GETVIRAL

Privacy Policy

Version 2 · Last updated 12 September 2026 · GETVIRAL (app.getvir.al, getvir.al)

1. Who we are

The GETVIRAL platform (app.getvir.al, getvir.al) is operated by GETVIRAL, Tirana, Albania (below "GETVIRAL", "we"). We are the controller of the personal data processed on the platform, with one exception explained in section 5: for the data of a customer who orders a product, the selling business is a separate controller for the fulfilment of that order.

This policy is applied in accordance with Law no. 124/2024 "On the Protection of Personal Data" of the Republic of Albania and, where applicable, Regulation (EU) 2016/679 (GDPR). Contact for any privacy matter: support@getvir.al.

2. Who this policy covers

  • Visitors of the public pages (the catalogue, influencer and business pages).
  • Customers who order products, who do not have an account on the platform.
  • Influencers, businesses and singers with a registered account.

3. What data we collect

FROM PUBLIC VISITORS

  • An aggregate count of page views (how many times a page was opened), without building an individual visitor profile.
  • The IP address and technical request data, processed transiently for security and abuse limiting (rate limiting).
  • We use no advertising trackers, third-party pixels or analytics cookies.

FROM CUSTOMERS WHO ORDER (NO ACCOUNT)

  • First and last name, phone number, delivery address, city and optional notes for the courier.
  • The IP address and browser type at the moment of ordering, kept only to investigate fraudulent or automated orders.
  • The content of the chat with the business, if the customer chooses to write before or after ordering (the chat opens via a secret link, without an account), and the email address used to send that link.
  • Order data: the product, variant, price, status and postal tracking number.

FROM INFLUENCERS

  • Name, email, phone, password (stored hashed — we never see it), photo and bio.
  • TikTok/Instagram usernames and the public follower count. We read the follower count from your public profile information and, when you connect the account, from the platform's official API. It is used to verify the profile is yours and to waive the monthly fee at 1000+ followers.
  • Bank details (account holder, bank, IBAN) for paying out earnings.
  • Sales statistics, earnings, link clicks and the campaigns you take part in.
  • For the referral programme: a random device identifier (gv_dev cookie) and a technical browser fingerprint, used solely to prevent fraudulent self-referrals.

FROM CONNECTED TIKTOK ACCOUNTS

  • Connecting is voluntary and happens on TikTok's own login screen (TikTok Login Kit); we never see your TikTok password. With your consent we request the read-only permissions user.info.basic, user.info.stats and video.list.
  • Through TikTok's official API we receive: your account identifier (open_id), display name, profile picture and follower count; and the list of your own public videos with their id, description, cover image, creation time and view, like, comment and share counts.
  • We use this data only to: confirm the account is yours, count followers for the free-registration threshold, verify that a post you submit to a campaign is yours and was published within the campaign period, and count the views that determine your campaign reward.
  • We never post, comment, message, follow or change anything on your account, and we do not use TikTok data for advertising, profiling or any purpose other than those above.
  • The access tokens TikTok issues to us are stored encrypted (AES-256-GCM) and are deleted when you disconnect. You can disconnect at any time from your panel, or revoke access in TikTok under Settings → Security → Manage app permissions.

FROM CONNECTED INSTAGRAM ACCOUNTS (META)

  • When Instagram connection is available, it works the same way through Meta's official Instagram Login for professional (Creator/Business) accounts. With your consent we request read-only access to your profile (user id, username, account type, profile picture, follower count) and to your own media (id, caption, media type, link, publish time and view/like/comment counts).
  • The purposes, the read-only nature, the encrypted storage and the deletion rules are identical to those for TikTok. If you remove GETVIRAL from your Instagram settings (Settings → Apps and websites), Meta notifies us and we delete the connection immediately; a data deletion request sent through Meta is completed within 30 days with a confirmation code.

FROM BUSINESSES AND SINGERS

  • The business or artist name, email, phone, tax ID (NIPT, for businesses), photo and bio.
  • Products, prices, commissions, orders, invoices and payments towards the platform.
  • For singers: links to their sounds on TikTok/Instagram and their YouTube channel, if provided.
  • The digitally signed contract, with its date, version and the IP address at the moment of signing.

4. Why we use the data and on what basis

  • To provide the service (account, catalogue, orders, payouts, campaigns): performance of our contract with you.
  • For connected social accounts (TikTok, Instagram): your consent, which you withdraw by disconnecting the account.
  • For invoicing and financial documentation: legal obligation (tax and accounting legislation).
  • For account security, fraud prevention (fake orders, self-referrals, purchased views) and abuse limiting: our legitimate interest in keeping the platform safe and fair.
  • For essential emails (confirmations, invoices, payouts, orders): performance of the contract; these cannot be unsubscribed from because the service does not function without them.
  • For news and marketing emails: your consent, withdrawable at any time with one click on the unsubscribe link or from your profile.
  • For push notifications on your device: your consent given in the browser, withdrawable from your profile or your browser settings.

5. Who we share it with

We never sell your data and we never hand it over for advertising.

