Privacy Policy

Version 1 · Last updated 29 October 2026 · GETVIRAL (app.getvir.al, getvir.al, *.getvir.al)

1. Who we are

The GETVIRAL platform (app.getvir.al, getvir.al, *.getvir.al) is operated by GETVIRAL, Tirana, Albania (below "GETVIRAL", "we"). We are the controller of the personal data processed on the platform, with one exception explained in section 5: for the data of a customer who orders a product, the selling business is a separate controller for the fulfilment of that order.

This policy is applied in accordance with Law no. 124/2024 "On the Protection of Personal Data" of the Republic of Albania, with Law no. 06/L-082 "On Protection of Personal Data" of the Republic of Kosovo for users in Kosovo (for example influencers and singers from Kosovo), and, where applicable, with Regulation (EU) 2016/679 (GDPR). Contact for any privacy matter: support@getvir.al.

2. Who this policy covers

  • Visitors of the public pages (the catalogue, influencer and business pages).
  • Visitors of getvir.al who write to us through the contact form.
  • Customers who order products, who do not have an account on the platform.
  • Influencers, businesses and singers with a registered account.
  • Administrators, partners and shareholders of a business that registers on GETVIRAL: we read their names from the public register of the National Business Center (QKB) only to compare them with the name of the person who manages the account, without storing them, and the business may upload the identity document of an administrator and, when the person who manages the account is not an administrator, that administrator's written authorisation, as proof that it represents the business, as described in section 3.

3. What data we collect

FROM PUBLIC VISITORS

  • An aggregate count of page views (how many times a page was opened), without building an individual visitor profile.
  • The IP address and technical request data, processed transiently for security and abuse limiting (rate limiting).
  • We use no advertising trackers, third-party pixels or analytics cookies.

FROM THE CONTACT FORM ON GETVIR.AL

  • Your name, email, role (business, influencer, singer or other), subject (question or complaint), message and consent.
  • The message reaches us by email through Resend and is not stored in the platform's database.
  • The IP address and a coded fingerprint of your email (not the address itself) are used transiently to limit abuse.

FROM CUSTOMERS WHO ORDER (NO ACCOUNT)

  • First and last name, phone number, email address, delivery address and city in Albania, and optional notes for the courier.
  • The IP address and browser type at the moment of ordering, kept only to investigate fraudulent or automated orders.
  • The content of the chat with the business, if the customer chooses to write before or after ordering (the chat opens via a secret link, without an account), and the email address used to send that link. The chat content is stored encrypted on our servers and GETVIRAL staff can read it only when a message is flagged by the automatic anti-bypass filter, reported or part of a complaint, and every such access is recorded. When the customer opens the chat with the link in the email we send when the chat is opened, or writes to the shop from the order page, we record when this happened, as proof that the address belongs to them. Only chats with a proven address count towards the shop's public response-speed label, and an unproven address receives at most a few chat emails a day from us.
  • Order data: the product, variant, price, status, the tracking number of the courier Ultra (U-CEP) and the status of the shipment, and, when the order is decided from Ultra's public tracking page, the source and the time of that decision.

FROM INFLUENCERS

  • Name, email, phone, password (stored hashed — we never see it), photo and bio.
  • The TikTok and Instagram accounts you connect through the platform's official login: their username and follower count. We never read your public profile pages automatically: your follower count comes from the platform's official API. It is used to confirm that the account is yours, to waive the monthly fee when the account you registered and verified with has 1000+ followers, and to spot unusual view counts.
  • The posts you submit to campaigns (link, platform, submission date), your confirmation of the posting rules, the result of the automatic check, complaints by businesses or singers about them with your explanation and, when a post is reviewed by staff, their decision with its reason, as well as the statistics of those posts described below.
  • The videos you offer for sale to businesses: the link, the platform, the product, the video's id on the network and, from TikTok, its duration, the result of the ownership check and, when staff review it, their decision with its reason, the original file you upload (with its size, its duration and the fingerprint (hash) that the video server gives for it, used only to detect a file replaced after the upload) and the sales of each video (the business, the price, your share, the licence dates and the reports about them with the staff decision).
  • Bank details (account holder, bank, Albanian or Kosovo IBAN) for paying out earnings.
  • Sales statistics, earnings, link clicks and the campaigns you take part in.
  • The digitally signed contract, with its date, version and the IP address at the moment of signing.
  • The shop address (<name>.getvir.al), whether it was proposed by us or chosen by you, the date you last changed it and your previous addresses for the 30 days they stay reserved. To propose your first address we use your verified TikTok or Instagram username or your 5-letter code, which are already public on your page. The address is public, like your page, because anyone can open it in a browser.

