Privacy policy

Our team is the controller of personal data collected through viralGTM. Contact details are at the bottom.

Depending on what you do, we hold:

• Account. Email address, name, a hashed password. We never store a password we could read.
• If you join the waitlist. Email address, whether you said you were a brand or a creator, and which page you signed up from.
• Creators. X handle, and from the X profile: display name, avatar, bio, location, website, and follower count. The rates you set, what you said when you applied, and any private X Analytics screenshot you provide as review evidence.
• Brands. Company name, what you sell and who you sell to, your briefs, your campaigns.
• If you sign in with X. We use the short-lived provider token once to read the profile details listed above. We do not retain that token or refresh it. Read access only. We cannot post as you.
• Bookings. What was agreed, at what rate, which post it produced, and the daily figures for that post.
• Technical. Server logs from our host: IP address, user agent, page, timestamp. Failed sign-in attempts, which is how the rate limit works.

We do not collect special category data and we do not ask for it.

At X sign-in, we read the public profile data needed to prefill a creator application: display name, handle, profile image, bio, location, website, and follower count. We do not currently sync X post metrics or retain an X token after sign-in.

We never ask for permission to post, and never for direct messages. When a creator chooses to upload X Analytics evidence, the image is kept private for our review team. It is not automatically verified or used to make an automated decision.

A creator’s rates are commercially sensitive and we treat them that way. They are shown to brands inside the product so a booking can be made, and to nobody else.

We do not publish individual rates. Where the public site mentions cost it is an aggregate across the network or an invented example, never a named creator’s price.

• Running your account and the bookings you make: performance of a contract.
• Showing creators to brands so the marketplace works: legitimate interests, and for creators, the reason you applied.
• Measuring posts and keeping the record of what was delivered: legitimate interests, and necessary to settle what is owed.
• Security, rate limiting, and preventing abuse: legitimate interests.
• Tax and accounting records: legal obligation.
• Marketing emails, where we send them: consent, withdrawable at any time.

• Our hosting provider, for running the site and the application.
• Our database provider, which stores everything above.
• Our payment provider, which handles plan billing and creator payouts. They will need identity and tax details from creators before paying out, and they hold that directly under their own policy.
• X, when we read data on your behalf.
• Our email provider, for account and campaign notifications.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

Brands and creators see each other: a brand sees a creator’s profile and rates, and a creator sees which brand is briefing them. That is the product working, not a disclosure to a third party.

Some providers process data outside your country, including in the United States. Where that means a transfer out of the UK or EEA it is made under appropriate safeguards, such as Standard Contractual Clauses.

• Account data, while the account is open and for up to 12 months after it closes.
• Bookings, posts and captured figures, for 7 years. These are financial records and evidence of delivered work, so they outlive the account.
• Waitlist entries, until we launch and for 12 months after, or until you ask us to remove you.
• Creator application evidence, including private X Analytics screenshots, while the account is open and for up to 12 months after it closes.
• Sign-in attempts, 30 days.
• Server logs, under our providers’ standard periods, typically short.

Depending on where you live, you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything wrong.
• Delete it.
• Stop or restrict processing we base on legitimate interests.
• Hand it over in a portable format.
• Withdraw consent where we relied on it.

Email legal@viralgtm.ai. We will not charge you and we will come back within a month.

Deletion has a limit worth stating plainly: we cannot delete the record of a booking that was paid for, because that is an accounting record and evidence of work delivered.

California residents have rights to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of. In the UK or EEA you can complain to your supervisory authority.

We set a session cookie when you sign in, and that is what keeps you signed in. There is no advertising cookie and no cross-site tracking pixel. Turning the session cookie off will stop you signing in.

Passwords are hashed with a slow algorithm designed for the purpose and never stored in a form we can read. Sign-in attempts are rate limited. Access to production data is restricted. No system is perfect, and we will tell you and the relevant regulator if a breach affects you.

This is a product for businesses and for adults working as creators. It is not for anyone under 18, we do not knowingly collect their data, and we delete it if we find it.

If we change this in a way that matters, we will say so in the product rather than quietly reposting the page.

Privacy questions and rights requests: legal@viralgtm.ai. Anything else: team@viralgtm.ai. Our terms are here.