Privacy Policy

The data controller is Randevos LTD, a company registered in England and Wales under company number 17300468, with its registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.

For any request or question concerning personal data — or for general support — write to [email protected], or to us at the registered office above.

Account data: your name, email address, password (stored only as a salted cryptographic hash), plan, and account settings.

Connected-account data: access tokens and account identifiers for the social-media accounts you connect (for example TikTok, Instagram, and YouTube) so the Service can post on your behalf. We store these tokens in a protected form and use them only to operate the features you enable.

Content data: the prompts, footage, images, audio, links, niche and style settings, and other material you supply, and the videos the Service generates, edits, and posts on your behalf.

Payment metadata: your subscription and purchase records. Full payment-card details are entered directly with our payment processor (Stripe) and are never stored on our systems; we retain only limited transaction metadata such as the card brand and last four digits, never the full card number.

Technical and usage data: log records, device and browser information, IP address, approximate (country-level) location, and product-usage metrics used to operate and secure the Service.

To create and administer your account and provide the Service you have requested, including finding, generating, editing, and posting videos to your connected accounts — performance of a contract.

To process payments, prevent fraud, secure the platform, prevent abuse, and enforce technical and spending limits — our legitimate interests and, where applicable, performance of a contract.

To comply with legal, tax, accounting, and regulatory obligations and respond to lawful requests from authorities — compliance with a legal obligation.

To send service and security notices essential to the Service — performance of a contract or legitimate interests; and to send optional product news — only where you have given consent, which you may withdraw at any time.

Under the KVKK we rely on the corresponding lawful grounds in Article 5, including the necessity of processing for the performance of a contract, compliance with a legal obligation, and our legitimate interests balanced against your rights.

To find, generate, and edit content, the material and prompts you provide are processed using a third-party artificial-intelligence provider (Google Gemini) engaged by us as a processor. We do not use your content to train third parties’ foundation models. AI output is generated automatically and you remain responsible for reviewing it before it is relied upon or published.

We do not sell personal data. We disclose personal data only to service providers who process it on our instructions under written contracts with appropriate safeguards, in the following categories: payment processing (Stripe); social-media publishing and account connection (Post for Me); artificial-intelligence content generation (Google Gemini); and cloud hosting and infrastructure.

We may also disclose personal data where required by law, to establish, exercise, or defend legal claims, to protect the rights, safety, and security of users or the public, or in connection with a merger, acquisition, or sale of assets (subject to this Policy).

Some of our processors may process personal data outside the country in which you are established (for example outside the United Kingdom, the EU/EEA, or Turkey). Where they do, we rely on appropriate safeguards recognised under applicable law — such as Standard Contractual Clauses, an adequacy decision, or, for transfers subject to the KVKK, a lawful transfer mechanism under Article 9 of the KVKK.

We retain your account, content, and connected-account data for as long as your account is active and for a limited period afterwards to satisfy legal, tax, accounting, and dispute-resolution obligations, after which we delete or irreversibly anonymise it. When you disconnect a social-media account or delete your account, we delete the associated access tokens, subject to those retention requirements. Security and audit records are retained for as long as necessary to investigate incidents and meet those obligations.

We implement technical and organisational measures appropriate to the risk, including encryption of secrets in a protected store, encryption of data in transit, least-privilege access, rate limiting, and audit logging of security-relevant actions. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If a personal-data breach occurs that is likely to result in a risk to you, we will notify the competent supervisory authority and, where required, affected data subjects, within the timeframes required by applicable law.

Subject to applicable law, you have the right to be informed about, access, rectify, erase, restrict, and object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. Under the KVKK you also have the rights set out in Article 11, including to learn whether your data is processed, to request information about the processing and the third parties to whom data is transferred, to have inaccurate data corrected, to request erasure or destruction, and to claim compensation for damages caused by unlawful processing.

To exercise these rights, contact [email protected]. We may need to verify your identity. You also have the right to lodge a complaint with a supervisory authority — in the United Kingdom, the Information Commissioner’s Office; in Turkey, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu); or your local EU/EEA authority.

The Service is not directed to children and is intended solely for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We use strictly necessary cookies to operate the Service and keep your session secure. Details are set out in our Cookie Policy.

We may update this Policy from time to time. We will post the updated version here, revise the date above, and, for material changes, provide notice in-product or by email.

Questions or requests concerning this Policy or your personal data: [email protected]. Viralcu is a service operated by Randevos LTD, company no. 17300468, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.