FROM CONNECTED TIKTOK ACCOUNTS

  • Connecting is voluntary and happens on TikTok's own login screen (TikTok Login Kit). We never see your TikTok password. With your consent we request the read-only permissions user.info.basic, user.info.profile, user.info.stats and video.list. If you switch one of them off on TikTok's screen, the connection is refused: we revoke the token at TikTok at once, store nothing and tell you which permission to leave on.
  • From your TikTok profile, through TikTok's official API, we receive: your account identifier (open_id), display name, username and follower count. We also request the profile link, only to read the username from it when TikTok does not return it separately. We do not store the link. We do not request your profile picture, bio, verified badge, or your following, likes and video counts.
  • For the videos you submit to campaigns, and only for those (requested by their ids), we receive: the video id, the time it was published, its caption, and its view and like counts. We use the caption only when you submit the video, to check the campaign hashtags, and we do not store it. We do not request comment or share counts.
  • For the videos you offer for sale to businesses, and only for those (requested by their ids), we receive the video id and its duration, to confirm that the video belongs to your connected account and to compare it with the original file you upload. We do not receive their caption or statistics.
  • Only when you press "Choose from my TikTok videos" while submitting a post, we read the list of your most recent public TikTok videos (id, publication time, caption and view count) to show it to you, so you can pick the video you made for the campaign. We show you only videos published after the campaign opened, and we do not store the list: we store only the video you submit.
  • We make no request to TikTok addresses outside the API. For this reason TikTok short links (vm.tiktok.com/… or tiktok.com/t/…) are not accepted when you submit a post: you paste the full link of the video, or choose it from your list as described above.
  • We use this data only to: confirm that the account is yours and, when you verify your profile with it, show its username as verified on your public GETVIRAL page, show you in your panel which account is connected, know your official follower count (for the free-subscription threshold of 1000 followers and the check of unusual view counts), check automatically that a post you submit is yours, was published after the campaign opened, still exists and contains the campaign hashtags, and pass it to our staff when the check cannot verify it, confirm that a video you offer for sale is yours and compare its duration with the original file you upload, count the views that determine your campaign reward, and compare them with the likes to flag unusual views for staff review, and show you your own statistics in your panel.
  • If you verify your profile with "Continue with TikTok" while your viral-video panel already uses another TikTok account, the verified account stays connected only to keep your profile's official follower count up to date. It is shown in "My profile" (Profili im), where you can disconnect it at any time. When your follower count comes from the connected account of your profile, we also store it on your GETVIRAL profile for as long as that connection exists.
  • We never post, comment, message, follow or change anything on your account, and we do not use TikTok data for advertising, profiling or any purpose other than those above.
  • The access tokens TikTok issues to us are stored encrypted (AES-256-GCM) in our database in the EU. When you disconnect the account from the last section of your panel that uses it (the viral-video panel, the singers' campaigns, or "My profile" for the account you verified your profile with), we revoke our access at TikTok and delete the tokens and the account's profile data at once. An account that no section of your panel uses any longer and that is not your profile's account, for example the old account of a section where you connected another one, is revoked and deleted automatically in the same way. You can also remove GETVIRAL from the app permissions in your TikTok settings. TikTok does not notify us of this, so the next time we try to use the connection and TikTok refuses our access, we delete the tokens, mark the connection as needing to be reconnected and notify you. If you do not reconnect it, the connection is deleted automatically after 90 days.

FROM CONNECTED INSTAGRAM ACCOUNTS (META)

  • When Instagram connection is available, it works through Meta's official "Instagram API with Instagram Login" and only for professional accounts (Creator or Business). It is voluntary and happens on Instagram's own login screen. We never see your Instagram password. With your consent we request the permissions instagram_business_basic and instagram_business_manage_insights. If you switch off one of them, or the account is not a professional account, the connection is refused and nothing is stored.
  • From your Instagram profile we receive: the ids of your account (the user id for our app and the id of your professional account), username, account type and follower count. We use the account type only to confirm that the account is professional and we do not store it. We do not request your name, profile picture, bio or number of posts.
  • To confirm that a post you submit to a campaign, or a video you offer for sale, is yours, we read the list of your recent media (id, media type, link and publication time) and look for the link you submitted. We store only the posts you submitted. For campaign posts we receive only the "views" insight (organic views only). We do not receive their caption, likes or any other metric, so the campaign hashtags on Instagram are not checked automatically: you confirm them when you submit the post, and our staff see them when the post is flagged for review or has a complaint.
  • The purposes (without the hashtag check, the comparison with likes and the duration of videos for sale, because we do not receive the caption, the likes or the duration), the read-only nature, the encrypted storage and the disconnection options (including an account you verified your profile with, shown in "My profile") are identical to those for TikTok. The long-lived token Meta issues lasts 60 days and is renewed automatically before it expires. It is deleted when you disconnect. If Meta ends our access for another reason (for example the token expired, or was invalidated after a password change), we delete the tokens, mark the connection as needing to be reconnected and notify you. If you do not reconnect it, the connection is deleted automatically after 90 days.
  • If you remove GETVIRAL from your Instagram settings (Settings → Apps and websites), Meta notifies us and we immediately delete the connection, its tokens, the profile data we received from it and the Instagram data of your campaign posts (described below), and notify you. A data deletion request sent through Meta is handled as described in section 8.
  • Whenever an Instagram connection is deleted (you disconnect it, you remove GETVIRAL from the Instagram settings, you ask for deletion through Meta, you delete your GETVIRAL account, or it stays without access for 90 days), we also delete the data Meta gave us about your campaign posts: the media id, the readings of the API (views) and the publication time, together with the automatic notes for our staff that repeat those numbers. For each campaign post only the view count that was counted for your reward remains, together with the reward amount, because they are the basis of the payment: the view count is deleted 12 months after the campaign closes, and the amounts are kept as long as accounting law requires. From then on our staff record the views of those posts.

