Privacy notice
Last updated: 13 October 2026
Viral OS is built and operated by AICraft, a company registered in the Netherlands. AICraft is the controller of the personal data described here. Questions or requests: mohamed@goviralos.com.
What we collect and why
Your account. Your email address, to send you login links and to tie audits, plan and credits to you. We never ask for a password.
Your audits.The ad you submit (a URL or an uploaded video). We analyze the video and then delete it, from our servers and from the AI provider's file storage. We keep the ad URL or file name, the creative features we extracted (for example hook, call to action, pacing and a transcript of the spoken words) and the resulting scores, so you can reopen and export your reports. If you create a share link, anyone with that link can see a reduced version of that report until you ask us to remove it.
Meta ad accounts (optional). If you connect a Meta ad account, we get read-only access to its performance data (such as spend, impressions, clicks and conversions) and store the access token to keep that data in sync. Viral OS does not create, change or pause your ads.
Payments. Payments are handled by our payment provider. We see that a payment was made and for which plan or credits, never your full card details.
Business outreach.We may email people at companies whose video ads appear in Meta's public Ad Library, with a free audit of one of those ads. For this we use a name, work email address, job title, company name and the public ad, found on company websites, professional profiles, the Meta Ad Library and business contact databases. We do this on the basis of our legitimate interest in offering a relevant business service. Reply "no thanks" (or email us) and we will stop: we then keep only your email address on a do-not-contact list so we never contact you again. Otherwise we delete outreach contact details 12 months after our last contact, unless you become a customer.
This website.No analytics, no advertising pixels, no tracking cookies. When you log in, a session token is stored in your browser's local storage to keep you signed in; logging out removes it. Our hosting providers keep standard technical logs (such as IP address and time of request) for security and reliability.
Legal bases
- Providing the service you signed up for: performance of a contract.
- Security, fraud prevention, improving the product and business outreach: our legitimate interests, balanced against yours.
- Meeting tax and accounting obligations: legal obligation.
Scores describe ads, not people. We make no automated decisions about you that have legal or similarly significant effects.
Who processes data for us
- Railway: application hosting and databases (United States).
- Vercel: website hosting.
- Google: the Gemini API, which analyzes ad videos, and Google Workspace for email.
- Resend: delivery of login emails (EU region).
- Meta: only if you connect an ad account.
- Our payment provider, when you buy a plan or credits.
Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on appropriate safeguards such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. We do not sell personal data.
How long we keep it
- Ad videos: deleted right after analysis.
- Account and audits: while your account is active. Ask us and we delete them.
- Outreach contact details: up to 12 months after our last contact (see above).
- Payment records: as long as Dutch tax law requires (currently 7 years).
Your rights
You can ask us to access, correct, delete or export your data, to restrict how we use it, or object to how we use it, including at any time to direct marketing. Email mohamed@goviralos.com and we will respond within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If this notice changes, we update the date at the top. Back to Viral OS