Privacy Policy

1. Who we are

ViralForensics is a creative-review service for short-form video creators. It is run by Alex Thorne, a sole trader in the United Kingdom, trading as ViralForensics (“we”, “us”). We are responsible (the “controller”) for the personal data described here. Contact: privacy@viralforensics.com.

2. What we collect and where it comes from

What you give us

• Your email address, to sign you in with a one-time link (there are no passwords).
• What you tell us when you set up your profile: your name, niche, social media link, equipment, editing style, how you describe yourself, your goals, what you want to avoid and what you think holds you back.
• Which of your pitches a video was made from, if you link them.

From Instagram, when you connect your Instagram professional account (through Meta, with your permission)

• Your Instagram account ID, and a login token that lets us read your account. The token is kept where only our server can read it and is never sent to your browser.
• For your recent video posts: the caption, link, posting date, number of likes and comments, and Instagram’s statistics (reach, views, shares, saves and average watch time).
• The text of up to 50 comments on each video post. Comments are written by other people; we store only the words, not who wrote them.
• Statistics for your account: daily reach and profile views for the last 30 days, and your followers’ countries, ages and genders as totals (never individual followers).
• A copy of each of your video posts, stored privately so it keeps playing in the app and can be analysed (Instagram’s own video links expire after a few days).

What we create from it

• For each video: a transcript, a factual record of what is in it (format, setting, shots, sound and so on), an analysis with suggestions, and comparisons with your usual numbers.
• Your Creator DNA, content pillars, pitches, patterns across your videos, and themes in your comments.
• Records of how much AI processing each task used, for cost accounting.

Technical data

• Our web server records each request (IP address, page and browser type) for security. These logs are kept for 14 days.
• We use only strictly necessary cookies: to keep you signed in and to protect your Instagram connection while you log in. We don’t use advertising or analytics cookies.

3. How we use it

Only to run ViralForensics for you: importing and storing your posts, analysing your videos, comparing them with your usual results, building your Creator DNA, suggesting pitches and showing it all in your dashboard. We don’t sell your data, use it for advertising or show it to other users.

The legal basis is our contract with you: providing the service you signed up for. For comments written by other people, it is our legitimate interest in helping you understand your audience; we keep only the text, use it only for your analyses and delete it with your account.

4. Who processes it for us

• Supabase: our database, file storage and sign-in, hosted in the EU (Frankfurt).
• Google (Gemini API): analyses your videos and text. We delete each video from Google’s systems as soon as its analysis is done (Google deletes uploaded files within 48 hours in any case). Google handles this data under its terms for paid Gemini API services, which don’t allow it to use the data to improve its products.
• Meta: provides your Instagram data to us through its official API when you connect.
• Our server in the United Kingdom, which runs the app.

Some providers may process data outside the UK. Where they do, we rely on their data processing terms, which include safeguards recognised under UK data protection law.

5. How long we keep it

• While your account is open.
• If you disconnect Instagram: we delete the login token and the stored copies of your videos straight away (within minutes). Your analyses, Creator DNA, pitches and statistics stay in your account until you delete it, and nothing is updated from Instagram any more.
• If you delete your account: everything about you is deleted straight away (profile, posts, comments, analyses, transcripts, pitches, statistics and connections) and the stored video copies within minutes. Records of AI usage are kept for cost accounting but are no longer linked to you.
• Server logs: 14 days. Background task records (internal IDs only): 30 days.
• Our database provider keeps backups for a limited period; deleted data disappears from them as they expire.

6. Your rights

Under UK data protection law you can ask to see, correct, delete or get a copy of your data, and object to or limit how we use it. You can do most of this yourself in the app (Settings); for anything else, email privacy@viralforensics.com and we’ll reply within one month. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

If you commented on a creator’s video and want to ask about your comment, you can contact us too.

7. Security

All connections use HTTPS. Each creator can see only their own data. Login tokens never reach browsers. Stored videos can only be opened through short-lived private links.

8. Age

ViralForensics is for people aged 18 and over.

9. Changes

When anything changes we’ll update this page and its date, and email you before significant changes take effect.