Privacy Policy

Vyral Sync is an online marketplace that connects brands with social media creators, operated by Indeep AI (Pty) Ltd. For the Protection of Personal Information Act, 2013 (POPIA), Indeep AI (Pty) Ltd is the responsible party for the personal information described here. Our Information Officer can be reached at [email protected].

Operated by

Indeep AI (Pty) Ltd

Legal status

a private company registered in South Africa

Registration number

K2026896720

Website

https://vyralsync.com

Privacy and data requests

[email protected]

Support

[email protected]

We only collect what we need to run the marketplace. Most of it you give us directly.

• Account details: your name, email address, password and whether you joined as a brand or a creator. We never store your password itself, only a one-way scrambled version (an Argon2 hash) that can't be turned back into it.
• Brand profiles: business name, industry, description, location, website and social links, logo, marketing goals, preferred platforms and budget.
• Creator profiles: display name, username, bio, photo, location, content categories, the kinds of work you accept, your social media handles, and the follower counts, engagement and audience details you enter, and your rates. Until you connect an account through a platform's official API, these figures are what you entered and are labelled that way.
• What you do on Vyral Sync: campaigns, applications, invitations, shortlists, profile views (brands viewing creator profiles), collaborations, content you submit for approval (images, links and captions), messages, payment records you report (amounts, dates and references) and notifications.
• Technical information: the IP address and browser of each signed-in session, and short-lived server logs (IP address, page requested, time) used to keep the service secure and working.

We do not collect bank account or card numbers. Payments currently happen directly between brands and creators, outside Vyral Sync.

You may be able to connect your TikTok, Instagram, Facebook or YouTube account to verify your profile and show real statistics. When you do:

• You sign in on the platform's own page and choose what to allow. We never ask for or see your social media password.
• We receive only what you approve through the platform's official API: typically your public profile (name, handle, picture), follower count, and statistics about your posts (such as views, likes and comments).
• We use this to verify your profile, show your statistics to brands you work with or who view your profile, and report results on campaigns you take part in. We don't sell it, use it for advertising, or use it to train AI models.
• The access keys the platform gives us are stored encrypted and are never sent to your browser.
• You can disconnect at any time in Vyral Sync, or from the platform's own security settings. When you disconnect, we delete the access keys and stop collecting new data.

Vyral Sync's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect a YouTube channel, Vyral Sync uses YouTube API Services. By connecting it you agree to the YouTube Terms of Service, and Google's handling of your information is described in the Google Privacy Policy. You can remove Vyral Sync's access at any time from your Google account's third-party connections page.

• To run your account and the marketplace: showing profiles and campaigns, matching brands with creators, messaging, collaborations, content approvals and payment tracking. Needed to provide the service you signed up for.
• To send you emails you need: password resets, and notifications about activity on your account if they're switched on.
• To keep Vyral Sync safe: preventing fraud, fake accounts, spam and abuse, and protecting our systems. This is in our and our users' legitimate interest.
• To improve the service, using totals and patterns (for example, how many campaigns are published), not individual profiling.
• To meet legal obligations, such as keeping records the law requires or responding to lawful requests.

We do not sell personal information, show advertising, or use tracking or advertising cookies. Matching scores between brands and creators are calculated by fixed rules from profile information and from how past collaborations on Vyral Sync went (for example, whether content was delivered on time). Each score shows how it was worked out. A brand's private notes and rating of a creator are visible only to that brand and affect only that brand's own results.

• Creator profiles can be seen by signed-in brands. Brand profiles and campaigns can be seen by signed-in creators. Neither is shown to people who aren't signed in.
• Messages, collaborations, submitted content and payment records are visible only to the brand and creator involved.
• Creators can see how many brands viewed or shortlisted their profile, but not which ones.
• People who work for Vyral Sync access personal information only when needed to run, support or secure the service.

We use a small number of trusted providers (called operators in POPIA) who process information only on our instructions:

• Hetzner Online (Germany): the servers and database that run Vyral Sync.
• Cloudflare (global network): delivering the website securely, protecting it from attacks, managing our domain, and storing our backup copies.
• Resend: sending emails such as password resets and notifications.
• Groq (United States), only when AI features are switched on: when you use the campaign assistant, AI search, invitation drafting or suggested replies, the text you type, the relevant profile details and, for a suggested reply, the recent messages in that conversation are sent to generate the draft. Groq doesn't keep these requests by default; it may log them for up to 30 days to fix reliability problems or investigate abuse.

Some of these providers process information outside South Africa. We only use providers bound by data-protection laws or agreements that give protection substantially similar to POPIA, as section 72 of POPIA requires. If we add a provider, for example for payments, we'll update this list before it handles your information.

We may also disclose information if the law requires it, or to protect the rights, property or safety of our users or others.

• While your account is open, we keep your information so the service works.
• When you delete your account, your profile, campaigns, applications, messages and uploaded files are deleted straight away. Conversations and collaborations you were part of are deleted too.
• Backups are kept for up to 30 days and then deleted automatically, so deleted information disappears from them within 30 days.
• Server logs are kept for a short time (usually a few weeks) for security.
• If the law requires us to keep certain records for longer, we keep only those, only for as long as required.

• All traffic to Vyral Sync is encrypted (HTTPS).
• Passwords are stored as one-way hashes; social media access keys are encrypted.
• When you choose a password, we check it against passwords exposed in known data breaches using the Have I Been Pwned service. Only the first five characters of a one-way hash of it are sent, never the password itself.
• New accounts and email address changes are confirmed through a single-use link sent to that address.
• Each brand and creator account can only reach its own data; the database is not reachable from the internet.
• Backups are made every night and stored in two separate places.
• If a security breach affects your personal information, we'll tell you and the Information Regulator as POPIA requires.

Under POPIA you have the right to:

• ask whether we hold information about you, and get a copy of it;
• have incorrect or out-of-date information corrected (you can edit most of it yourself in your profile and settings);
• have your information deleted;
• object to how we use your information, and withdraw consent you have given;
• not receive direct marketing (we don't send any);
• complain to the Information Regulator (South Africa): inforegulator.org.za.

To use any of these rights, email [email protected] from the email address on your account. We'll reply within 30 days and may ask you to confirm your identity first.

You can delete everything yourself at any time:

1. Sign in and open Settings.
2. Under Delete account, enter your password and choose Delete permanently.

This deletes your account, profile, campaigns, messages, uploaded files and any data received from connected social media accounts. Backup copies are removed within 30 days. If you can't sign in, email [email protected] and we'll delete it for you.

To remove Vyral Sync's access to a connected social media account without deleting your Vyral Sync account, disconnect it in Vyral Sync or in that platform's app settings; we then delete the data we received from it.

We use only the cookies needed for the site to work:

• vs_session keeps you signed in. It holds a random identifier, nothing about you, and is removed when you sign out.
• Cloudflare security cookies (such as __cf_bm) help tell people apart from automated attacks.

We don't use analytics, advertising or tracking cookies, so there's nothing to opt out of.

Vyral Sync is for people aged 18 and over. We don't knowingly collect information from anyone younger. If you believe a child has created an account, email [email protected] and we'll delete it.

If we change this policy, we'll update the date at the top. If a change materially affects how we use your information, we'll tell you by email or in the app before it takes effect.

Questions about privacy or this policy: [email protected]. See also our Terms of Service.