Privacy Policy

Learn how we collect, use and protect your personal data.

Last Updated: October 20, 2026

VIRAL DAY LLC, a legal entity, acting as Data Controller under applicable data protection laws including GDPR and CCPA, presents our Privacy Policy, which establishes how personal data collected through the "Viral Day" platform is processed.

1. Important Definitions

  • Personal Data: Any information related to an identified or identifiable natural person.
  • Processing: Any operation performed with personal data.
  • Data Subject: Natural person to whom personal data refers.
  • Controller: Legal entity responsible for decisions regarding personal data processing.
  • Legal Basis: Legal foundation that authorizes personal data processing.

2. Legal Bases for Processing

We process personal data based on the following legal grounds:

  • Consent: When you expressly authorize the collection and use of your data.
  • Contract Performance: To provide services requested by you.
  • Legitimate Interest: When necessary to improve our services and user experience.
  • Legal Obligation Compliance: To meet legal and regulatory requirements.

3. Personal Data Collected

3.1 Data provided directly by the user:

  • Identification and contact data (name and email)
  • Preferences and interests (dark mode, heat map [where and when clicked])
  • Content you submit to the Platform's tools: videos, audio, photos and reference images (which may show people's faces and voices) and text prompts used for clipping and for AI image and video generation, plus the content generated from them. This content is collected only when you upload or type it while using each tool

3.2 Automatically collected data:

  • Device Data:

    • Unique identifiers (device ID)
    • Operating system
    • Device model
    • Application version

  • Usage Data:

    • IP address
    • Geolocation data
    • Application interaction logs

4. Processing Purposes

  • Service Provision:

    • Creating clips and generating AI images and videos at your request
    • Processing purchases, payments and refunds
    • Sending notices about your account

  • Marketing Communications (legitimate interest):

    • Sending news and promotions about the platform by email. You can stop receiving them at any time through the unsubscribe link in each email or under Settings › Profile › Email preferences.

  • Service Improvement:

    • Analysis of usage patterns
    • Development of new features
    • Conducting research and statistical analysis

  • Security:

    • Protection of user rights

5. Data Sharing

We may share your data with:

  • Service providers: Trusted companies that assist us in operating the platform (cloud hosting, analytics, customer support) under strict data protection agreements.
  • AI providers: To run the image and video generations and the clip processing you request; in the app, only after you accept. Who they are, what each one receives and the protection safeguards are described in Sections 12.2 and 12.3.
  • AI apps you connect: Only when you expressly authorize it, as described in Section 5.1 below.
  • Advertising and measurement platforms (such as Google, Meta and TikTok): when you sign up and when you start or complete a purchase, they receive click and browser identifiers, your IP address and approximate location, and your email, phone number and name converted into a hash, to measure the results of our campaigns.
  • Legal compliance: When required by law, court order, or to protect our rights and users' safety.

We will NEVER sell your personal data to third parties.

5.1 AI apps you connect

You may connect third-party AI apps (for example Claude, ChatGPT, Cursor, VS Code or Gemini) to your account through the platform's MCP server, using the OAuth standard. A connection only exists if you start it from the AI app and approve it on a consent screen of the platform, where you choose the workspace and the permissions granted.

What is shared. While the connection is active, and only when you ask the AI app for something, it receives, within the permissions you granted: your name, plan, credit balance, subscription, charge history, rewards and notifications; workspace data (name, your role, other spaces and spend limit); titles, descriptions, thumbnails, transcripts and the video files of the projects and clips in the chosen workspace, with their translations and dubs (including the dubbed audio) and the analyses generated about them (scores and suggested segments); library items (templates, brand kits, caption styles and saved prompts, plus other users' public templates and videos); the AI-generated images and videos and the prompts used to generate them; and, with the social permission, your connected social accounts, posts, schedules, metrics and contests. Other workspace members' e-mails, comments received on your posts and the names of who commented, your e-mail and your payment details are not shared through this channel; your phone number only passes through it when you type it in the chat yourself to enter a contest.

Purpose. Carrying out the requests you yourself make to the AI app (for example: listing projects; creating, editing, translating, dubbing and rendering clips; generating AI images and videos; posting and scheduling on your social accounts; entering contests for you), within the permissions and the daily credit budget you set at consent. Anything that spends credits, publishes in your name or requires accepting terms happens only after your confirmation, and the voice consent for dubbing is given only on the Platform.