FROM BUSINESSES AND SINGERS

  • The business or artist name, the first and last name of the person who manages the account, email, phone, photo and bio.
  • For businesses: the NIPT or, when the business has no NIPT, an identity document (ID card or passport) of the person who manages the business on GETVIRAL. The same document is also collected when the NIPT is not found in the QKB register or when the business says that the official name in the QKB is not its own, so that our staff can check the NIPT by hand. For businesses that sell physical products, also the business address (street and city), from where the orders are shipped.
  • The identity document is used only to verify who manages the business. It is stored privately, only authorised GETVIRAL staff see it, it is never shown publicly and it is never passed to Ultra, influencers or customers. It is kept while the account is active and deleted when the account is closed.
  • When an identity document is uploaded, the server also stores a numeric fingerprint (SHA-256) of the file, from which the document cannot be reconstructed. We use it only to notice when the same file is uploaded from several business accounts, and a person from our staff then reviews the case. This never stops the account. The fingerprint is not shown to the business and is deleted together with the document.
  • The name of the person who manages a business without a NIPT is compared with the names of the people who manage other businesses on GETVIRAL, so that our staff are alerted to a possible second account of the same person. No one is blocked automatically.
  • For a business that gives a NIPT, from the public register of the National Business Center (QKB), which the law makes freely accessible to anyone (Law no. 9723/2007 "On business registration", Article 66): we read the official name, the trade names, the legal form, the status (for example active, deregistered or suspended), the city, the registration date and the names of the administrators, partners and shareholders. For the status we also read the free "simple extract" that the same register provides, and we use only the status from it. For a business registered as a natural person, the official name is usually the owner's own name.
  • For every NIPT used on GETVIRAL we also keep a one-way code computed from the NIPT (not the NIPT itself) and the start date of its first free period, also after the account is deleted, so that a NIPT receives the free months for sales only once.
  • Of this we store only: the official name, the trade names, the legal form, the status, the city, the registration date, the time of the check, the result of the check (including your answer to whether the official name is your business's) and a yes or no answer to whether the name of the person who manages the account matches one of the administrators, partners or shareholders. Their names are compared only in the server's temporary memory, at the moment of the check: we never store them, never write them to our logs and never show them to the business. We do not store the extract either. When the same NIPT has recently been checked from another business account, or when a check could not be made because a limit on the number of checks was reached, we note this for our staff. The result of a search, without these names, is kept for at most 24 hours so that the register is not asked again and so that we notice when the same NIPT is checked from several business accounts, and is then deleted.
  • When the name of the person who manages the account does not match any administrator, partner or shareholder in the QKB, or when our staff ask for it, we ask the business for proof that this person has the right to represent it: the identity document of an administrator of the business registered in the QKB and, when the person is not an administrator, that administrator's written authorisation. These documents are handled like the identity document above.
  • GETVIRAL does not pass the business's name, address or phone to Ultra: the business has its own account and contract with Ultra. The business address is not shown on the public page.
  • Products, prices, commissions, the staff review of products held for the prohibited categories (the words that triggered it, the decision and its reason), orders, invoices and payments towards the platform.
  • The campaigns they open (category, description, instructions, hashtags, sound, budget), the staff decision on each campaign with its reason, and the complaints they file about campaign posts, with the staff decision.
  • For businesses that buy videos of their products: the videos they buy (the video, the influencer, the product, the price, the licence dates and renewals, the card payment) and the reports they make about them, with the staff decision.
  • For singers: links to their sounds on TikTok/Instagram and their YouTube channel, if provided.
  • The digitally signed contract, with its date, version and the IP address at the moment of signing.

FROM EVERY ACCOUNT, AT SIGN-UP

  • When any account is opened (influencer, business or singer): a random device identifier (gv_dev cookie), a technical fingerprint of the browser (a code computed from the browser type, language and platform) and the IP address at that moment. They are used solely to prevent referral fraud and fraud with the video sales level: a referral earns no reward when the new account is opened from the referring influencer's device, from a device that has already opened an account on GETVIRAL, or from the same browser and internet connection as another referred sign-up, and a video purchase does not count towards the influencer's level when the buying business was registered from the influencer's device or from the device of another buying business that already counts.
  • For an influencer who signs up through a referral link, the same data and the browser type are also stored with the referral, so that our staff can review a blocked referral.

FROM EVERY ACCOUNT, WHEN OUR STAFF ACT ON IT

  • When our staff block, unblock or delete an account: the decision, its date and time, the staff account that took it and the reason. A block always has a reason. The reason is not shown publicly.
  • When our staff remove an influencer's shop address or allow it to be changed before the 30 days: the decision, the address affected, its date and time, the staff account that took it and, for a removal, the reason. A removal always has a reason. The reason is not shown publicly.

FROM EVERYONE, FOR ERRORS AND THE SPEED OF THE PLATFORM

  • A technical error report when a page or an operation of the platform fails: the address of the page (without the private part of links and without parameters), the browser and device type, the technical error and, where relevant, the random identifier of the account concerned. It does not contain names, phone numbers, addresses, email addresses, message contents, passwords, payment data or IP addresses. It is sent to Sentry, as described in section 5.
  • A technical speed measurement for a sample of at most 5 in 100 requests to our servers, and for every automatic job and every notification that the payment and video services send to our servers, even when nothing fails: the address of the page or operation (without the private part of links and without parameters), how long each step took, the result code and the browser and device type. It does not contain names, phone numbers, addresses, email addresses, message contents, passwords, payment data, IP addresses or the identifier of your account. It is sent to Sentry together with the error reports.
  • The warning and error lines that our servers write to their technical log. Before they are sent to Sentry, they go through the same cleaning as the error reports.

