Last updated: October 7, 2026
Leer en español — the English version is the binding one.
Account Information: Email address used for authentication via magic link login, or the account details Google or Apple share when you sign in with them (see section 12). We do not collect passwords.
Anonymous Demo Sessions: When you use the public demo at /demo without signing up, we set an HttpOnly cookie containing a random session UUID, hash your IP address (SHA-256, not the raw IP), and record the public video URL you submit. This data is deleted when the session expires, 2 days after it is created. We use it only to scope your processed clips to your session and to rate-limit abuse.
Video Content: Videos you upload or link for processing. This includes the original video, generated clips, subtitles, and AI-generated metadata (titles, content analysis). Anonymous demo clips include a non-removable watermark and are auto-deleted 48 hours after creation unless you sign up and claim them.
Social Media Tokens: When you connect TikTok, Instagram, or YouTube accounts, we store encrypted OAuth tokens that allow us to publish content on your behalf. We do not access your social media accounts for any purpose other than content publishing as authorized by you.
Usage Data: Credit usage (minutes of source video processed, clips generated and new versions generated after editing), subscription plan and capacity level, automation runs, job history, and feature interactions. We use this telemetry to meter credits, enforce plan limits, and improve the service.
Billing Information: Your Stripe customer ID, subscription status (plan, capacity, trial and billing state), and billing history such as invoices and payments. We do not collect or store card numbers or full payment details; you provide those directly to Stripe, our payment processor. Purchases made in the mobile app are processed by Apple or Google instead (see section 12).
Abuse Detection Signals: To protect the service, we capture: Cloudflare Turnstile bot-score tokens, URL fingerprint hashes (so the same public video processed by many IPs is detectable), and request rate counters. None of these signals contain personal data beyond the hashed IP already mentioned.
CreatorViral integrates with the following third-party services:
Social media OAuth tokens are encrypted using AES-256-GCM before storage. Video content is stored on AWS S3 with server-side encryption. All data transmission uses HTTPS/TLS encryption. Access to production systems is restricted to authorized personnel.
Authenticated users: the media files of your clips (video files, thumbnails and transcript files) are kept for 30 days from the moment each clip is created, as described in the Terms (§3b); the clip's record (title, description, score, subtitles and editing settings) stays for as long as your account exists. Social media tokens are deleted as soon as you disconnect an account. Billing records (Stripe customer ID, subscription history, and invoices) are kept after deletion only for as long as accounting, tax, or other legal obligations require.
Push notification tokens and the per-install identifier are deleted when you delete your account, or when the app is uninstalled and the token stops being valid.
Deleting your account. You can delete your account yourself, at any time, from Settings → Account on the web and from Profile in the CreatorViral app. You do not need to email us. When you confirm:
Once the 30 days are up, deleting your account is permanent. We cannot restore it, its content, or its credits.
What we keep after you delete, and why. Tax and accounting law requires us to keep a record of the money you paid us. So after deletion we keep, and only for that purpose: the payment records held by Stripe, our payment processor (invoices, charges and the customer record they are attached to), and, in our own systems, the amounts, dates, plan, credits purchased and credits used, together with the identifier that links them to the Stripe record. We do not keep your email address, your content or your activity. This means our remaining record is pseudonymous, not anonymous: the Stripe identifier still points at an identified person on Stripe's side. We keep it for as long as tax, accounting and anti-fraud law requires, and we use it only to meet those obligations, to answer a payment dispute, and to prove that we handled your deletion request.
Emails already sent. Messages we have already delivered to you remain with our email provider for its own retention period. Our own copy of them is erased when your account is deleted.
Anonymous demo: Anonymous session data (cookie UUID, hashed IP, submitted video URL) is deleted when the session expires, 2 days after it is created; the media generated during the demo is deleted 48 hours after creation. If you sign up within that window, your clips are claimed to your new account and follow the authenticated retention policy above. Watermarked preview clips are regenerated without the watermark only after you start a paid subscription.
Derived text: transcripts, content analysis and detected moments produced from processing a video are kept for up to 30 days. When the same publicly available video is processed more than once, including by different accounts, we may reuse that derived text instead of processing the video again; it never contains account information, edits, captions or clips, and it is never shown to other users as content (Terms §15). Videos uploaded from your device are never reused across accounts.
If you are in the European Economic Area or the United Kingdom, you also have the right to complain to your national data protection authority.
CreatorViral uses essential cookies for authentication (JWT session token) and locale preferences. We do not use advertising or cross-site tracking cookies. We do use first-party product analytics (Amplitude) and error and performance monitoring (Datadog on our servers, Sentry in the mobile app) to understand product usage and keep the service reliable; these process usage events tied to your account, not advertising identifiers.
Your data may be processed in data centers located in the United States (AWS us-east-1 region). By using our service, you consent to this transfer.
CreatorViral is not intended for users under 18 years of age. We do not knowingly collect information from minors.
We may update this privacy policy as our practices evolve. Material changes will be communicated via email to your registered address.
For privacy-related inquiries, contact us at legal@creatorviral.com.
CreatorViral is our iOS and Android app, and it does what the web does: you create clips from a link or from a video you upload from your device, review and edit them, publish or schedule them to TikTok and Instagram, run automations, connect your TikTok and Instagram accounts, and buy subscriptions and credit packs. In addition to the data described above, the app collects or receives the following:
x-device-id header on every request. We use it to bind your session to this device — a refresh token issued to one installation cannot be redeemed from another — and to rate-limit abuse. It is not an advertising identifier and it is not shared with anyone.Store subscriptions and account deletion. You can delete your account from Profile in the app, with the effects described in section 5. If you subscribed through Apple or Google, deleting your account does not cancel the store subscription: the store bills it, not us, so cancel it yourself in your Apple ID subscriptions (Settings on your iPhone or iPad) or in your Google Play subscriptions. The app reminds you of this before you confirm.
The app does not use tracking as defined by Apple's App Tracking Transparency framework: there is no IDFA, no advertising SDK, and no data shared with third parties for advertising or cross-app measurement. The technical privacy manifest embedded in the iOS binary declares the data types described in this section.