No model training. Data and content the platform receives or creates through AI apps you connect are processed only to carry out the requests described above, with the security and moderation measures in Section 12.1, and are not used by VIRAL DAY LLC to train artificial intelligence or machine learning models.

Independent controller. The AI app vendor is a third party that processes this data as an independent controller under its own privacy policy, not as our processor. We recommend reading the vendor's policy before connecting.

International transfer. These vendors process data outside Brazil and possibly outside your country. The transfer relies on your specific and prominent consent, collected on the consent screen (for Brazilian users, under Article 33, item VIII of the LGPD), and is limited to the data and permissions you authorized.

Retention. The authorization record (app, workspace, permissions, date and origin of consent) and the connection's usage log are kept for 90 (ninety) days after revocation, for security, audit and request-handling purposes, and deleted afterwards.

Revocation. You can revoke a connection at any time under Settings › Security › Connected apps on the web version of the platform. Revocation immediately stops the AI app's access; data it has already received remains subject to the vendor's policy, and you may exercise your rights directly with the vendor.

6. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including:

  • Data encryption in transit and at rest
  • Strict access controls
  • Continuous security monitoring
  • Regular team training in security practices
  • Data backup and recovery policy

7. Your Rights

Under applicable data protection laws (GDPR, CCPA), you have the following rights:

  • Confirmation and Access: Know if we process your data and access it.
  • Correction: Request correction of incorrect or outdated data.
  • Anonymization, Blocking or Elimination: Request these actions for unnecessary or excessive data.
  • Portability: Receive your data in structured format.
  • Deletion: Request deletion of your personal data.
  • Information: Be informed about data sharing.
  • Consent Revocation: Withdraw your consent at any time.
  • Objection: Object to processing based on legitimate interest.

8. Account Deletion

You can delete your account at any time by accessing Settings → Security within the application.

Important: Account deletion is a permanent and irreversible action. When you delete your account:

  • All your personal data will be removed from our systems
  • All created content, videos, projects, and settings will be permanently deleted
  • Connections with third-party platforms (YouTube, TikTok, Instagram) will be unlinked
  • Usage history and preferences will be eliminated
  • It will not be possible to recover the account or any information associated with it afterwards

We recommend that you back up any important content before requesting account deletion.

9. Retention Period

We maintain your personal data for the time necessary to:

  • Fulfill the purposes for which they were collected
  • Meet legal and regulatory obligations
  • Exercise rights in judicial or administrative proceedings

After the necessary period, data will be deleted or anonymized.

Photos and videos you upload to generate AI images and videos, the generated content, the related prompts and avatars are stored in your account until you request their permanent deletion, as described in Section 12.2. Videos uploaded for clips and the analysis made on them are deleted automatically when the project expires, as described in Section 12.4. The associated usage and billing records are kept for the legally required periods.

10. Cookies and Similar Technologies

We use cookies and similar technologies to:

  • Improve browsing experience
  • Personalize content and offers
  • Analyze application usage

You can manage your cookie preferences through the application settings.

11. International Data Transfers

Providing the Platform involves international data storage, access, and processing operations, as described below.

11.1 Infrastructure in the United States

The Platform's database, frontend, applications, and backend are hosted and operated in the United States. Therefore, account and registration data, usage records, and other data described in this Policy may be stored and processed in that country to operate, maintain, secure, and support the Platform.

11.2 Temporary video processing in Asia

Only video files uploaded by the user may be securely transmitted and automatically processed by service providers in environments located in China, Taiwan, and Japan. This processing is performed solely to provide the video analysis and clip-generation features requested by the user.

Videos may contain personal data, including images, voices, and other information included in the content itself. Registration data and the Platform's database are not transferred to these three countries as part of this video processing.

Video files remain in these processing environments for no more than 60 (sixty) calendar days from upload and are deleted from those environments after that period.

11.3 Safeguards and data subject rights

The service providers involved act as processors or subprocessors, must process files according to our instructions, and are not authorized to use them for their own purposes. We remain responsible for decisions concerning the processing of personal data.

