Privacy Policy

Viralyshop is a service of Scalemind, LLC, a limited liability company (LLC) registered in the State of Delaware, United States, under file number 10469525. Its registered office is at 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

The team runs the service from Algiers. Viralyshop serves Algeria first, and amounts are in Algerian dinars (DZD).

Scalemind, LLC is the controller of the data of accounts, creators, merchants, the Instagram, TikTok and YouTube accounts that creators verify, and clicks on tracked links. In this policy, "we" means Scalemind, LLC.

Data of merchants' customers

When a customer orders from a merchant, the merchant is responsible for its customer's data. Viralyshop processes that data to run the service for the merchant: handling the order, tracking the delivery and calculating the creator's commission. We also process it for our own fraud prevention.

For any question about your data, write to our data protection contact: privacy@viralyshop.com.

This policy covers:

• the website viralyshop.com;
• the app app.viralyshop.com, used by merchants, creators, our team and the ZR Express desks;
• the product pages that merchants publish with Viralyshop, on a viralyshop.com address (for example myshop.viralyshop.com) or on their own domain name;
• creators' tracked links, on go.viralyshop.com;
• the API and scripts that merchants' online stores, such as Shopify, call to send us their orders.

It concerns these people:

• visitors to the website;
• creators, managers who manage influencers, and the influencers a manager adds before they have their own account;
• merchants and the members of their team;
• our operations team and the clerks at ZR Express desks;
• customers who order from a merchant;
• creators without an account whom a merchant invites by email from the creator marketplace.

It does not cover the services of Instagram, TikTok, YouTube or Google, or merchants' own websites and stores. Each has its own privacy policy. Instagram, TikTok and YouTube are trademarks of their owners; YouTube belongs to Google. Viralyshop is not affiliated with, endorsed or sponsored by Meta, TikTok or Google.

Here is each category of data, with the real fields. We collect only what the service needs.

Your account

• Sign-in with Google: your name, your email address, your profile photo and your Google account ID. It is the only way the public can sign up. The details are in the Sign-in with Google section.
• Accounts of our team and of the desks: name, email address and password. We keep only a fingerprint (hash) of the password, never the password itself.
• WhatsApp number: every creator or merchant account verifies a mobile number with a 6-digit code sent by WhatsApp.
• Preferences: language, country and time zone.

Profile and sign-up answers

• Merchant: account type (brand, agency or local business), agency name, activity, number of locations, whether you manage several brands, display name, shop address (its subdomain), sector, wilaya, website, campaign types, sales channels, delivery method, and whether your WhatsApp number is shown to creators and customers.
• Merchant company details: legal name, NIF (tax ID), contact email and phone, website, wilaya, commune, address and logo.
• Creator: account type (creator or manager), handle, display name, bio if you add one, wilaya, niches (at most 3), languages of your content, declared TikTok and Instagram accounts, your yes or no answer to the auto-entrepreneur card question, and your chosen payout method.
• Creator's extra phones: up to 5 numbers. They are used to detect orders placed from your own phones, or from your manager's phone while the manager manages your account, which earn no commission.
• Sample delivery address: when a creator applies to a call for offers that sends a product sample, their wilaya, commune, address and a phone number.
• Manager: the number of influencers you manage and, for each influencer you add, their display name, handle, phones and social media usernames. Add only a person who has agreed to it. That person then accepts the invitation with their own account. For your withdrawals: your ID document, your auto-entrepreneur card (encrypted number and photo) and your transfer accounts, in your name.

Creator payouts

• Payout details: for a transfer, the account holder's name, the CCP or bank account number and the bank name. The number is encrypted; the app shows only its last 4 digits.
• Identity check: before the first payout, your full name, the type of ID (national ID card, passport or driving license), its number and a photo of the document. The number is encrypted. At a ZR Express desk, the clerk types your ID number to compare it.
• Payouts: amounts, pickup codes, desk, dates and how your identity was checked.

Instagram, TikTok and YouTube accounts

The accounts you verify with a code, and the public data we read from them, are described in the Instagram, TikTok and YouTube section.

