This Privacy Policy describes how ViralDM ("we", "us", "our") collects, uses, and shares information when you use our services available at viraldm.app (the "Service").
1. Information We Collect
Account Information
- Name, email address, password (hashed)
- Profile picture (if provided)
- OAuth IDs (Google, GitHub) if you sign up via OAuth
Social Media Account Data
When you connect Instagram, Facebook, or YouTube, we receive (with your permission):
- Account ID, username, profile picture
- Access tokens to perform authorized actions on your behalf
- Messages and comments from your connected accounts (only what you've authorized)
YouTube
ViralDM uses YouTube API Services to read comments on your videos, reply to them on your behalf, follow your live chat, and be notified when you publish. By connecting a channel you also agree to the YouTube Terms of Service.
Google's handling of any data it receives is described in the Google Privacy Policy.
You can revoke ViralDM's access to your YouTube channel at any time from your Google security settings, or by disconnecting the account inside ViralDM. Revoking stops every automation on that channel immediately. We keep no copy of your YouTube content beyond what is needed to run the automations you set up, and stored tokens are deleted when you disconnect.
Subscriber Data
When users interact with your automations, we collect:
- Their platform user ID and username
- Messages they send to your accounts
- Custom fields you collect via flows (email, phone if provided)
Usage Data
- IP address, browser type, device info
- Pages visited, features used, time on site
- Error logs and diagnostic data
Payment Information
Web payments are processed by Razorpay; purchases in the Android app are processed by Google Play Billing. We don't store your full card details. We retain transaction IDs, amounts, dates and (for Play) purchase tokens for billing/tax purposes.
UPI Payment Screenshots (optional feature)
If you turn on UPI Payment Verify, screenshots that your subscribers send you as proof of payment are analysed by an AI model (Anthropic Claude through our AI gateway, or Google Gemini if that is unavailable) to read the amount, UTR/reference number, timestamp and payee handle. The screenshot and the extracted fields are stored with the verification record so you can review it. This may include the subscriber's name or UPI id as shown on their screenshot.
Notifications
If you enable browser push notifications we store the push subscription (endpoint and keys) your browser gives us. We also send the operator an internal alert (via Telegram) when an account signs up, pays or cancels — it carries your email address in masked form (for example j***@gmail.com), your ViralDM account id, the plan and amount, how you signed up, and the referral code or campaign you came from, if any. It does not carry your name. A daily summary to the operator lists that day's new sign-ups by masked email. These messages go to the operator's private Telegram chat only, are used to run the service, and never for marketing.
2. How We Use Your Data
- Provide and operate the Service
- Process automations on your behalf
- Generate AI-powered replies using third-party AI providers
- Send service emails (account, billing, security)
- Improve and analyze the Service
- Measure our own advertising (Meta Pixel after cookie consent, Conversions API — see Data Sharing and Cookies)
- Comply with legal obligations
- Prevent fraud and abuse
3. Data Sharing
We share data only with:
- Meta (Instagram/Facebook) and Google (YouTube) — to perform automations you've authorized
- AI providers — message text for AI replies, captions and translations (no personal data sent unnecessarily). Requests go first through an AI gateway we run ourselves on a server in Mumbai, India (hosted by Hostinger), to AI models such as Anthropic Claude run by Amazon Web Services through its Kiro service; if that is unavailable, to Google Gemini; AWS Bedrock is a last fallback. The in-app AI assistant asks Google Gemini first and our gateway second. One provider answers each request. Our requests to Kiro carry Amazon's opt-out flag for the use of content to improve its services.
- Meta Platforms Ireland Ltd. / Meta Platforms, Inc. — advertising measurement for ViralDM's own website (Meta Pixel and Conversions API): when you sign up or pay for a plan we send Meta a SHA-256 hash of your email address and of your ViralDM account id, an event id and, for a payment, its amount — plus, when the request comes from your browser, your IP address, your browser's user agent and Meta's ad-click identifiers (
fbclid/_fbc,_fbp). Never your name, phone number or messages. Nothing is sent from a browser that pressed Reject on our cookie banner or that sends Do Not Track / Global Privacy Control; events from payment webhooks and renewals, where no browser is involved, carry only the two hashes. Meta uses this to measure and improve our ads, under its own terms. To opt out of these server events entirely, write to [email protected]. - Razorpay — for web payment processing; Google Play — for purchases made in the Android app
- Anthropic Claude via Kiro (Amazon Web Services), reached through an AI gateway we host, with Google Gemini as fallback — UPI payment-screenshot analysis, only when you enable that feature
- Resend — delivering account email (verification, password reset, receipts, alerts)
- ElevenLabs (with Vapi as backup) and Exotel — AI voice calls and voice-note replies, only when you switch those features on: the lead's phone number, the call script, audio and transcript
- Cloudinary — storage and delivery of media you upload for posts
- Browser push services (Google, Apple, Mozilla) and Telegram — to deliver notifications (see above)
- Cloud hosting (Google Cloud Platform — Mumbai, India region) — to operate infrastructure; Hostinger (Mumbai, India) — the server that runs our AI gateway
- Legal authorities — when required by valid legal process
We never sell your personal data.