International transfers are performed to provide the services requested by the user and rely on the applicable mechanisms required by data protection law, including, as appropriate, contractual necessity and contractual safeguards. We apply measures such as data minimization, confidentiality obligations, access controls, data protection during transmission, and security measures appropriate to the risks of processing.

Transfers to AI apps you connect are not governed by this section: they take place under the separate regime of Section 5.1 (the vendor as an independent controller, based on your specific consent).

You may request additional information about international transfers and exercise the rights described in Section 7 through the channel listed in Section 17.

12. Use of Artificial Intelligence

We use Artificial Intelligence (AI) technologies to enhance functionality, security, and personalization of the user experience on the platform. AI applications include, but are not limited to:

  • Face detection:

    • Locating faces and who is speaking in each scene, to automatically frame the short videos we generate. We do not identify who people are. Details are in Section 12.4.

  • Audio transcription:

    • Automatic conversion of speech to text to facilitate indexing, searching, and video editing.
    • Analysis of preferences and consumption patterns to suggest relevant cuts and themes.
    • Identification of recurring topics and content trends.

  • Security:

    • Detection of suspicious activities
    • Fraud prevention
    • Protection against platform misuse

  • Speech diarization:

    • Separation of speech by speaker with the objective of refining automated editing and cut personalization.
    • Extraction of contextual information such as accent, regionalism, and humor.

AI systems are used ethically and transparently, always respecting your privacy and applicable data protection principles.

12.1 Moderation of Generated Images and Videos

Generating pornographic, sexually explicit, or sexualized nude content is prohibited on the Platform under Section 4.1 of the Terms of Service and results in the permanent ban of the account, without any refund. To enforce this rule, based on legitimate interest and compliance with legal obligations:

  • Prompts, images, and videos uploaded or generated on the Platform may be analyzed by automated moderation systems and, when necessary, by human review;
  • In case of violation, account data, usage records, and the content that led to the ban may be retained for as long as necessary to prevent the same user from creating new accounts, to comply with legal obligations, and to exercise legal rights in judicial or administrative proceedings, even after the account is closed;
  • Content involving children or adolescents, or content subject to a lawful request, will be shared with the competent authorities.

12.2 AI Image and Video Generation

This section explains what data we send to AI providers when you generate images and videos, who receives it, how we ask for your permission and what the data is used for. It applies to every generation feature on the Platform, including images, videos, Xablau, AI Influencer, video apps and thumbnails.

What data we send. Only what is needed to run your request:

  • the text instructions (prompts) you write;
  • the photos and reference images you upload, which may show people's faces and other features;
  • reference videos and, when the feature needs them, frames and audio from those videos, which may contain people's image and voice;
  • the options you choose for the generation (model, duration, format and resolution).

We do not send your name, email, phone number, payment data or device data to these providers. To prevent abuse, BytePlus also receives a pseudonymous account identifier, a hashed code that does not reveal who you are.

How we collect it. This data is collected only when you type it, or select and upload it, yourself to start a generation.

Who we send it to. The providers listed in Section 12.3, each receiving only the data for the features it runs.

Your permission. In the app, before anything is sent for the first time, we show a notice about what goes to AI services: the videos and photos you upload, the audio of your videos and its transcript, and the text you write in your requests, along with who receives them. We only send it after you accept. When the notice text changes, the app asks for your consent again. On every version of the Platform, nothing is sent unless you start a generation. You can stop using these features at any time and withdraw your consent through the contact channel in Section 17.

What we use it for. This data is used only to: (i) run the generation you requested and deliver the result to your account; (ii) moderation and safety, as described in Section 12.1; and (iii) billing and legal compliance. VIRAL DAY LLC does not use your prompts, your reference images and videos or the generated content to train its own models. The legal bases are contract performance and, in the app, your consent.

Equivalent protection. The providers in Section 12.3 act as processors for VIRAL DAY LLC. They process the data only to provide the service, under contracts and terms of use that require confidentiality, security and protection equal to or equivalent to that described in this Policy, and they may not use it for their own purposes. We only share data with providers that offer this level of protection. Transfers outside your country follow the safeguards in Section 11.3.

