Privacy Policy

This Privacy Policy describes how ViralDM ("we", "us", "our") collects, uses, and shares information when you use our services available at viraldm.app (the "Service").

1. Information We Collect

Account Information

• Name, email address, password (hashed)
• Profile picture (if provided)
• OAuth IDs (Google, GitHub) if you sign up via OAuth

Social Media Account Data

When you connect Instagram, Facebook, or YouTube, we receive (with your permission):

• Account ID, username, profile picture
• Access tokens to perform authorized actions on your behalf
• Messages and comments from your connected accounts (only what you've authorized)

Subscriber Data

When users interact with your automations, we collect:

• Their platform user ID and username
• Messages they send to your accounts
• Custom fields you collect via flows (email, phone if provided)

Usage Data

• IP address, browser type, device info
• Pages visited, features used, time on site
• Error logs and diagnostic data

Payment Information

Web payments are processed by Razorpay; purchases in the Android app are processed by Google Play Billing. We don't store your full card details. We retain transaction IDs, amounts, dates and (for Play) purchase tokens for billing/tax purposes.

UPI Payment Screenshots (optional feature)

If you turn on UPI Payment Verify, screenshots that your subscribers send you as proof of payment are analysed by an AI model (Google Gemini) to read the amount, UTR/reference number, timestamp and payee handle. The screenshot and the extracted fields are stored with the verification record so you can review it. This may include the subscriber's name or UPI id as shown on their screenshot.

Notifications

If you enable browser push notifications we store the push subscription (endpoint and keys) your browser gives us. We also send the operator an internal alert (via Telegram) when an account signs up, pays or cancels — it carries your name, plan and amount, nothing else.

2. How We Use Your Data

• Provide and operate the Service
• Process automations on your behalf
• Generate AI-powered replies using third-party AI providers
• Send service emails (account, billing, security)
• Improve and analyze the Service
• Comply with legal obligations
• Prevent fraud and abuse

3. Data Sharing

We share data only with:

• Meta (Instagram/Facebook) and Google (YouTube) — to perform automations you've authorized
• AI providers (Google Gemini, DeepSeek, OpenAI, AWS Bedrock — one is used per request, in that fallback order) — message text for AI reply generation (no personal data sent unnecessarily)
• Razorpay — for web payment processing; Google Play — for purchases made in the Android app
• Google Gemini — UPI payment-screenshot analysis, only when you enable that feature
• Cloudinary — storage and delivery of media you upload for posts
• Browser push services (Google, Apple, Mozilla) and Telegram — to deliver notifications (see above)
• Cloud hosting (Google Cloud Platform — Mumbai, India region) — to operate infrastructure
• Legal authorities — when required by valid legal process

We never sell your personal data.

4. Data Retention

• Account data: until you delete your account
• Automation logs: 90 days (free), 1 year (paid)
• Subscriber data: until you delete them or close account
• Payment records: 7 years (Indian tax law)

5. Your Rights (GDPR + Indian DPDPA)

You have the right to:

• Access your data — download from dashboard
• Correct inaccurate data
• Delete your account and data anytime — see Data Deletion Instructions
• Port your data to another service
• Object to certain processing
• Withdraw consent for OAuth integrations

To exercise rights, email [email protected]

6. Security

• All connections use HTTPS/TLS encryption
• Passwords are bcrypt-hashed (never stored plain)
• Social access tokens are encrypted at the application layer (AES-256-GCM) before they are stored; all data is additionally encrypted at rest (disk-level) on Google Cloud
• Periodic internal security reviews and automated dependency checks
• Database backups encrypted

7. Cookies

We use essential cookies for authentication and security only; we currently run no third-party analytics. See our Cookie Policy.

8. Children's Privacy

Accounts are for users 18 and over. We don't knowingly collect data from minors as account holders.

Subscribers (people who message a creator): we process their data on behalf of the creator, as the creator's processor. We do not profile subscribers or target advertising at them. Creators must not use the Service to collect personal data from anyone under 18 without verifiable parental consent, as required by the Digital Personal Data Protection Act, 2023.

9. Where Your Data Lives (Data Localization)

Primary hosting is in India — our application and database run on Google Cloud Platform's Mumbai (asia-south1) region, so your account data, subscriber data, and messages are stored in India by default.

Limited processing happens outside India only where a provider requires it:

• USA — Google Gemini API, OpenAI, AWS Bedrock (AI text generation), Cloudinary (media CDN), Google (OAuth)
• China — DeepSeek (AI text generation, used only when Gemini is unavailable)
• USA / EU — Meta (Instagram/Facebook APIs, inherent to the platform)

Payment data is processed and stored in India by Razorpay in line with RBI data-localization requirements. All cross-border transfers comply with the DPDP Act 2023 and applicable data protection laws.

10. Changes to This Policy

We'll notify you via email/dashboard for material changes. Continued use after changes means acceptance.

11. Grievance Redressal (India — IT Rules 2021 & DPDP Act 2023)

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

Grievance Officer: Jeetmal Kumawat
Entity: Vyzonek Technology Private Limited (CIN: U58201DC2026PTC473496), Patel Nagar West, New Delhi, Central Delhi – 110008, India
Email: [email protected] (subject line: "Grievance")

ViralDM began as Kings 11, the sole proprietorship of Jeetmal Kumawat (MSME UDYAM-RJ-07-0010091), and was incorporated as Vyzonek Technology Private Limited on 25 July 2026. Some third-party platform accounts remain registered to the proprietorship while they are transferred — including the Meta Business Account behind our Instagram API integration. Both are owned by the same founder. Vyzonek Technology Private Limited is the data controller (Data Fiduciary) for all personal data described in this policy.

• Complaints are acknowledged within 24 hours
• Complaints are resolved within 15 days of receipt
• If unsatisfied with our resolution, you may escalate to the Data Protection Board of India as provided under the DPDP Act 2023

As a Data Principal under the DPDP Act you may also withdraw consent at any time (disconnect integrations from your dashboard or delete your account) and nominate another individual to exercise your rights in case of death or incapacity (email us to record a nomination).

12. Contact

Privacy questions: [email protected]
Data Protection Officer: [email protected]
Grievance Officer: [email protected]