WITHIN THE OPERATION OF THE PLATFORM

  • The data of a customer who orders (name, phone, address) is passed ONLY to the selling business and the postal service, solely for delivering the order. The business is contractually bound to use it for this purpose only.
  • The influencer NEVER sees the customer's personal data; they only see the product, the status and the tracking number.
  • The business or singer who runs a campaign sees the posts you submitted to that campaign and their view counts, as needed to account for the rewards; they do not receive your access tokens or any other data from your connected accounts.
  • The public profile of an influencer, business or singer (photo, bio, social networks, products, the business's Trust score) is visible to anyone — that is the nature of the service.

PROCESSORS WORKING FOR US

  • Supabase Inc. — database, accounts and file storage (data centre in Frankfurt, EU).
  • Vercel Inc. — application hosting (functions running in Frankfurt, EU).
  • Resend (Plus Five Five Inc.) — email delivery.
  • TikTok and Meta (Instagram) act as sources of the data you authorise us to read; they process your data under their own terms and privacy policies.
  • These processors handle data only under our instructions, under data processing agreements.

AUTHORITIES

  • We provide data to public authorities only where the law requires it, upon a valid request.

6. Transfers outside Albania

Our main storage is in the European Union (Frankfurt). Some processors may process data in the USA. Transfers are protected by recognised legal safeguards (standard contractual clauses and, where applicable, the EU–US Data Privacy Framework).

7. How long we keep it

  • Account and profile data: for as long as the account is active.
  • Connected social accounts: the access tokens until you disconnect or the connection expires; the profile snapshot (username, picture, follower count) while the connection exists; view statistics of posts submitted to campaigns for 12 months after the campaign closes, for reward accounting and complaints.
  • Financial documents (invoices, payouts, contracts): as long as tax and accounting legislation requires, currently up to 10 years.
  • Order data: as long as needed for fulfilment, complaints and the parties' legal obligations.
  • Technical security logs (IP, sign-in attempts, request limits): up to 90 days, then deleted automatically.

8. How to delete your data

  • Your account: from your panel, 'Delete my account'. The account is closed immediately and your personal data (name, email, phone, bank details, social usernames, connected-account tokens, notifications) is erased or anonymised within 30 days.
  • A connected TikTok or Instagram account only: 'Disconnect' in your panel deletes its tokens and profile snapshot at once; the same happens when you revoke access from the TikTok or Instagram settings.
  • What we cannot delete on request: invoices, payouts and signed contracts that the law obliges us to keep (see section 7); they are kept without any data that is not required.
  • Any other request, or if you cannot sign in: write to support@getvir.al from the email of your account. We confirm within 30 days.

9. Your rights

Under Law 124/2024 and the GDPR you have the right to request: access to your data, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, portability (a copy of your data in a machine-readable format), and withdrawal of consent at any time (without affecting the lawfulness of processing up to that point).

  • Most of these you exercise yourself from the panel: editing your profile, changing your email and password, unsubscribing from emails, disconnecting social accounts, deleting your account.
  • For any other request write to us at support@getvir.al; we respond within 30 days.
  • If you believe we have violated your rights, you may lodge a complaint with the Albanian Commissioner for the Right to Information and Protection of Personal Data (www.idp.al).

10. Automated processing

Some steps on the platform are automated: the monthly fee is waived automatically at the follower threshold; an order is marked accepted automatically when the business does not update it within the deadline; posts submitted to campaigns are verified automatically against the connected account; and unusually high view counts are held for review by our staff instead of being rewarded automatically. Every automated outcome can be contested through the complaints system or by writing to us, and a person reviews it.

11. Cookies and similar technologies

We use essential cookies only. We have no advertising cookies, no third-party trackers, and we do not follow your history across the internet.

  • Sign-in cookies (sb-*): keep your session open; without them you cannot access your account. Duration: your session.
  • gv_dev: a random device identifier, used solely to prevent referral fraud (the same person cannot refer themselves). It contains no personal data and is not used for advertising. Duration: 1 year.
  • Your choice on the cookie notice is stored on your device (localStorage), so it does not reappear every time.
  • Since all of them are essential for functioning or security, no separate consent is required; we inform you through the banner and this page.

12. Security

  • All communication is encrypted (HTTPS).
  • Passwords are stored hashed; we never see them. Social-account tokens are stored encrypted (AES-256-GCM).
  • The database is protected with row-level access rules (Row Level Security), with access denied by default; the application reads and writes only through server-side code.
  • Failed sign-in attempts are slowed down with growing delays, and sensitive actions (sign-in, registration, ordering, administration) have request limits.
  • Administrative access is limited to authorised staff, through a separate sign-in with attempt limits.

13. Minors

GETVIRAL accounts may be opened only by persons 18 years or older. The service is not directed at children and we do not knowingly collect their data; if such a case is brought to our attention, we delete the data.

14. Third-party platforms

Our use of information received from TikTok's APIs complies with the TikTok Developer Terms of Service and Developer Policy. Our use of information received from Meta's APIs complies with the Meta Platform Terms and Developer Policies. GETVIRAL is an independent service and is not affiliated with, endorsed or sponsored by TikTok or Meta.

15. Changes to this policy

When we change this policy in a substantial way, we notify you on the platform and by email before it takes effect. The version and the update date always remain at the top of this page. This policy is available in English and Albanian; both versions have the same content.

16. Contact

For any privacy question: support@getvir.al. See also the Terms of Service.

Questions: support@getvir.al

See also: Terms of Service