Retention. Reference photos and videos, generated content and avatars are stored in your account, in our cloud storage (Section 11). You can request permanent deletion of these files at any time through the contact channel in Section 17, and it is carried out within 15 (fifteen) business days. Records of each generation (model used, date and credits deducted) are kept for billing, security and legal compliance purposes. Providers keep the data only as long as needed to run the request, for security and abuse prevention, and to meet legal obligations. Moderation of this content follows Section 12.1.

12.3 AI providers that receive your data

The files, audio and text you send for AI processing, both for image and video generation and for clip creation, are received by:

  • BytePlus Pte. Ltd. (Singapore): text, photos and reference videos to generate AI videos.
  • Alibaba Cloud (China): text, photos, videos and video frames to generate AI videos and plan edits, and clip transcripts to write hooks and descriptions.
  • OpenRouter, Inc. (United States): text, photos and video frames, which it passes on to the AI model each feature uses.
  • Other AI model providers (United States and other countries): videos, photos, video frames, transcripts and text to generate images and videos, write titles, descriptions and edits, translate captions, check them for content that is not allowed and locate people in reference photos and videos.
  • Transcription, voice and language model providers (United States, Spain and other countries): the audio and transcripts of your videos and the scripts of narrated videos, to transcribe them, pick the best moments, write titles, hooks and descriptions, plan edits, translate captions and create voices.
  • GPU server providers (United States and other countries): servers running our own AI models, which process videos, photos and audio.

All of them are subject to the same rules in this section and in Section 12.2.

12.4 Face data

This section explains, in one place, how we handle face data.

What we collect.

  • The photos and videos with faces that you upload: videos for clips, reference photos and videos to generate AI images and videos (including Xablau and Xablau Lite) and photos to create avatars and the AI Influencer.
  • The face positions our servers work out to frame clips: where each face is in each frame, who is speaking, the path of each face through the scene and an approximate expression label (for example, neutral or happy).

To follow the same face through a video, our servers compute temporary numeric face-appearance vectors. They exist only in memory during processing and are never saved. Each person gets an anonymous label ("person 1", "person 2") that is valid only within that clip and is not linked to any other video. We do not keep face databases and we do not recognize who people are.

What we use it for. Only to run the feature you requested: framing clips on whoever is speaking, locating people in reference photos and videos, and performing the character swap or generation you asked for. Face data is never used for advertising, usage analytics, identifying people or training facial recognition models.

Who receives it.

  • Our own models, on contracted GPU servers (Section 11): face analysis for clips and Xablau Lite.
  • BytePlus Pte. Ltd. (Singapore): reference photos and videos for AI Video in Ultra mode.
  • Alibaba Cloud (China): reference photos and videos to generate AI videos, and video frames to plan edits.
  • OpenRouter, Inc. (United States): reference photos and video frames, which it passes on to the AI model each feature uses: to locate, describe and check people in Xablau, to write prompts for AI videos and to generate AI images, thumbnails and avatars.
  • Other AI model providers (United States and other countries): reference photos and videos for Xablau and other generations, the photos used to create avatars and, to locate people, the reference photos and one frame of the video.

All of them follow the rules in Sections 12.2 and 12.3. The temporary appearance vectors never leave processing on our servers.

Where it is stored and for how long.

  • Face positions are stored with the clip analysis, in our cloud storage (Section 11), and are deleted automatically together with the video when the project expires: 3 days for accounts that never subscribed to a plan, 7 days after a subscription ends and 31 days for active subscribers. In the processing environments described in Section 11.2, videos are kept for no more than 60 days.
  • The temporary appearance vectors are discarded at the end of each processing job.
  • The photos and videos you upload to generate images and videos or to create avatars, and the results, are stored in your account until you request their permanent deletion.
  • At providers, data is kept only for the period described in Section 12.2.

How to delete it. You can request deletion of your photos, videos and face data at any time through the email in Section 17, and it is carried out within 15 (fifteen) business days. Face analysis for clips is also deleted automatically when the project expires, within the periods above.