4. Data Retention
- Account data: until you delete your account
- Automation logs: kept while your account is active (at least one year), erased with your account
- Deleted accounts: erased 30 days after the deletion request by an automated daily job
- Security and consent records (audit log, consent and rights-request ledger): kept as long as the law requires, with no marketing use
- Subscriber data: until you delete them or close account
- Payment and payout records: 7 years (Indian tax law)
5. Your Rights (GDPR + Indian DPDPA)
You have the right to:
- Access your data — download from dashboard
- Correct inaccurate data
- Delete your account and data anytime — see Data Deletion Instructions
- Port your data to another service
- Object to certain processing
- Withdraw consent for OAuth integrations
To exercise rights, email [email protected]
6. Security
- Every connection from your browser or app to ViralDM, and from ViralDM to third-party services, uses HTTPS/TLS; the app reaches its database over a private network inside the same server, not over the internet
- Passwords are bcrypt-hashed (never stored plain)
- Social access tokens are encrypted at the application layer (AES-256-GCM) before they are stored; all data is additionally encrypted at rest (disk-level) on Google Cloud
- Periodic internal security reviews and automated dependency checks
- Database backups encrypted
7. Cookies
We use essential cookies for authentication and security. To measure our own advertising, ViralDM's public website and sign-up pages may use the Meta Pixel — only after you press Accept on our cookie banner; press Reject, or browse with Do Not Track / Global Privacy Control, and it never loads. We run no other third-party analytics. See our Cookie Policy.
8. Children's Privacy
Accounts are for users 18 and over. We don't knowingly collect data from minors as account holders.
Subscribers (people who message a creator): we process their data on behalf of the creator, as the creator's processor. Inside a creator's account the Service scores leads and reads the mood of a message (lead score, mood) so the creator can decide whom to answer first; that stays within that creator's account. We do not combine subscribers' data across creators, sell it, or target advertising at them. Creators must not use the Service to collect personal data from anyone under 18 without verifiable parental consent, as required by the Digital Personal Data Protection Act, 2023.
9. Where Your Data Lives (Data Localization)
Primary hosting is in India — our application and database run on Google Cloud Platform's Mumbai (asia-south1) region, so your account data, subscriber data, and messages are stored in India by default.
Limited processing happens outside India only where a provider requires it:
- USA — Amazon Web Services through Kiro (AI text generation and payment-screenshot analysis, reached through our gateway in Mumbai), Google Gemini API (AI fallback, and first for the in-app assistant), AWS Bedrock (last AI fallback), Resend (email delivery), ElevenLabs and Vapi (AI voice, when switched on), Cloudinary (media CDN), Google (OAuth)
- USA / EU — Meta (Instagram/Facebook APIs, inherent to the platform; and the Meta Pixel / Conversions API that measure ViralDM's own ads)
Payment data is processed and stored in India by Razorpay in line with RBI data-localization requirements. All cross-border transfers comply with the DPDP Act 2023 and applicable data protection laws.
10. Changes to This Policy
We'll notify you via email/dashboard for material changes. Continued use after changes means acceptance.
11. Grievance Redressal (India — IT Rules 2021 & DPDP Act 2023)
In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:
Grievance Officer: Jeetmal Kumawat
Entity: Vyzonek Technology Private Limited (CIN: U58201DC2026PTC473496), Patel Nagar West, New Delhi, Central Delhi – 110008, India
Email: [email protected] (subject line: "Grievance")
- Complaints are acknowledged within 24 hours
- Complaints are resolved within 15 days of receipt
- If unsatisfied with our resolution, you may escalate to the Data Protection Board of India as provided under the DPDP Act 2023
As a Data Principal under the DPDP Act you may also withdraw consent at any time (disconnect integrations from your dashboard or delete your account) and nominate another individual to exercise your rights in case of death or incapacity (email us to record a nomination).
12. Contact
- Privacy questions:
[email protected] - Data Protection Officer:
[email protected] - Grievance Officer:
[email protected]