Orders and customer data

• What the customer types on a product page, an embedded form or the merchant's store: name, phone, optional second phone, wilaya, commune, address, note, products, variants and quantities. An order that comes from Shopify can also contain an email address. If the merchant installs our script on its store and the customer came from a creator's link, the script sends us a copy of the submitted order form, so that we can find the order and credit the creator.
• What the merchant adds: orders typed by hand or imported, confirmation, call notes and parcels.
• Attribution: the creator code used, the tracked link, its sub-IDs and the ad identifiers in the link, such as fbclid, ttclid or gclid.
• Anti-fraud data: time taken to fill in the form, a random tab ID, an encrypted fingerprint of the IP address, browser (user agent), number of submissions, risk score and its signals, duplicates, and orders placed from a creator's phone. For each shop, we also keep one record per customer phone number: name, wilaya, number of delivered, returned and cancelled orders, and any block.
• Delivery: statuses, tracking number, cash-on-delivery amount and delivery fee received from ZR Express.
• Quality checks: our team may call or message on WhatsApp a sample of customers to check that an order was really placed, received and paid. We keep their answers.

We never keep a phone number in plain text. It is stored encrypted, with a fingerprint used to find duplicates and a masked version for display.

Clicks on tracked links

When someone opens a creator's link on go.viralyshop.com, we record: the link, the campaign, the creator, the date, an encrypted fingerprint of the IP address (never the address itself), the browser (user agent), the device type, the site the visitor came from (its domain name only), the ad identifiers and sub-IDs in the link, and the landing page. The cv_click cookie that links the click to an order is described in Cookies and browser storage.

Messages, disputes and files

• Messages between brands and creators, and their attachments. Phone numbers written in a message are masked automatically.
• Disputes and reports: your explanations, the evidence you send (images or PDF) and our team's decisions. A creator who reports a missing order gives their customer's phone number, which we keep encrypted.
• Uploaded files: product images, videos for pay-per-video campaigns, screenshots of views, photos of ID documents and dispute evidence. They are kept in private storage.

Payments

For merchants: top-ups (amount, payment method, status, and the provider's or the cash request's reference), the wallet, campaign budgets, commissions and fees. For creators: earnings, their stages and payouts. We never see or keep a card number: you type it on the payment provider's page.

Technical data

• Sessions: the IP address and browser (user agent) of each sign-in session.
• Server logs: IP address, requested address and time of each request. Search text and signed links to files are removed from them.
• Error reports from our background jobs, and anti-abuse counters that keep an encrypted fingerprint of the IP address.
• Audit log: sensitive actions, for example who viewed an ID document or decided a dispute.

Acceptance of the terms

When you accept the creator or merchant terms, we keep the version you accepted, its language, the date, an encrypted fingerprint of your IP address and your browser (user agent).

Emails and notifications

We send service emails to your account's address: orders, payouts, disputes, campaigns, messages, a change of payout details. The same alerts appear in the app. We keep these notifications and a record of what was sent.

Creators invited without an account

In the creator marketplace, a merchant searches public TikTok, Instagram and YouTube profiles provided by Influencers.club: name, username, photo, bio, followers, accounts followed, number of posts, engagement rate, average views, likes and comments, date of the last post, location, niches and, sometimes, a business email address. If the creator has no account, the merchant can have an invitation sent to them by email. We keep the address encrypted, a record of the invitation and, if the person unsubscribes, a fingerprint of their address so that we never write to them again.

What is required

Sign-in with Google, a verified WhatsApp number, acceptance of the terms and the answers marked as required are needed to open your space. The identity check is needed to withdraw your earnings, and payout details to receive a transfer. Without them, we cannot open your space or pay you. All other fields are optional.

A creator can add their Instagram and TikTok accounts and their YouTube channels to their profile, to show their numbers to brands and be paid for their videos and posts. We never ask for your password, and you do not connect your account to Viralyshop: we have no access to your account. We read only what anyone can see on the public page of the account and of its posts.