13. YouTube Integration

13.1 YouTube Account Connection

When you connect your YouTube account to our platform, you authorize us to:

  • Publish videos: Upload content created on our platform directly to your YouTube channel
  • Update videos: Modify titles, descriptions, tags, and other properties of videos published through our platform
  • Delete videos: Remove from YouTube only videos that were originally published through our platform

13.2 Access Limitations

  • We can only manage videos that were published through our platform
  • We do not have access to or ability to modify videos you published directly on YouTube
  • You can revoke these permissions at any time through your Google/YouTube account settings

13.3 YouTube Data Collection

When you connect your YouTube account, we collect:

  • Basic channel information: Channel name, channel ID, profile picture
  • Published video statistics: Views, likes, comments for videos created through our platform
  • Upload status: Information about successful or failed uploads

13.4 Use of YouTube Information

We use YouTube data to:

  • Facilitate content publishing
  • Display performance statistics for your videos
  • Improve our integration functionality
  • Provide technical support when needed

13.5 YouTube Policy Compliance

Our integration is in full compliance with:

  • YouTube Terms of Service
  • YouTube Privacy Policy
  • YouTube API Services Terms of Service

Important: You can disconnect your YouTube account at any time through the platform settings, which will revoke all granted permissions.

14. TikTok Integration

14.1 TikTok Account Connection

When you connect your TikTok account to our platform, you authorize us to:

  • Publish videos: Upload content created on our platform directly to your TikTok profile
  • Update videos: Modify titles, descriptions, hashtags, and other properties of videos published through our platform
  • Delete videos: Remove from TikTok only videos that were originally published through our platform

14.2 Access Limitations

  • We can only manage videos that were published through our platform
  • We do not have access to or ability to modify videos you published directly on TikTok
  • You can revoke these permissions at any time through your TikTok account settings

14.3 TikTok Data Collection

When you connect your TikTok account, we collect:

  • Basic profile information: Username, user ID, profile picture
  • Published video statistics: Views, likes, comments for videos created through our platform
  • Upload status: Information about successful or failed uploads

14.4 Use of TikTok Information

We use TikTok data to:

  • Facilitate content publishing
  • Display performance statistics for your videos
  • Improve our integration functionality
  • Provide technical support when needed

14.5 TikTok Policy Compliance

Our integration is in full compliance with:

  • TikTok Terms of Service
  • TikTok Privacy Policy
  • TikTok Developer Terms

Important: You can disconnect your TikTok account at any time through the platform settings, which will revoke all granted permissions.

15. Instagram Reels Integration

15.1 Instagram Account Connection

When you connect your Instagram account to our platform, you authorize us to:

  • Publish Reels: Upload content created on our platform directly as Instagram Reels to your profile
  • Update Reels: Modify titles, descriptions, hashtags, and other properties of Reels published through our platform
  • Delete Reels: Remove from Instagram only Reels that were originally published through our platform

15.2 Access Limitations

  • We can only manage Reels that were published through our platform
  • We do not have access to or ability to modify content you published directly on Instagram
  • You can revoke these permissions at any time through your Instagram/Facebook account settings

15.3 Instagram Data Collection

When you connect your Instagram account, we collect:

  • Basic profile information: Username, user ID, profile picture
  • Published Reels statistics: Views, likes, comments for Reels created through our platform
  • Upload status: Information about successful or failed uploads

15.4 Use of Instagram Information

We use Instagram data to:

  • Facilitate content publishing
  • Display performance statistics for your Reels
  • Improve our integration functionality
  • Provide technical support when needed

15.5 Instagram Policy Compliance

Our integration is in full compliance with:

  • Instagram Terms of Service
  • Instagram Privacy Policy
  • Instagram API Terms
  • Meta/Facebook Developer Policies

Important: You can disconnect your Instagram account at any time through the platform settings, which will revoke all granted permissions.

16. Policy Changes

This policy may be updated periodically. The most recent version will always be available in the application. Significant changes will be communicated through notification in the application.

17. Contact

To exercise your rights or clarify doubts:

  • Email: privacy@viral.day
  • Data Protection Officer: privacy@viral.day
  • Response time: up to 30 days

18. Governing Law

This Privacy Policy is governed by the laws of Delaware, United States. Any disputes will be resolved in the courts of Delaware.

Data Controller:

  • VIRAL DAY LLC

© 2026 Viral Day LLC. All rights reserved.