4. Why we use the data and on what basis

  • To provide the service (account, catalogue, orders, payouts, campaigns): performance of our contract with you.
  • To let influencers sell, and businesses buy, the right to use videos (the ownership check of the video, the comparison of the original file with the posted video, the sale, the licence, renewals, reports and the payment of the influencer's share): performance of the contract. The ownership check through a connected account relies on your consent for that connection.
  • To track orders with the Ultra tracking number entered by the business (verifying the tracking number, checking that the parcel belongs to the order, showing the shipment status to the customer, the influencer and the business, and marking the order accepted or rejected automatically from Ultra's public tracking page): performance of the contract. For the checks that the parcel belongs to the order (city, reference, a number that is not repeated, times) and for following a parcel after a manual rejection or after its number is replaced: our legitimate interest in preventing fraud.
  • To verify who manages a business (NIPT or identity document), including the automatic check of the NIPT in the public QKB register, the comparison of the name of the person who manages the account with the administrators, partners and shareholders registered there and the proof of representation, and to use the official name on invoices and in the contract: performance of the contract with the business, our legal obligation for invoicing and our legitimate interest in preventing fraud and in knowing who is responsible for the account. For the administrators, partners and shareholders, whose names we read from the register only for this comparison and do not store, and for the identity document of an administrator and the written authorisation uploaded as proof, the basis is our legitimate interest, and that of the real business, in preventing fraud.
  • For connected social accounts (TikTok, Instagram): your consent, which you withdraw by disconnecting the account.
  • For invoicing and financial documentation: legal obligation (tax and accounting legislation).
  • For account security, fraud prevention (fake orders, self-referrals, purchased views), the automatic check of campaign posts through the official APIs, the staff review of campaigns, of products held for the prohibited categories, of flagged posts and of complaints, and abuse limiting: our legitimate interest in keeping the platform safe, fair and compliant with the rules of TikTok and Instagram.
  • For essential emails (confirmations, invoices, payouts, orders): performance of the contract. These cannot be unsubscribed from because the service does not function without them.
  • For news and marketing emails: your consent, withdrawable at any time from the unsubscribe link in the email (the link opens a page where you confirm with one click, so that email scanners cannot unsubscribe you without your knowledge), from your mail app's own 'Unsubscribe' button, or from your profile.
  • For push notifications on your device: your consent given in the browser, withdrawable from your profile or your browser settings.
  • To detect and fix errors and outages of the platform (technical error reports, speed measurements on a sample of requests, the warning and error log of our servers and checks that the platform and its automatic jobs are running): our legitimate interest in a secure and working service.
  • To reply to messages sent through the contact form: your consent, given with the form's checkbox. You withdraw it by writing to us at support@getvir.al.

5. Who we share it with

We never sell your data and we never hand it over for advertising.

WITHIN THE OPERATION OF THE PLATFORM

  • The data of a customer who orders (name, phone, address, city) is passed ONLY to the selling business, solely for delivering the order. The business gives Ultra, with which it has its own contract, only what the delivery and the collection of the payment need, and it is contractually bound to use the data for this purpose only. GETVIRAL sends Ultra no customer data. The customer's email is not passed to the business, the influencer or Ultra: only we use it, for the order confirmation and the tracking link, and never for advertising.
  • Ultra (U-CEP), the courier with which businesses deliver orders in Albania, receives the shipment data from the business, under the business's contract with Ultra, and processes it under its own obligations as a postal service provider. GETVIRAL only checks the parcel's tracking number on Ultra's public tracking page (u-cep.com), to verify it (that the parcel exists and when it was created), to show the shipment status and to mark the order accepted or rejected from it. For open orders our system reads this page automatically, at a limited rate (no more than 20 readings per minute in total). We store only the shipment step (for example Për Shpërndarje, Dorëzuar or Refuzuar), the time the parcel was created and last updated, the time of the reading and the yes or no result of the checks. We read the city, postal code and country shown by the page only in the server's temporary memory, to compare them with the city of the order, and the parcel's reference only to compare it with the order code: we do not store them and do not write them to our logs. We send Ultra no personal data and do not read or store any other recipient data.
  • The influencer NEVER sees the customer's name, phone, address or email: they only see the product, the status and the parcel's tracking number. Ultra's public tracking page, which opens with the tracking number, may show the city and postal code of the delivery.
  • The business or singer who runs a campaign sees the posts you submitted to that campaign and their view counts, as needed to account for the rewards and for complaints. They do not receive your access tokens or any other data from your connected accounts.
  • The business that owns a product sees the videos influencers offer for it: the influencer's name, photo and level, the link of the posted video and the video itself through the official TikTok or Instagram player. Only the business that buys a video receives a copy of its file (MP4, up to 1080p, without the location data that a phone may store in the original). The influencer sees which business bought the video and the reports about it.
  • The public profile of an influencer, business or singer (photo, bio, social networks, products, the level of a verified influencer, the business's Trust score) is visible to anyone — that is the nature of the service. The level shows only its name (RISING STAR, VIRAL or ICON), never the number of videos sold.

PROCESSORS WORKING FOR US

  • Supabase Inc. — database, accounts and file storage (data centre in Frankfurt, EU).
  • Vercel Inc. — hosting of the application and of the getvir.al website, including the endpoint that receives the messages of the getvir.al contact form (functions running in Frankfurt, EU). The pages of the getvir.al website are delivered through Vercel's global network.
  • Resend (Plus Five Five Inc.) — email delivery, including forwarding the contact form messages to our mailbox.
  • Cloudys (DCGRP OÜ, Estonia, cloudys.com) — hosting of the @getvir.al mailboxes (support@, ankesa@), where the emails you send us and the contact form messages arrive (server at Hetzner Online GmbH in Germany, EU). Backup copies are also kept at Hetzner USA LLC in the USA and at Hetzner Singapore Pte Ltd in Singapore, under the EU standard contractual clauses.
  • POK (pokpay.io) — processing of card payments. Card data is entered on POK's pages and never reaches GETVIRAL. POK receives the amount, the currency, our payment reference and, to prefill its page, your email.
  • Functional Software, Inc. d/b/a Sentry (USA) — monitoring of application errors and performance. Error reports, speed measurements and the warning and error log of our servers are stored in Frankfurt (EU). They contain the page (without the private part of links and without parameters), the browser and device type, the technical error or how long each step took and, for an error, where relevant, the random identifier of the account concerned. We do not send names, phone numbers, addresses, email addresses, message contents, passwords, payment data or IP addresses, and Sentry is set not to store IP addresses.
  • Cloudflare, Inc. (USA), Turnstile — protection of the sign-up, login, password reset, email-link confirmation, order, ask-the-shop and contact forms against automated programs. When one of these forms is open, your browser connects to Cloudflare, which receives your IP address and technical signals from the browser and the device, to tell a person from a program. Cloudflare uses them only for this check and not for advertising. We do not send Cloudflare your name, email, phone number, address or anything else you write in the form.
  • BunnyWay d.o.o. (bunny.net, Slovenia, EU) — storage, encoding and streaming of product videos and of the original files of the videos influencers sell. The videos are stored mainly in Frankfurt (EU), with copies at Bunny's storage locations in Singapore and the USA. When you upload or watch a product video, or upload the original file of a video for sale, your browser connects directly to Bunny's network, which receives your IP address as any web server does. Before a video leaves your device, the app removes from the file the location that your phone may have stored in it. A business downloads a bought video through our server, which fetches it from Bunny, so its browser does not connect to Bunny for the download.
  • Your browser's push services (e.g. Google, Mozilla, Apple) — only if you turn on push notifications: they deliver the notification to your device. The content is encrypted and they cannot read it.
  • TikTok and Meta (Instagram) act as sources of the data you authorise us to read. They process your data under their own terms and privacy policies. When you disconnect TikTok, we send TikTok only the request that revokes our access. When a business presses "Watch video" on a video offered for sale, the official TikTok or Instagram player of that post is loaded in the business's browser from the servers of TikTok or Meta, which receive its IP address and may set their own cookies, under their own policies. The player is not loaded before that press.
  • The National Business Center (QKB) is a public source, not a processor: for the NIPT that a business gives us, we read its public register "Search for subject" and the free simple extract, as anyone can. We send it only the NIPT and no other data.
  • Supabase, Vercel, Resend, Cloudys, POK and Sentry handle data only under our instructions, under data processing agreements.

AUTHORITIES

  • We provide data to public authorities only where the law requires it, upon a valid request.

6. Transfers outside Albania and Kosovo

Our main storage is in the European Union (Frankfurt). Some processors may process data in the USA. The @getvir.al mailboxes are hosted by Cloudys in Germany (EU), and their backup copies are also kept at Hetzner USA LLC in the USA and at Hetzner Singapore Pte Ltd in Singapore, under the EU standard contractual clauses. The getvir.al website is delivered by Vercel Inc. (USA) through its global network. Error reports, speed measurements and technical logs sent to Sentry are stored in Frankfurt (EU). Sentry is a US company, and any access from the USA is covered by the standard contractual clauses of its data processing agreement. Product videos and the original files of the videos influencers sell are stored at Bunny mainly in Frankfurt (EU), with copies in Singapore and the USA. Cloudflare, which checks the forms against automated programs, is a US company and processes these checks in its global network. Transfers are protected by recognised legal safeguards (standard contractual clauses and, where applicable, the EU–US Data Privacy Framework).

7. How long we keep it

  • Account and profile data: for as long as the account is active.
  • The identity document of the person who manages a business and its numeric fingerprint (SHA-256): while the account is active. They are deleted when the account is closed, as described in section 8, and when the document is replaced with a new one or removed.
  • The NIPT and the business address: while the account is active. The NIPT and the official name also stay on the invoices for as long as accounting law requires.
  • The data of a business read from the QKB register (official name, trade names, legal form, status, city, registration date, time of the check, result of the check, the yes or no answer of the comparison and the notes for our staff): while the account is active. When the NIPT changes, they are replaced by the result of the new check. The names of the administrators, partners and shareholders are never stored. The result of a QKB search kept so that the register is not asked again and so that checks of the same NIPT from several accounts are noticed: at most 24 hours, then deleted automatically.
  • The data of a shipment at Ultra: Ultra keeps them under its own legal obligations and its contract with the business.
  • The readings of Ultra's tracking page: up to 90 days after the last reading, then deleted automatically. The source and the time of an automatic decision are kept with the order.
  • Access tokens of connected TikTok and Instagram accounts: only while the connection is valid. They are deleted immediately when you disconnect the account from your panel, when you or the platform revoke our access, and when you delete your account.
  • For the TikTok or Instagram account with which you verified your profile, a one-way code computed from the account's identifier (not the identifier itself): while your profile stays verified with that account, also after you disconnect it, so that the same account cannot verify another GETVIRAL profile. It is deleted when you remove that network from your profile or when your account is deleted.
  • For the TikTok or Instagram account that made your subscription free, a one-way code computed from the account's identifier (not the identifier itself): while your subscription stays free with that account, also after you disconnect it, so that our staff are alerted when the same account makes another profile free. It is deleted when the fee is restored or when your account is deleted.
  • When a business's purchases do not count towards an influencer's level because the business was registered from the same device, we keep only the identifiers of the two accounts (not the device, the IP or any names), also after one of them is deleted, so that the level and the video price do not rise after the deletion.
  • When our staff are alerted to a possible second account (the same manager name, the same identity document file, or the same TikTok or Instagram account making another profile free), we keep only the identifiers of the two accounts and the type of the alert, also after one of them is deleted, so that the staff do not lose the case.
  • The profile data of a connected account (identifier, display name, username, follower count), including the follower count copied to your GETVIRAL profile when the connected account is your profile's account: while the connection exists. A connection whose access ended without you disconnecting it (you revoked it from the TikTok settings, TikTok ended it, or the Instagram token expired or was invalidated) keeps no tokens and is deleted automatically after 90 days if it is not reconnected. An Instagram connection removed from the Instagram settings is deleted at once. A connected account that no section of your panel uses any longer and that is not your profile's account is deleted automatically (for TikTok, after we revoke our access).
  • Statistics of posts submitted to campaigns (views and, for TikTok, likes), including the automatic notes for our staff that repeat these numbers: for 12 months after the campaign closes, for reward accounting and complaints. Then they are deleted automatically. For Instagram posts, the data received from Meta (media id, API readings, publication time) are deleted earlier, as soon as the Instagram connection is deleted. Only the view count counted for the reward stays until the 12 months. The amounts reserved and paid remain in the financial records below.
  • Complaints about campaign posts (reason, description, the influencer's explanation and the staff reply): the texts are deleted together with the post statistics, 12 months after the campaign closes, or after the staff decision when the complaint is still open at that time. The reason and the outcome remain with the post's financial records.
  • Videos offered for sale: the link, the check result and the staff decision while the video is on the platform. The links of unsold videos are deleted together with your other data when your account is deleted (section 8). The original file: while the video is offered for sale, and for a sold video while its link stays active, so that the business can renew its licence. It is deleted automatically when you remove an unsold video, when the video is rejected or withdrawn after an upheld report, when it is uploaded again over the first file, and, when your account is deleted, once the business's last licence has expired. After the account is deleted, the file of a sold video is kept until the last licence of a business expires, also when the business renews the licence before it expires. An uploaded file that is not linked to a video is deleted after 24 hours. The records of video sales and licences (the parties' names, the product, the price, the licence dates and the payment) are kept as financial documents. The texts of reports about bought videos (the business's description and the staff note) are deleted 12 months after the decision. The reason and the outcome remain with the sale.
  • Financial documents (invoices, payouts, contracts): as long as tax and accounting legislation requires, currently up to 10 years.
  • Order data: as long as needed for fulfilment, complaints and the parties' legal obligations.
  • Chat messages (with customers, between influencers and businesses, and about campaigns): stored encrypted with a key held only by the platform, for 12 months after the last message of the conversation, then deleted, for complaints and for checking attempts to move orders outside the platform. Staff access is recorded and kept for 24 months.
  • The part of a message caught by the automatic anti-bypass filter (up to 200 characters), kept encrypted with the flag as evidence: for 12 months from the flag, then deleted. The category, the decision and any Trust score reduction remain. Staff see it only by opening the flag, and every opening is recorded.
  • Notifications in the app (the bell in your panel): 12 months from the day they were created, then deleted automatically, even when they repeat texts that are deleted earlier elsewhere (for example a staff reply to a complaint). The text of the notes attached to Trust score changes is deleted after the same 12 months, while the change itself, its amount and its date remain. Our staff's notifications about campaign posts held for review do not contain numbers received from Meta or TikTok.
  • Contact form messages and the emails you send to support@getvir.al or ankesa@getvir.al: in our mailbox for up to 12 months from the last reply, then deleted.
  • Sign-up device data (device identifier, browser fingerprint, IP address and, for a referral, the browser type): until the account is deleted. They are erased together with your other personal data, as described in section 8. The referral's status and amount remain in the financial records.
  • Technical security logs (IP, sign-in attempts, request limits): up to 90 days, then deleted automatically.
  • Error reports, speed measurements and technical logs at Sentry: up to 30 days (up to 90 days on a paid plan), then deleted automatically.
  • Previous shop addresses are kept for 30 days after a change, after a removal by our staff or after the account is permanently deleted, so that visitors reach the new address and nobody takes the old one immediately, and are then deleted. A name blocked by our staff stays on the list of blocked names without any note and without a link to an account. The staff decision that blocked it (the address, the account and the reason) stays in the record of staff decisions, like the other staff decisions.
  • The record of staff decisions on an account (block, unblock, deletion, removal of a shop address, with the reason): it is kept after the account is deleted, without the name or the email of the person, for as long as needed for complaints and legal claims.

8. How to delete your data

  • Your account: from your panel, 'Delete my account'. The account is closed immediately and the tokens of your connected accounts are deleted at once (for TikTok, after revoking our access at TikTok). From that moment no request is made to TikTok or Instagram for your account. Our staff erase or anonymise your other personal data (name, email, phone, bank details, social usernames, the identity document and the address of a business, the data of a business read from the QKB register, sign-up device data, the links of the videos you offered for sale and did not sell, notifications) within 30 days. An account with orders still in progress or unsettled obligations (including a payout you are still owed) is closed once they are completed, or on request at support@getvir.al.
  • A connected TikTok or Instagram account only: 'Disconnect' in your panel (in the viral-video panel, or in "My profile" for the account you verified your profile with), once the account is no longer used in any section of your panel, deletes its tokens and profile data at once, including the follower count copied from it to your GETVIRAL profile, and, for TikTok, revokes our access at TikTok. For Instagram it also deletes the Instagram data of your campaign posts, as described in section 3. If you remove GETVIRAL from the Instagram settings, Meta notifies us and the same deletion happens at once. If you remove it from the TikTok settings, TikTok does not notify us: we delete the tokens the next time we try to use them, and the connection, kept without tokens so that you can reconnect it, is deleted automatically after 90 days together with its profile data.
  • Through Meta (Instagram): you can also ask Instagram to delete the data GETVIRAL holds about your Instagram account (Settings → Apps and websites → GETVIRAL). Meta sends us a signed request. We immediately delete the connection, its tokens, the profile data we received from it (including the follower count copied to your GETVIRAL profile) and the Instagram data of your campaign posts (media id, API readings, publication time), notify you and return a confirmation code. What remains, and why: for each campaign post, the view count that was counted for your reward and the reward amount, because they are the basis of the payment. The view count is deleted automatically 12 months after the campaign closes, and the amounts are kept as long as accounting law requires. The Instagram username shown on your GETVIRAL profile stays part of that profile until you change it or delete your account. You can check the status of the request at https://app.getvir.al/api/oauth/instagram/fshirja?kodi= followed by your code.
  • What we cannot delete on request: invoices, payouts and signed contracts that the law obliges us to keep (see section 7). They are kept without any data that is not required.
  • Any other request, or if you cannot sign in: write to support@getvir.al from the email of your account. We confirm within 30 days.