Prove that an account is yours: the code in the bio

We give you a code (CV followed by 6 characters). You add it to the public bio of your Instagram or TikTok account, or to the description of your YouTube channel, then you click Verify. We then read the public profile and look for the code in it. The account must be public. Once the account is verified, you can remove the code.

Each account is verified with its own code. You can verify several accounts, several on the same platform too, up to 10 verified accounts in all. An account can be verified by only one creator.

Our public data provider

We read these public pages through our provider ScrapeCreators (Web Scraping Guy LLC, in the United States). For each reading, it receives only the account's public username, its public ID on the platform, or the public link of a post. It never receives your name, your email address, your phone number or any other data from your Viralyshop account. We use neither the Instagram API, nor the TikTok API, nor the YouTube API.

What we read

• The profile: the account's public ID (on YouTube, the channel's), the username, the display name, the bio (on YouTube, the channel description), whether the account is private, and the number of followers. On YouTube, this number is rounded by YouTube, and we read none if the channel hides it. To prove that the account is yours and show your numbers to brands.
• Your latest posts: the ID, the date and the number of views of each one, and whether it is pinned. To calculate your average views over your last 10 videos that are not pinned (on YouTube, your videos and your Shorts together). We do not keep this list, only the average.
• Posts sent to a campaign (a video in a pay-per-view campaign, the post of a call for offers): the ID, the link, the public ID of the account that posted it, the date, the views, the likes, the comments and, on TikTok, the shares. On YouTube, also the type of video (Short, video or live) and whether it is declared as paid promotion. To check that it comes from one of your verified accounts and that it is online, to pay for views and to catch fake views.
• The content of a video sent to a pay-per-view campaign: its cover, its duration, its caption (on YouTube, its title and description) and, when the public page of Instagram or TikTok gives it, its video file. YouTube never gives the file. For the content check described below.

What we do not read or do

We read only public data. We do not read your messages, the list of your followers, your private statistics, your profile photo or your password. We never post, comment, follow anyone or change anything on your account.

When we read

• The code in the bio: only when you click Verify.
• Your number of followers and your average views: right after the verification, then about once every 24 hours, as long as the account is verified on your profile.
• The views, likes, comments and shares of a video sent to a pay-per-view campaign: when you send it, then every 4 hours as long as the campaign counts its views, and one last time at its end. A rejected video is read only while its rejection can still be disputed. After the campaign ends, only an approved video is still read, until it is paid at the end of the hold period: a video still waiting for the brand's decision, or a rejected one, no longer is.
• The content of a video sent to a pay-per-view campaign: once, right after you send it, for the content check.
• The post of a call for offers: when you send its link, at the end of the hold period before it is paid, and 30 days after it was posted, to check that it is still online.

A post that is deleted or made private can no longer be read. We treat it as gone only after two readings in a row. An approved video then goes offline and we stop reading it; if it was still waiting for a payment, our team is told. A video still waiting for the brand's decision keeps its status, our team is told, and we keep reading it as long as the campaign counts its views. A rejected video whose rejection can still be disputed is read again at the next pass, as long as the campaign counts its views.

What we keep

For each verified account: its public ID, the username, the display name, the profile link, the followers, the average views and their history, the verification method and its date. We keep neither the text of your bio or description, nor the list of your latest posts. For each post sent to a campaign: its link, its ID, the public ID of its author, its date and every reading of its numbers. The periods are in How long we keep your data.

The automatic content check (Google Gemini)

When you send a video from a verified account to a pay-per-view campaign, we check it automatically, from its public page:

• With the file: when the public page of Instagram or TikTok gives the video file, we download it from the platform's servers into a temporary folder that is deleted right after. We send it to Google Gemini, which compares it with the campaign's brief and rules. The file is deleted from Gemini after the check, and at the latest 48 hours after it was sent.
• Without a file, and always on YouTube: we send Gemini the cover image, the caption (on YouTube, the title and description) and the duration.
• Copies: we compute fingerprints of the video (its pictures and its sound, or its cover and its duration when we do not have the file) to detect a video that was already sent. We compare it with the campaign's other videos and with the videos checked in the last 180 days. The same post sent to two campaigns is also caught by its ID.

