Legal

Privacy Policy

Version 1.0 · Last updated 12 November 2026

This policy explains what personal data DotShop LLC (“ViralCore”, “we”) collects through the ViralCore website and workspace, why we collect it, who processes it, how long we keep it, and the rights you have. Read it together with our Terms, Cookie Policy and Account Deletion page.

1. Who we are

Controller: DotShop LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.

Data protection and privacy enquiries: privacy@viralcore.app. When you use ViralCore on behalf of a company, that company is the controller of the brand, content and publishing data you put into the workspace, and we process it as its processor under our Terms.

2. Data we collect

• Account data: email address, display name, profile picture, password hash (never the password itself), or your Google/Facebook identifier and the name, email and avatar those providers share when you choose social sign-in; sign-in method, workspace role and last sign-in time.
• Workspace and brand data: brand name, niche, markets, voice and tone notes, example posts and brand assets you upload, platform list, posting schedule and approval policy.
• Connected platform accounts: the platforms you link, your handle/page identifier, the permissions (scopes) you grant, and OAuth tokens that let us post only when you approve or schedule it.
• Research data: public posts, formats and performance signals we scan for your niche, together with derived tags and metrics. This is public content, not data about your private accounts.
• Generated content: drafts, captions, scripts, images, renders, the prompts and model settings used, and the resulting files stored in our private storage.
• Action and approval records: what was approved, rejected, edited, scheduled or published and by whom; engagement and lead replies you ask us to send.
• Billing data: plan, subscription status, invoices, last four digits of the card and billing country. Card details are handled by Stripe; we never store a full card number.
• Support and communications: messages you send us, including email.
• Technical data: IP address, device and browser type, pages viewed in the workspace, error logs and security events.

3. How we use data

• Create and secure your account, sign you in and administer workspaces and roles.
• Analyse your brand, scan for working formats, generate drafts and renders, and publish only on your instruction.
• Run the approval queue and record decisions so the audit trail is complete.
• Bill you, manage plans and entitlements, and prevent fraud and abuse.
• Provide support, fix defects, and improve prompts, formats and the product using aggregated or de-identified signals.
• Comply with law and enforce our Terms and Acceptable Use policy.

We do not sell personal data, do not share it with advertising networks, and do not use your private brand data to train models for other customers.

4. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the workspace and publishing what you approve); legitimate interests (security, fraud prevention, product improvement and aggregated analytics); consent (optional emails and any optional storage you allow); and legal obligation (tax, accounting and lawful requests). You can object to processing based on legitimate interests at any time.

5. AI processing and providers

Generation, decision support and embeddings run on models we operate or call on our own infrastructure. Our primary language model is DeepSeek; embeddings are produced with an open model (BGE-M3) on our own hardware, and video is rendered with open Chinese models or MoneyPrinterTurbo on our workers. We send only what is needed for the task: your brief, brand voice notes, examples, prompts and the material being analysed.

We do not permit our model providers to use your content to train their general models, and we do not use your content to train models for other customers. AI output can be wrong or derivative; that is why the Approval Gate is on by default and you decide what is published.

6. Connected platform accounts

When you connect Instagram, TikTok, X, YouTube, LinkedIn, Facebook, Threads, Pinterest, Snapchat or Reddit, you authorise us through that platform’s OAuth flow. We store the access and refresh tokens in encrypted form, use them only to read permitted data and to publish or reply as you instruct, and delete them when you disconnect the account or delete your workspace. The platform’s own terms and privacy policy also apply to that data. You can revoke access at any time in the platform’s settings.

7. Sharing and processors

We share data with service providers that host and run the Service, under contracts that limit them to our instructions:

• Supabase — database, authentication, file storage and access policies; project hosted in Singapore (ap-southeast-1).
• Vercel — website and API hosting, request logs and edge network.
• Stripe — subscriptions, invoices and payment processing.
• DeepSeek — text generation for drafts and captions.
• Model and render workers — open video, image and embedding models running on our own or contracted GPU capacity.
• Social platform APIs — Meta, Google/YouTube, TikTok, X, LinkedIn, Pinterest, Snapchat and Reddit, when you connect an account or publish.
• Email delivery — transactional messages such as sign-in and billing notices.

We also disclose data where required by law, to enforce our Terms, or as part of a merger or acquisition (with notice where required). Professional advisers and auditors are bound by confidentiality.

8. International transfers

Our database is hosted in Singapore and several processors operate in the United States, the European Union and Asia. Where personal data leaves the EEA, UK or Switzerland, we rely on Standard Contractual Clauses, the UK Addendum, and equivalent safeguards, together with technical measures such as encryption in transit and at rest.

9. Cookies and local storage

We use only what sign-in and preferences require: an authentication session, a check that keeps it fresh, and your light/dark theme. There are no advertising pixels or analytics cookies on the site today. Full detail, durations and how to clear them are in the Cookie Policy.

10. Retention

• Account and workspace data: for as long as the workspace is active.
• Drafts, renders and generated files: until you delete them; unpublished renders are cleared 90 days after creation unless you keep them.
• Approval and audit records: 24 months.
• Billing and tax records: up to 7 years, as required by law.
• Security and request logs: up to 12 months.
• Backups: deleted data leaves encrypted backups within 30 days.

After those periods we delete or anonymise the data. See Account Deletion for the workflow and exceptions.

11. Security

Traffic is encrypted with TLS, data is encrypted at rest, and every tenant table is protected by row-level security so one workspace cannot read another. The service-role key stays on our servers; browsers only receive the public key. Access to production is limited, logged and reviewed. No system is perfectly secure, but if a breach affects your rights we will notify you and the regulator as the law requires.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or port your data, to object to processing, to withdraw consent, and to complain to a supervisory authority. Under the CCPA/CPRA you also have the right to know what we collect and to opt out of sale or sharing — we do neither. Comparable rights exist under Brazil’s LGPD, India’s DPDP Act, China’s PIPL, Singapore’s PDPA, South Africa’s POPIA and Australia’s Privacy Principles.

Exercise any right at privacy@viralcore.app; we reply within 30 days and may ask you to verify control of the account email. You can also delete your account yourself from the steps on the Account Deletion page. If you are in the EEA or UK, you may complain to your local data protection authority; in the US you may contact your state attorney general.

13. Children

ViralCore is a business tool for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

14. Automated processing

We use automation to rank formats, draft content and schedule posts, but publishing is subject to the Approval Gate by default. Autopilot, where you enable it, follows the rules and limits you set and can be switched off at any time. We do not make decisions with legal or similarly significant effects about individuals through automated processing alone.

15. Changes

We will post any update on this page with a new version and date, and for material changes we will notify workspace owners by email before they take effect. Continuing to use the Service after an update means you accept the revised policy.

16. Contact and complaints

Privacy: privacy@viralcore.app · Support and billing: support@viralcore.app · Legal: legal@viralcore.app. Postal: DotShop LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.