9. Your rights

Under Law 124/2024, Law no. 06/L-082 of Kosovo (for users in Kosovo) and the GDPR you have the right to request: access to your data, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, portability (a copy of your data in a machine-readable format), and withdrawal of consent at any time (without affecting the lawfulness of processing up to that point).

  • Most of these you exercise yourself from the panel: editing your profile, changing your email and password, unsubscribing from emails, disconnecting social accounts, deleting your account.
  • For any other request write to us at support@getvir.al. We respond within 30 days.
  • If you believe we have violated your rights, you may lodge a complaint with the Commissioner for the Right to Information and Personal Data Protection in Albania (www.idp.al) or, if you are in Kosovo, with the Information and Privacy Agency (aip.rks-gov.net).

10. Automated processing

Some steps on the platform are automated: the monthly fee is waived automatically at the follower threshold of your profile's account, and is reinstated automatically, with notice and a grace period, when the account that made it free is removed or replaced. Your profile is verified automatically when you prove that an account is yours by connecting it through the official TikTok or Instagram login, and its username and follower count then come from the official API. A connection is refused automatically when you switch off one of the permissions we request, when the account is already connected to another GETVIRAL account or, when you verify your profile, it is the verified account of another GETVIRAL profile, and, on Instagram, when the account is not a professional account. An order is marked accepted automatically when the business does not update it within the deadline or does not enter the tracking number within the deadline. An order with an Ultra tracking number is marked accepted automatically when Ultra's public tracking page shows Delivered, and rejected when it shows Refused or that the parcel was returned, only when the checks described in the Terms pass. The business and the influencer may file a complaint, and a person from our staff reviews it. A manual rejection of an order is refused automatically when this page shows Delivered. A tracking number entered by a business is refused automatically when Ultra's public tracking page does not find it, when the page shows that the parcel was created more than 15 minutes before the order, or when the same number is already on a still open order of another business. A product whose title, description or variants contain words linked to the prohibited categories is saved inactive automatically and is not shown publicly unless a person from our staff approves it. The follower count of a connected account is refreshed daily from the official API. A post is not accepted when it comes from a connected TikTok or Instagram account and the official API shows that it is not yours or not public (on Instagram: that it is not among the connected account's posts published after the campaign opened), or that it was published before the campaign opened. A post that passes the automatic checks (ownership, publication date and, on TikTok, the hashtags) is approved automatically and its views count towards the reward. The reward is reserved automatically according to the views. A post that the official API shows as deleted or private before 7 days from the first moment the platform confirmed it public is not rewarded. When the automatic check cannot verify a post, when hashtags are missing or when views are unusual (on TikTok few likes compared with the views, a sudden jump in views, views far above the follower count), the post is not rejected automatically: it is held for review by a person from our staff. A person also reviews every complaint by a business or singer about a post, and apart from the automatic cases above only a person rejects or blocks a post. Every campaign is approved by a person. When a business gives or changes its NIPT, it is checked automatically in the public QKB register: whether it exists, whether it is active, what its official name is and whether the name of the person who manages the account matches one of the administrators, partners or shareholders registered there (for a business registered as a natural person, the official name). A business is verified automatically only when the NIPT is active, the official name is the business's (the name the business chose matches it or one of its trade names, or the business confirms it) and the name of the person matches. This check alone never refuses an account and never stops anything: the business's products and campaigns continue normally, whatever the result. Doubtful cases are reviewed by a person from our staff, for example when the NIPT is not found or is not active, when the business says that the official name is not its own, when the name of the person does not match or when the business has no NIPT. When the name of the person does not match, the business is asked automatically for the identity document of an administrator registered in the QKB and, when the person is not an administrator, for that administrator's written authorisation, and a person from our staff checks them. When the register or its extract does not respond, the check is repeated automatically later. The NIPTs that businesses gave before this check existed are checked once in the background: this never stops anything, it verifies a business automatically when everything matches, and otherwise a person reviews the data. Our staff can also repeat a check by hand. When a later check finds something that was not there before (for example the NIPT is no longer active or the name of the person does not match), the verification mark is removed and a person from our staff reviews the business again. This never stops anything. A video offered for sale is accepted automatically when the official API confirms that it belongs to your connected account, and is refused automatically when the API shows that it belongs to another account. When the API cannot verify it, a person from our staff reviews it. An original file whose duration differs by more than 2 seconds from the duration TikTok gives for the post is rejected automatically, and the price of a video follows automatically from the influencer's level. Every automated outcome can be contested through the complaints system or by writing to us at ankesa@getvir.al, and a person reviews it. The NIPT of a verified business is checked again automatically once a year, and when the NIPT is not found in the QKB the identity document is requested automatically. A person from our staff reviews every automatic verification. When the same identity document file is uploaded by more than one business account, our staff are notified and a person reviews the case. This never stops anything.

11. Cookies and similar technologies

We use essential cookies only. We have no advertising cookies, no third-party trackers, and we do not follow your history across the internet.

  • Sign-in cookies (__Host-sb-*): keep your session open. Without them you cannot access your account. Duration: up to 400 days from your last visit, or until you sign out. For our staff the separate __Host-sb-admin cookie lasts 12 hours.
  • __Host-gv_pajisja: set when you sign in successfully, so that this browser can still sign in to your account while someone else is repeatedly entering wrong passwords for it. It holds only a code derived from your email address and the time of sign-in, not the address itself, and it never signs you in without your password. Duration: 180 days.
  • gv_dev: a random device identifier, used solely to prevent referral fraud and fraud with the video sales level. The cookie itself holds only a random code. On our server it is linked to the account opened from that device, as described in section 3. It is not used for advertising. Duration: 1 year.
  • __Host-gv_tt_state and __Host-gv_ig_state: set only while you connect a TikTok or Instagram account, to protect the connection against forged requests (CSRF), to make sure the connection is completed by the same account that started it and to return you to the right page. Duration: 10 minutes, deleted as soon as you return from TikTok or Instagram.
  • gv_tarifa_pare: set when an influencer continues from the fee page during sign-up, so that later visits go straight to connecting the account instead of showing the fee page again. It holds only the value "1". Duration: 1 year.
  • gv-rivendosja: set only after you open a password-reset or invitation link, so that only that visit can set the new password. Duration: 15 minutes, only on the new-password page.
  • Device storage (localStorage), which stays on your device until you clear the browser data and never leaves it: gv_cookies_ok (your choice on this notice, so it does not reappear), gv-instaluar (that the app is installed, so the install invitation does not reappear), gv-instalimi-mbyllur (that you closed the install invitation, which then stays hidden for 14 days), gv-njoftimet-fikur:<account> (that you switched notifications off for an account on this device), gv-shporta:<business> (the cart of a customer without an account: the chosen product codes, variants and quantities). When you open a shop at its own address (<name>.getvir.al), your browser keeps this storage, including the cart, separately for that address.
  • Tab storage (sessionStorage), deleted when you close the tab: gv-hyrja-email (your email for a few seconds when you sign in through the wrong door, so you do not retype it), gv-shporta-derguar:<business> and gv-perpjekja:<form> (protection against the same order being sent twice), gv-bubble-dirty (refreshes the unread counters after you have read something), gv-hapja (that the opening animation of the installed app has already played, so it plays only once each time you open the app).
  • Browser cache (Cache Storage): the app's service worker keeps only the app icons, no pages and no data, so the installed app shows its icon.
  • Error reports: when a page fails, your browser sends a technical error report through our own domain (app.getvir.al). It uses no cookies and stores nothing on your device.
  • Video players of TikTok and Instagram: on the page with the videos of your products, the official player of a post is loaded only when you press "Watch video", which is your choice to load it. From then on TikTok or Meta may set their own cookies in that player, under their own policies. GETVIRAL sets and reads no cookie for this.
  • Apart from the video players, which you choose to load, all of them are essential for functioning or security, so no separate consent is required. We inform you through the banner and this page.

12. Security

  • All communication is encrypted (HTTPS).
  • Passwords are stored hashed. We never see them. Social-account tokens are stored encrypted (AES-256-GCM).
  • The database is protected with row-level access rules (Row Level Security), with access denied by default. The application reads and writes only through server-side code.
  • Failed sign-in attempts are slowed down with growing delays, and sensitive actions (sign-in, registration, ordering, administration) have request limits.
  • Administrative access is limited to authorised staff, through a separate sign-in with attempt limits.
  • The identity documents of businesses are kept in a private storage area, never public, accessible only to authorised staff. A member of staff opens a document only after giving a reason, through a link that expires within 60 seconds, and every opening is recorded.

13. Minors

GETVIRAL accounts may be opened only by persons 18 years or older, or by minors acting through their legal representative, as set out in the Terms of Service. The service is not directed at children and we do not knowingly collect their data. If such a case is brought to our attention, we delete the data.

14. Third-party platforms

We receive data from TikTok and Instagram only through their official APIs and only for accounts connected with the owner's authorisation. We never read TikTok or Instagram pages automatically. We make no request to TikTok or Instagram addresses outside these APIs. For this reason TikTok short links are not accepted when you submit a post (see section 3). The only exception is the official player of a post, which a business's own browser loads when it presses "Watch video" on a video offered for sale (section 11). Our use of information received from TikTok's APIs complies with the TikTok Developer Terms of Service and Developer Policy. Our use of information received from Meta's APIs complies with the Meta Platform Terms and Developer Policies. GETVIRAL is an independent service and is not affiliated with, endorsed or sponsored by TikTok or Meta.

We do not sell or license the data we receive from TikTok or Meta, we do not give it to data brokers or advertising networks, we do not use it for advertising or surveillance, and we do not combine it with data from other sources to build profiles or databases about you or anyone else. Within GETVIRAL, you see this data in your panel, and authorised staff see it to review accounts, posts and complaints. The business or singer of a campaign sees only the posts you submit to that campaign and their view counts (section 5). The username of the account you verified your profile with is shown on your public page. Apart from this, it is used only for the purposes described in section 3 and in the automatic checks described in section 10. When a connection ends, or when you delete your account, this data is deleted as described in section 7 and section 8.

PUBLIC REGISTER OF THE NATIONAL BUSINESS CENTER (QKB)

The QKB register is public by law: anyone may search it free of charge, also electronically (Law no. 9723/2007 "On business registration", Article 66). We read it only for the NIPT that a business gives us: when it gives or changes it, again later when the register or its extract did not respond, once in the background for the NIPTs given before this check existed, and when our staff repeat a check by hand, always with a limit of checks for each business and a daily limit for all checks. We never search it in bulk and never by a person's name. We use the result only to verify the business and for its invoices and contract, as described in section 3 and section 10, and we do not combine it with data from TikTok or Meta. An administrator, partner or shareholder of a business who wants to know what we did with their name, or to object, can write to us at support@getvir.al.

15. Changes to this policy

When we change this policy in a substantial way, we notify you on the platform and by email before it takes effect. The version and the update date always remain at the top of this page. This policy is available in English and Albanian. Both versions have the same content.

16. Contact

For any privacy question: support@getvir.al. See also the Terms of Service.

Questions: support@getvir.al · Complaints: ankesa@getvir.al

See also: Terms of Service