Gemini receives this content with the campaign's title, brief and rules and the product name, never your name or your username. We keep the caption (with phone numbers masked), the duration, the fingerprints, and Gemini's opinion with its summary. This opinion is only an aid: the brand decides whether to accept the video, and our team decides on copies.

Accounts added by hand and screenshots

An account added by hand, without a code, is not verified: we read neither its profile nor its posts. Its numbers are the ones that were declared, and brands see them as declared numbers. When a campaign allows it, you prove the views of a video from this account with screenshots that our team reads and enters.

Who sees this data

Brands see your username, your followers, your average views and whether the account is verified: on your profile in the creator marketplace and on your applications. They also see the views of the videos sent to their campaigns. Our team sees them to check views and handle disputes.

What we never do

We do not sell, rent or license the data of your Instagram, TikTok or YouTube accounts. We do not use it for advertising or to target ads. We share it only with brands, as described above, and with the providers that run the service, including ScrapeCreators to read public pages and Google Gemini for the content check. We do not use it to train artificial intelligence models, and we use it only for the features described in this section.

Remove an account

In the app, open Profile, section Social accounts, then choose Remove next to the account and confirm. We stop reading its profile, its followers and its average views at once, and brands no longer see the account. You can no longer send a new video from this account to a campaign without verifying it again, except with screenshots when the campaign accepts them. Posts already sent to a campaign are still read through their public link as long as the campaign counts their views (a rejected video, only while its rejection can still be disputed), then, after the campaign ends, only the approved ones, until they are paid: we checked when they were sent that they were yours, and their views still count. A call-for-offers post is read one last time 30 days after it was posted. Numbers already read stay linked to your applications and payments. To erase them too, follow the data deletion page.

The old Instagram and TikTok connections

Until 4 October 2026, an account could also be connected with Instagram login (for professional accounts) or with TikTok Login Kit. We no longer use these connections, and we have erased all the access tokens they gave us. An account connected this way is no longer read: it shows To verify on your profile until you verify it with a code. If Viralyshop still appears in your Instagram or TikTok account settings, you can remove it there: see the steps for Instagram or TikTok.

You sign up and sign in to Viralyshop with your Google account. We ask only for the openid, email and profile permissions. Google gives us:

• your name;
• your email address;
• your profile photo;
• your Google account ID, which lets us recognize you at each sign-in.

We use them to create your account, sign you in, show your name and photo in the app, and send you service emails about your account. Google also gives us sign-in tokens: we keep them with your account and do not use them to access any other data in your Google account. We do not read your emails, contacts or files.

We do not sell this data. We share it only with the providers that host the service, and we do not use it for advertising or to train artificial intelligence models. Like the rest of your account, it is stored in our database, in Germany (Neon); the Security section describes how we protect it. We keep it as long as your account is open, and we delete it, sign-in tokens included, within 30 days of a deletion request.

Viralyshop's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Viralyshop's access at any time on the connections page of your Google account. This does not delete your Viralyshop account: to delete it, follow the data deletion page.

We also use Google as a provider for other needs, unrelated to your Google account: Gemini for the content check, Google Sheets when a merchant chooses it, and Google Fonts for fonts.

Signing in with Google gives us no access to your YouTube channel. If you verify a channel with a code, we read only its public page, through our provider ScrapeCreators, without Google's APIs: see Instagram, TikTok and YouTube.

Each use rests on a legal basis: performing the contract (the terms you accept), your consent, a legal obligation, or our legitimate interest, which we weigh against your rights.

