user.info.basic permission, so you can see in the interface which account will be posted to
• The scheduled video and its metadata (title, description, scheduled time) — kept until publication, then deleted from our servers
• The publication status and the post identifier returned by the platform (to show the history in the app)

F. YouTube — Viralio Scheduler uses YouTube API Services

Viralio Scheduler uses YouTube API Services. If you choose to connect your YouTube channel, authorisation happens through Google OAuth, on google.com — we never receive and never store the password of your Google account.

• What we read — the youtube.readonly permission gives us the channel name, its identifier and the profile picture, solely so you can see in the interface which channel will be published to.
• What we upload — the youtube.upload permission is used only to upload to your channel the videos you schedule, with the title, description, category, privacy level and “made for kids” declaration you choose for each scheduled post.
• What we do NOT do — we don’t read your watch history, don’t access analytics, don’t delete or modify existing material, don’t subscribe to channels and don’t comment on your behalf.
• Third parties and advertising — the data obtained through YouTube API Services is not sold, rented or transferred to third parties, is not used for advertising, ad profiling or credit assessment, and we display no third-party ads in the app.
• Human access — our staff do not view your YouTube data, except where you expressly ask us for support, for security reasons or under a legal obligation.

Our use of data received through Google APIs, including YouTube API Services, complies with the Google API Services User Data Policy, including the Limited Use requirements: we use this data solely for the scheduling and publishing feature you see in the app.

G. Facebook and Instagram — Viralio Scheduler uses the Meta Graph API

If you choose to connect a Facebook Page and/or a professional Instagram account (Business or Creator), authorisation happens through Facebook Login, on facebook.com — we never receive and never store the password of your Meta account. Publishing to Instagram works through the Facebook Page your professional account is connected to.

• What we read — the list of Pages you administer (pages_show_list), and for the Page you choose: its identifier and name (pages_read_engagement), plus the identifier, username and profile picture of the professional Instagram account connected to that Page (instagram_basic). We use them solely so you can see in the interface where the post will go.
• What we store — the Page access token (issued by Meta, valid for about 60 days), the Page’s identifier and name, the Instagram account identifier and your Facebook user identifier (app-scoped user ID). The last one is needed solely so we can identify you when you request deletion of your data.
• What we publish — the pages_manage_posts and instagram_content_publish permissions are used only to publish, at the date and time you choose, the videos you upload into the app, with the caption and hashtags you write. We publish nothing automatically, without an explicit scheduling action from you.
• What we do NOT do — we don’t read your feed, don’t read or reply to comments or messages, don’t access analytics or audience data, don’t delete or modify existing posts, don’t manage ads and don’t publish to any Page other than the one you chose.
• Third parties and advertising — the data obtained through the Meta Graph API is not sold, rented or transferred to third parties, is not used for advertising or ad profiling and is not combined with data from other sources.
• Human access — our staff do not view this data, except where you expressly ask us for support, for security reasons or under a legal obligation.

Our use of data received through Meta’s platforms complies with the Meta Platform Terms and the Meta Developer Policies. Your data is also processed by Meta under the Meta Privacy Policy.

Purposes and legal basis of processing

Recipients and third-party processors

We use the following third-party processors, each under their own privacy policies and GDPR commitments (DPA):

International data transfers

Some of our processors (Google, Stripe, Cloudflare, MongoDB, RunPod, TikTok, Meta) may transfer data outside the European Economic Area (EEA), including to the USA.

These transfers are made through legal mechanisms compliant with the GDPR:

• Standard Contractual Clauses (SCCs) adopted by the European Commission
• The EU–US Data Privacy Framework (where applicable)
• Appropriate technical and organisational safeguards (encryption, pseudonymisation)

How long we keep data

Your rights (GDPR)

Under the GDPR you have the following rights, which you can exercise by email at contact@viralio.ro:

Data security

We implement appropriate technical and organisational measures to protect your data:

• HTTPS/TLS for all communication between client and server
• A JWT token with automatic expiry for authentication
• Cloudflare for DDoS protection, firewalling and filtering malicious traffic
• Passwords and sensitive data are never stored in the clear
• Database access is restricted and protected by secure credentials
• Temporary media files are isolated in secure environments and deleted automatically

Cookies

We use cookies and similar technologies to run the platform. Full details are available in the Cookie Policy.

The essential cookie viralio_token is required for authentication and cannot be switched off without losing access to your account.

Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be communicated by publishing the new version with an updated date and, where appropriate, by direct notice.

Continuing to use the services after the updates are published constitutes acceptance of the new policy.

Minors, sensitive data and automated decisions

Minors. Viralio’s services are not intended for people under 18. We do not knowingly collect data from minors. If you are a parent or guardian and believe a minor has given us personal data, contact us at contact@viralio.ro and we will delete it as the law requires.

No automated decisions. We do not take decisions with legal or similarly significant effects on you based solely on automated processing (including profiling), within the meaning of Art. 22 GDPR. AI processing produces results at your request, but does not evaluate you or take decisions about you.

Data about third parties. If you invite a friend through the referral programme, you give us their contact details (e.g. a shared link) — please do this only with that person’s agreement. We process this data strictly to deliver the invitation and to award the reward.

Marketing, communications and other services

Marketing communications. We may send you emails about news, offers and features, on the basis of legitimate interest or consent, as appropriate. You can unsubscribe at any time using the link at the bottom of every email or by writing to contact@viralio.ro. You will keep receiving essential transactional messages (e.g. payment confirmations, account alerts).

To measure how effective our emails are we may use pixels/tags (see the Cookie Policy). You can block image loading in your email client to disable them.

Other sites and services. The platform may contain links to third-party sites (e.g. social networks, partner documentation). We do not control and are not responsible for their privacy practices — we recommend reading their own policies.

Contact and complaints

If you believe your rights have not been respected, you have the right to lodge a complaint with: