Privacy Policy

1. Who is responsible

Ponuz, LLC, a Delaware limited liability company, is the controller (in Mexico, the “responsable”) of the personal data described here. Contact us about privacy at contact@ponuz.app. Residents of the EU, the EEA and the UK can use the same address.

2. Data we collect

Account data: your email address, password (stored only as a secure hash by our authentication provider), sign-up and sign-in dates, and the language you use. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.

Onboarding answers: if you answer our optional onboarding questions: your name, why you signed up, how you heard about us, your role, team size, business model, revenue range, the categories you work in and what you expect from Viralytics.

Brand data: the website address you give us and the public text we read from it, and the brand profile you create and edit (name, description, audience, tone of voice, voice samples, customer quotes, content themes, niche, logo).

Content you create or upload: videos, images, audio and music you upload; prompts and instructions; ideas, scripts, captions, slides and calendar entries; transcripts of speech in your videos; and the images, videos, captions and translations generated for you.

Billing data: your plan, subscription status, billing period, and the customer, subscription and invoice identifiers we receive from Stripe. Stripe collects your card and billing details directly; we never receive your full card number.

Usage and technical data: the AI actions you run and the amount of AI usage each one consumes, the provider and model used, timestamps, and technical logs (such as IP address, browser type and errors) kept by our hosting providers to run and secure the Service.

Product analytics in your browser: unless you turn analytics off (or, in the European Union, the EEA, the United Kingdom and Switzerland, only if you accept them), which pages you visit and what you do in the app (for example, generating ideas, opening the editor or scheduling a post), your browser and device type, approximate location derived from your IP address, and recordings of your sessions that show where you click and scroll. Recordings hide all the text you see or type and all images and videos, so they never show your content. When you are signed in, these are linked to an analytics profile with your account ID, email address, plan, language, number of brands and the onboarding answers you picked from lists, and to your active brand (its name and plan), so we can count brands as well as people.

Account events recorded on our servers: whatever you choose about analytics cookies, our servers record a limited set of events linked to your account ID and brand, without storing or reading anything on your device: signing up and signing in, confirming your email, brand analysis, finished AI tasks and whether they failed, connecting a social account, published posts and failed posts, reaching a usage limit, and subscription changes (plan, billing period, monthly amount and failed payments). For each AI request we also record the provider, model, amount of text processed, cost and time it took, never your prompts or the AI's answers. We use these to run the business (revenue, costs and limits), detect failures and improve the Service, based on our legitimate interests; you can object at any time by emailing contact@ponuz.app.

Communications: messages you send us, such as support or privacy requests. When you use “Report an issue” in the app, we receive your message together with your email address, account ID, the name and ID of your active brand, the page you were on, your language and your browser type.

We do not ask for sensitive data (such as health, religion or sexual orientation). Please do not include it in your content unless it is necessary; if a video you upload contains it, it is processed only to provide the feature you requested.

3. Creators in the inspiration library

To show trends, we collect a selection of publicly available TikTok posts in specific niches, through the third-party service Apify and public embed services. For each post we may store: the creator’s public username and display name, the caption, hashtags, engagement figures (views, likes, comments, shares), the post’s media and cover, a transcript of its audio, a selection of its public comments, and an AI analysis of why it performed. When a user pastes a link to a public TikTok, Instagram or YouTube post, we also store that post’s public details.

We use this data to help users understand content trends (our legitimate interest in providing a trend-research tool, balanced against creators’ interests: we only use content that creators chose to publish, we do not build profiles of individuals, we do not contact creators, and we prune posts that are no longer relevant). Posts are refreshed periodically and removed when they no longer meet our criteria, unless a user’s idea is based on them.

If you are a creator and want your content removed from the library, or object to this processing, email contact@ponuz.app with a link to your profile or post. We will act within one month.

4. Social account connections

You can connect a TikTok account or an Instagram professional account (Business or Creator). When you choose to connect an account, we receive, with your authorization, the account’s identifier, username, display name, profile picture and follower count; access tokens to publish the content you choose and to read your posts’ metrics (views, likes, comments, shares); the title, description, link and metrics of the account’s most recent videos, read to match the posts you send from Viralytics and the links you add by hand; and the permissions you granted. Tokens are stored encrypted (AES-256-GCM). Instagram is connected with Instagram Login, Meta's official OAuth flow, and we request only these permissions: instagram_business_basic, to read the account's user ID, username, name, profile picture, account type and follower count, which we show in Settings, in the account picker when you publish an idea, and in Analytics; instagram_business_content_publish, to publish Reels, single images or carousels with your caption, only when you ask us to publish; and instagram_business_manage_insights, to read the views and shares of the posts you published through Viralytics, during their first 60 days, shown in Analytics. We do not read account-level insights, comments or direct messages from Instagram. Instagram data is hosted by Vercel (hosting and server processing) and Supabase (authentication, database and storage) on our behalf; Ponuz, LLC is the controller. If an Instagram request fails, our error monitoring provider Sentry receives the error, which can include the account's username and the error message returned by Instagram; our product analytics (PostHog) only record which platform you published to (for example, “instagram”), not your Instagram data, and session recordings mask all text and hide images. We will use this data only to provide publishing and analytics for your own account, never for advertising or to build profiles, and we will not read private messages. You can disconnect an account at any time in Settings, which deletes its tokens, or revoke access from the TikTok or Instagram app (see our Data Deletion page at /data-deletion). Disconnecting deletes the account's tokens immediately, and deleting your Viralytics account deletes all of its data.

5. How we use data and our legal bases

• To provide the Service (create and secure your account, analyze your brand, generate and edit content, transcribe and translate, store your media, export, plan, enforce plan limits): performance of our contract with you.
• To process payments and keep billing and tax records: performance of the contract and legal obligations.
• To keep the Service secure and prevent abuse, including preventing people from re-creating accounts to obtain a new free trial: legitimate interests.
• To understand and improve the Service using usage records and your optional onboarding answers: legitimate interests (and consent for the optional answers, which you can withdraw).
• Product analytics in your browser and session recordings: your consent in the European Union, the EEA, the United Kingdom and Switzerland; legitimate interests elsewhere, with the option to turn them off.
• Account events, AI usage records and technical logs on our servers: legitimate interests in running the business, measuring costs and keeping the Service reliable; you can object as described above.
• To communicate with you about your account, billing, legal notices and changes: performance of the contract and legal obligations.
• To operate the inspiration library: legitimate interests, as described above.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

6. How AI is used

When you use an AI feature, the content needed for that task is sent to the provider that performs it:

• Anthropic (Claude): brand data, website text, prompts, transcripts with word timings, video frames and media thumbnails, to write ideas, posts and scripts, plan edits, decide what to cut, run the editor copilot and translate captions; and text, frames and public post details to analyze inspiration posts, suggest niches and hashtags and write search queries.
• OpenAI: prompts and reference images or video frames to create and edit images, and your speech audio to transcribe it when our main transcription provider is unavailable.
• Deepgram: your speech audio and your brand name, to transcribe what is said in your videos.
• Runway: your video clip and keyframes, or an image from your media bank, to transform video or animate images (Pro and Business plans).
• Exa: web search queries written from your topic, to find sources for posts and scripts.

Under the terms that apply to our use of their APIs, these providers do not use the data we send to train their models, and they keep it only for limited periods (for example, for abuse monitoring) as described in their own policies. Temporary audio and video files we create for these tasks are deleted from our storage once the task has used them. We do not use your content to train any AI model.

AI output can be wrong. The Service marks AI features as such, and you should review results before using them.

7. Who we share data with

We do not sell your personal data and we do not “share” it for cross-context behavioral advertising. We disclose personal data only to:

• Service providers that process it for us under contracts: Vercel (hosting and server processing), Supabase (authentication, database and file storage), Stripe (payments and billing portal), Anthropic, OpenAI, Deepgram, Runway and Exa (AI features, as described above), Apify (collecting public posts for the inspiration library), Cloudflare (storage of inspiration media, when used), PostHog (product analytics, session recordings, account events, AI usage records and technical logs, as described above), Sentry (error and performance monitoring: errors and server error logs with the page address and stack trace, and timing traces for a sample of requests, without IP addresses or cookies), Resend (sending our emails: account emails such as confirmations and password resets, renewal notices, and issue reports to our team), and Google (sign-in with Google and web fonts).
• TikTok and Meta, only when you connect an account and ask us to publish or read metrics.
• Authorities or others when required by law, or to protect rights, safety and security.
• A buyer or successor in a merger, acquisition or sale of assets, subject to this policy.

When you load pages with embedded TikTok, Instagram or YouTube posts, or our web fonts, your browser connects to those companies, which receive your IP address and browser information under their own privacy policies.

8. Cookies and storage on your device

We use no advertising cookies. These cookies are needed for the Service to work and are always on:

• authentication cookies from Supabase, to keep you signed in;
• “vx_ws”, to remember the brand you selected (1 year);
• “vx_nav”, to remember whether the sidebar is collapsed (1 year);
• “NEXT_LOCALE”, to remember your language (1 year);
• “vx_oauth” and “vx_oauth_next”, temporary cookies (10 minutes) that protect the social-account connection process and return you to where you started;
• “vx_checkout”, which remembers the plan you picked on the pricing page while you sign up, so checkout can open next (7 days);
• “vx_paywall”, which tells the app to show the plans when an action reached your plan’s limit (2 minutes);
• “vx_consent_region”, which remembers, from the country your connection comes from, whether analytics need your consent before they start (30 days);
• “__ph_opt_in_out_…”, kept in local storage, which remembers whether you accepted or rejected analytics cookies.

Analytics cookies (optional). PostHog stores an identifier in a cookie and in local storage (“ph_…_posthog”, 1 year) and records sessions as described in “Data we collect”. In the European Union, the EEA, the United Kingdom and Switzerland this happens only if you accept it in the banner shown on your first visit; until you choose, or if you reject it, nothing is stored on your device for analytics and no sessions are recorded. Everywhere else analytics are on by default, based on our legitimate interest in understanding and improving the Service, and you can turn them off at any time. Either way, you can change your choice whenever you want with “Cookie settings” at the bottom of our website’s pages or in Settings in the app. While analytics are on, the app also keeps in local storage what it last sent about your profile and brand (“vx_ph_person”, “vx_ph_workspace”), so it doesn’t send it again. With analytics off, we may still count your visit without any identifier on your device. Vercel Web Analytics counts page views and Vercel Speed Insights measures how fast pages load, both without cookies.

The app also stores some data in your browser’s local storage, which stays on your device: unsaved edits (so you don’t lose them), where you left off in the video editor, your conversation with the editor copilot for each video, scenes the editor reuses, the timeline height, your progress in the product tour, which notifications you have read and some preferences. You can clear it from your browser settings.

9. International transfers

We are based in the United States and our providers process data in the United States and other countries. When personal data from the EU, the EEA, the UK or Switzerland is transferred to the United States, we rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) for providers certified under it, and on the European Commission’s Standard Contractual Clauses (and the UK addendum) otherwise. You can ask us for more information about these safeguards at contact@ponuz.app.

10. How long we keep data

• Account, brand and content data: while your account is active, and until you delete it (or delete the specific item). When you delete your account, it is erased from our active systems; backups are overwritten on their regular cycle.
• Temporary files for AI tasks: deleted once the task has used them.
• Ideas you skip: deleted about 10 minutes after you skip them.
• Usage records: kept after account deletion, for accounting, fraud prevention and to stop the same person from obtaining a new free trial by deleting and re-creating an account. For the same reason, when you delete your account we keep a one-way hash of your normalized email address and your original sign-up date, which cannot be turned back into your email.
• Billing records: kept by us and by Stripe for as long as tax and accounting laws require (generally up to 7 years).
• Inspiration library posts: while they remain relevant to a niche, as described above.
• Technical logs: for the limited periods set by our hosting providers.
• Product analytics: events and analytics profiles for up to 12 months, session recordings for up to 1 month and background-task logs for up to 14 days, after which PostHog deletes them. When you delete your account, analytics data is no longer linked to an active account and is deleted when those periods end; email contact@ponuz.app if you want it deleted sooner.

11. Security

We protect data with access controls that separate each workspace, private storage with short-lived access links, encryption in transit (HTTPS) and encryption of connected-account tokens. No system is completely secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

12. Your rights

Depending on where you live, you may have the right to: access the personal data we hold about you and get a copy; correct it; delete it; receive it in a portable format; restrict or object to certain processing (including processing based on our legitimate interests); withdraw consent at any time; and not be discriminated against for exercising your rights.

You can delete a brand or your whole account yourself in Settings → Brand, turn analytics off with “Cookie settings”, and fix most data directly in the app. For any other request, email contact@ponuz.app from your account’s address. We may need to verify your identity and will respond within the time the law sets (one month in the EU and UK, 45 days under U.S. state laws, 20 days in Mexico). If we decline a request, you can appeal by replying to our answer.

13. Additional information by region

European Union, EEA and UK. The legal bases are listed above. You can complain to your local data protection authority (in Spain, the Agencia Española de Protección de Datos, aepd.es; in the UK, the ICO), although we would like the chance to resolve your concern first: we acknowledge complaints within 30 days and tell you the outcome.

United States (including California). In the last 12 months we have collected these categories of personal information: identifiers (such as email and IP address); commercial information (plan and purchase history); internet or electronic activity (usage records and logs); audio, video and visual information (the media you upload); and professional information (optional onboarding answers). We collect them from you, your device and the services described above, for the purposes in this policy, and we disclose them to the service providers listed above for those business purposes. We do not sell or share personal information, do not use sensitive personal information other than your sign-in credentials for your account, and do not knowingly collect data from people under 16. You may use an authorized agent to make a request; we may ask for proof of the agent’s authority and verify your identity.

Mexico. You can exercise your rights of access, rectification, cancellation and opposition (ARCO), revoke your consent or limit the use and disclosure of your data by emailing contact@ponuz.app with your name, the right you want to exercise, a clear description of the data, and a copy of an identification. We respond within 20 days and apply the decision within the following 15 days. The data is processed for the purposes described above, which are necessary for the Service except for the optional onboarding answers. We will notify changes to this notice by email or in the app. If you believe your rights have been infringed, you can go to the competent federal data protection authority.

14. Children

We do not knowingly collect personal data from children; if we learn that we have, we delete it.

15. Changes to this policy

We may modify this policy at any time, whenever we consider it necessary, for example when our features, providers or processing change, or when the law changes. The updated policy is published on this page with a new date at the top and applies from that date.

For material changes, we will notify you by email or in the app before they take effect and, where the law requires it, ask for your consent again. We encourage you to review this page from time to time.