• Create and manage your account, verify your number and sign you in: contract.
• Connect brands and creators and run campaigns, applications, messages and orders: contract.
• Credit a sale to the right creator through tracked links, creator codes and phone numbers: contract, and the legitimate interest of merchants and creators.
• Read the public data of your Instagram, TikTok and YouTube accounts and pay for views: contract. We start reading an account when you verify it with a code to use it in your campaigns, and stop when you remove it from your profile. Posts already sent to a campaign are still read so that they can be paid: as long as the campaign counts their views (a rejected video, only while its rejection can still be disputed), then, after the campaign ends, only the approved ones, until they are paid, and, for a call for offers, 30 days after they were posted.
• Check the content of videos sent (brief and copies): contract, and our legitimate interest in paying only for original videos that follow the brief.
• Collect top-ups, keep the accounts, pay creators and check their identity before a payout: contract and legal obligations, including accounting and tax.
• Prevent fraud and protect the service (risk score, duplicates, orders placed by a creator, fake views, check calls to customers, anti-abuse limits, logs): legitimate interest.
• Handle disputes and defend our rights: legitimate interest and legal obligations.
• Send you service emails and notifications: contract. We do not send advertising emails without your prior consent.
• Let a merchant invite a creator without an account whose business address is public: the merchant's legitimate interest in offering paid work, and the creator's interest in receiving the offer. Each email names the shop, says why the person receives it, and contains a free unsubscribe link.
• Host your data outside Algeria: necessary for the service you ask for, and your consent (see Transfers outside Algeria).

Some rules apply automatically: for example, a duplicate order or an order placed from a creator's phone earns no commission. Fraud signals and Gemini's opinion help a person, who decides. If you think an automatic rule was wrong, write to us or open a dispute: a person on our team reviews the case.

We do not sell any personal data. We share data only in the following cases.

Other users

• Brands see creators' profile (display name, handle, wilaya, whether the identity is verified, number of delivered orders, the manager's name if there is one, verified or declared accounts and their numbers), their applications, their messages and the results of their videos. They see neither creators' ID documents nor their phones, except the phone of the delivery address of a requested sample, for the time it takes to ship it.
• Merchants see their customers' orders in full, except an order that arrived when the campaign's budget was used up: the customer's details stay masked until the merchant tops up. Only the members who call customers (owner, admin, agent) see the full phone number; a read-only member sees it masked.
• Creators see, for orders that came from their links, the customer's first name and the initial of their last name, their masked phone, wilaya and commune, the product, quantity, amount and status. Never the address or the note.
• Creators and customers see a merchant's verified WhatsApp number, unless the merchant chooses to hide it.
• Managers act for the influencers they manage in campaigns, applications, messages and disputes. They never see the influencers' ID documents, payouts or payout details, nor the earnings of the campaigns the influencers join themselves; the earnings of a campaign a manager runs go to the manager.
• The ZR Express desk clerk sees, at the time of a payout, the creator's name, the amount and the photo of their ID document.
• Our team accesses the data needed for support, identity checks, fraud prevention, message moderation and disputes. Every view of an ID document is recorded.

Our providers

They process data on our behalf, following our instructions:

• Railway: hosting of the API, in the Netherlands.
• Neon: database, in Germany.
• Vercel: hosting of the website, the app and the product pages.
• A private file storage service, S3-compatible: uploaded photos, videos, ID documents and evidence.
• Resend: sending emails.
• Trigger.dev: scheduled jobs, such as reading views every 4 hours.
• Sentry: error reports from our background jobs.
• Google (Gemini): automatic check of video content.
• Meta (WhatsApp Business): sending the code that verifies your number.
• ScrapeCreators (Web Scraping Guy LLC): reading the public pages of Instagram, TikTok and YouTube, to find the code in the bio and read the numbers of accounts and posts. It receives only an account's public username, its public ID on the platform or the public link of a post, never your contact details.

Partners a merchant chooses to connect

• ZR Express, the carrier: for each parcel, it receives the customer's name, phones, address, commune, wilaya, the product, the amount and the note. It sends us back the delivery statuses. Its desks also pay creators in cash.
• Shopify: the merchant's store sends us its orders.
• Telegram and Google Sheets: if the merchant turns them on, they receive an alert for each new order, with the customer's name and masked phone, never the address or the note.

Payment providers

Merchants top up their budget by Visa or Mastercard card with Stripe, or by CIB or Edahabia card with Slick Pay, which goes through SATIM. You type your card on their page. We receive only the payment's status and reference. A cash top-up goes through no provider: a member of our team contacts the shop, using its account's contact details, to collect the money.

Influencers.club

For the creator marketplace, we send Influencers.club the merchant's search criteria or the username searched for. Influencers.club sends us back public creator profiles. We send it neither your account data nor your orders.

Authorities and cases set by law

We disclose data to an authority when the law requires it, at the request of a judge or a competent authority, or to defend our rights and those of our users against fraud.

If Scalemind, LLC is ever sold or merged, your data will pass to the new operator, who must respect this policy. We will tell you beforehand.

Your data is hosted outside Algeria. Our database is in Germany (Neon) and our API in the Netherlands (Railway). Several providers are companies established in the United States or process data there, including Railway, Neon, Resend, Vercel, Trigger.dev, Sentry, Google, Meta, Stripe, ScrapeCreators and Influencers.club. The partners a merchant chooses to connect, such as Shopify or Telegram, also process data outside Algeria.

These transfers are necessary to provide the service you ask for. They also rest on your consent, which you give when you create your account, by accepting this policy on the sign-in screen. For merchants' customers, the transfer is necessary to process the order they place. Each provider processes data under its contract with us and its own security commitments.

We keep data for as long as its use requires, then we delete it or make it anonymous.

• Account, profile, phones, sign-up answers, company details, payout details, preferences, notifications and content check results: as long as the account is open. After a deletion request, we delete them or make them anonymous within 30 days, except for what follows.
• Instagram and TikTok access tokens: we no longer receive any. Those the old connections gave us before 4 October 2026 have been erased.
• Data of your Instagram, TikTok and YouTube accounts (public ID, username, followers, average views and their history): as long as your Viralyshop account is open, even after you remove the account from your profile. It is the basis of your applications and payments. To have it deleted sooner, write to privacy@viralyshop.com. View readings that justify a payment are kept with the accounting records.
• Video file and cover image read for a content check: deleted from our temporary folder right after the check. The file sent to Gemini is deleted there too, at the latest 48 hours after it was sent.
• ID document (photo and number): as long as the creator account is open. Deleted within 30 days of a deletion request, unless a fraud check or a dispute about a payout is open: it is then kept until that closes. The record of payouts made stays with the accounting records.
• Orders, accounting entries, top-ups, commissions, payouts, invoices and tax data, with the customer data and view readings that justify them: 10 years, the retention period for accounting records (Article 12 of the Algerian Commercial Code).
• Messages, disputes, evidence and fraud files (reports, signals, decisions): 5 years after the end of the campaign concerned or the closing of the account, so that we can prove what happened in case of a claim or a dispute. Audit log, including your acceptances of the terms: 5 years after the account is closed.
• Clicks on tracked links: 12 months, then deleted or made anonymous. When a click led to an order, the attribution stays with the order.
• Sessions: a session lasts 7 days and renews while you use the app. Its IP address and browser are kept at most 90 days after the session ends.
• Server logs: 30 days at most. Error reports: 90 days at most.
• Public profiles received from Influencers.club: 7 days at most. Invitations sent: 12 months. Unsubscribes: a fingerprint of the address, kept with no time limit, so that we never write to that person again.

The law may require us to keep some data longer, for example at the request of an authority. We then keep it for as long as that obligation lasts.

We protect your data with technical and organizational measures:

• Phone numbers, ID document numbers, payout account numbers and merchants' ZR Express keys are encrypted (AES-256-GCM). The key is kept outside the database.
• Phone numbers are compared through an encrypted fingerprint and displayed masked. A number written in a name, an address, a note or a message is masked automatically.
• ID documents, videos, screenshots and dispute evidence are kept in private storage. They open only through links that expire: after 5 minutes for an ID document, a views screenshot or dispute evidence, and after one hour at most for other files. The product images a merchant publishes on its product pages are public.
• Each person accesses only what their role needs. Every time our team views an ID document, it is recorded.
• Order history, money movements, view readings, messages and the audit log cannot be changed afterwards: each change is added as a new line.
• Traffic to the website and the app goes over an encrypted connection (HTTPS).

No system is 100% secure. If a data breach puts you at risk, we tell you and the competent authority within the time the law sets.

Algerian Law No. 18-07 of 10 June 2018 on the protection of individuals in the processing of personal data gives you the following rights:

• Information: to know what data we process and why. That is what this page is for.
• Access: to get a copy of your data.
• Rectification: to have inaccurate data corrected, completed or erased. We correct it within 10 days, as the law requires. We also tell those we passed the data to, such as the merchant or ZR Express.
• Objection: to object, on legitimate grounds, to the processing of your data.
• Refusal of direct marketing: to receive no commercial message without your prior consent.
• Withdrawal of consent: at any time, for processing based on your consent. What was done before remains valid. To stop the reading of an Instagram, TikTok or YouTube account, remove it from your profile.

If you live in the European Union, the GDPR also gives you the right to erasure, to restriction of processing and to data portability, and the right to complain to the data protection authority of your country.

To use a right, write to privacy@viralyshop.com from your account's email address. If you have no account, for example if you are a merchant's customer, give the shop's name, the date of the order and the phone number used or the parcel's tracking number, so that we can find your data. We may ask for proof of identity if in doubt.

We confirm receipt within 3 working days and answer within 30 days. A rectification request is handled faster: within 10 days, as the law requires. If your request concerns an order, we also pass it on to the merchant, who is responsible for its customers' data, and help it answer.

If you are not satisfied with our answer, you can complain to the Algerian National Authority for the Protection of Personal Data (ANPDP).

The app has no button to delete your account. To delete your account and your data, write to privacy@viralyshop.com from your account's email address.

We confirm receipt within 3 working days and complete the deletion within 30 days. We keep what the law or money requires (orders, accounting entries, payouts, invoices, tax data, messages, fraud and dispute files, audit log) for as long as that obligation lasts (see How long we keep your data), and we delete or make anonymous everything else.

To stop only the reading of an Instagram, TikTok or YouTube account, remove it in Profile, section Social accounts, with the Remove button. All the steps are on the data deletion page.

The website viralyshop.com sets no cookie. It has no audience measurement tool and no advertising pixel. It loads its fonts from Google Fonts: your browser then contacts Google's servers, which receive your IP address and information about your browser.

The app, the product pages and the tracked links use:

• better-auth.session_token (with the __Secure- prefix in production): the session cookie that keeps you signed in. It lasts 7 days and renews while you use the app.
• cv_click: set when you open a creator's link on go.viralyshop.com. It holds a random click ID and lasts 7 days. It is used to credit the order to the right creator so that they are paid.
• sidebar_state: remembers for 7 days whether the app's side menu is open.
• Browser storage (localStorage and sessionStorage): your language, your theme, your last space, the layout of your inbox, the current step of a campaign you are creating, a pending pickup code (cleared when you sign out), a sign-up draft and, on product pages, a random tab ID (cv_order_session) that helps detect repeated submissions.
• _cv_ref: if a merchant installs our script on its own store, this cookie remembers for 7 days the code and link of the creator who brought you there, with the click ID and the sub-IDs. The script also keeps, in browser storage, a session ID, a cart mark and the time of its last signal to our server.

We use no advertising or audience measurement cookie. The app and the product pages also load their fonts from Google Fonts. You can delete cookies in your browser settings. Without the session cookie, you cannot stay signed in. Without cv_click, a sale may not be credited to the creator.

Tracked links add to the address of the merchant's page or store the creator's code, the click ID, the sub-IDs and the ad identifiers in the link, such as fbclid, ttclid or gclid. The tools the merchant uses on its own site can read them: they fall under the merchant's own privacy policy.

Viralyshop is only for people aged 18 and over. We do not knowingly create an account for a minor. If we learn that an account belongs to a minor, we handle it as a deletion request: we delete the account and its data within 30 days, except what the law requires us to keep. If you think a minor is using Viralyshop, write to privacy@viralyshop.com.

We update this policy when the service or the law changes. The date of the last update is shown at the top of the page. If an important change affects your data, we tell you by email or in the app before it applies.

• Your personal data, your rights or a deletion: privacy@viralyshop.com.
• Any other question: support@viralyshop.com. We aim to reply within 3 working days.
• By post: Scalemind, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.