Privacy Policy

1. Who Is Responsible For Your Information

VYRAL is operated by Ratio Labs, Inc., a Delaware corporation ("VYRAL," "we," "us," or "our"), with a mailing address at 169 Madison Ave., Suite 94369, New York, NY 10016, United States. Ratio Labs, Inc. is the controller of personal information described in this Policy unless a separate notice says otherwise.

This Policy applies to the VYRAL mobile app, websites, campaign and creator services, support, and related services (the "Service").

2. Information We Collect

Account and profile information

We receive identifiers and account information when you sign in, including your Apple user identifier and, when Apple makes them available, your name and email address. We also process your display name, username, profile color or image, country, account status, creator metrics, campaign membership, and account creation and update times.

Country and device information

We may receive your Apple App Store storefront country and related country-source information to show eligible campaigns. We process device and technical information needed to operate and secure the Service, such as app version, operating system, request and error data, hashed network identifiers used for rate limiting, and push notification tokens. We do not use precise device location for campaign eligibility.

Social account and public content information

When you connect a TikTok identity or submit a TikTok URL, we collect the username and account details you provide and retrieve information from publicly accessible sources. This may include profile name, avatar, profile URL, biography and verification information, content URL and identifier, caption, cover image, publication date, account ownership signals, availability, views, likes, comments, shares, and other public metadata. We may retain the source response and periodic metric snapshots to verify campaign performance and investigate disputes or manipulation.

Campaign, submission, and communication information

We process campaign applications, participation and ban status, content-format selections, submitted links and media, submission and review status, optional rejection reasons, tracked metrics, estimated and approved amounts, quality and integrity indicators, support requests, campaign chat messages, and chat attachments.

Payout and financial information

To set up and administer payouts, we may process your legal or account holder name, country, currency, provider account identifier, email, verification status, masked account label, payout preference, and payment status. For bank transfer, this may include bank name, IBAN, BIC/SWIFT, routing number, account number, account type, and billing or account-holder address. Full bank details are stored encrypted and are available only to authorized personnel when needed to administer or investigate a payout.

We do not receive your Apple password, PayPal password, online banking password, PayPal balance, or full payment-card number. Payment providers process credentials and other information under their own privacy policies.

On-device onboarding answers

Answers to onboarding questions about gender, age range, discovery source, social accounts, posting goals, earnings goals, and available time are currently stored on your device and are not sent to VYRAL's servers. This Policy will be updated before we begin collecting those answers server-side.

3. How We Use Information And Our Legal Bases

We process personal information to:

• create, authenticate, maintain, and secure creator accounts;
• determine country and campaign eligibility and administer applications and participation;
• connect social identities, retrieve public content, and verify account or content ownership;
• review submissions and track public content performance;
• calculate estimated and eligible earnings, administer payout cycles, and reconcile or retry payments;
• detect artificial engagement, duplicate activity, abuse, security incidents, and campaign-rule violations;
• operate chat, support, push notifications, audit records, and product troubleshooting;
• comply with tax, accounting, payment, court, regulatory, and other legal obligations; and
• establish, exercise, or defend legal claims and resolve campaign or payout disputes.

Where European data-protection law applies, we rely on the legal basis appropriate to each use: performance of our contract with you; compliance with legal obligations; your consent where requested, including device permission for push notifications; and our or a third party's legitimate interests in operating, securing, improving, and protecting the Service, administering campaigns, preventing fraud, and resolving disputes. Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations.

4. Review And Integrity Indicators

We may generate integrity signals, including a bot or manipulation risk score, from public engagement patterns, account information, submission history, and technical or provider data. These indicators help authorized reviewers identify submissions that may need closer review. A bot score currently does not by itself automatically reject a submission or withhold a payout.

Some technical checks may automatically identify late submissions, invalid or unsupported links, unavailable content, duplicate records, or failed data retrieval. Decisions with significant payment or account effects are reviewed by authorized personnel where required by applicable law. You can contact us to request information or human review where you have that right.

5. How We Disclose Information

We may disclose information to:

• Campaign sponsors and authorized administrators who need creator, submission, public social, performance, review, and payout-status information to operate or assess a campaign;
• Infrastructure and operations providers, such as Supabase for database, authentication, storage, and server functions, and Vercel for web hosting and request processing;
• Social-data and content providers, including TikTok public pages and Apify or similar tools used to retrieve public account, content, and metric information;
• Apple for Sign in with Apple, App Store storefront information, app distribution, and push notifications;
• Payout providers and banks, such as PayPal, Airwallex, Revolut, and banking partners, depending on the payout method and country you select;
• Professional advisers and authorities where needed for accounting, legal advice, audits, compliance, safety, fraud prevention, or a valid legal request; and
• A successor or transaction participant in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate safeguards.

We do not sell personal information for money. We do not use personal information for cross-context behavioral advertising or share it for that purpose.

6. Public And Private Information

Content you post on TikTok remains public or available according to your TikTok settings. VYRAL may store public submission previews, cover images, campaign media, and content-format examples using publicly accessible storage so they can be displayed in the Service. Campaign chat attachments are stored using access-controlled links. Do not include sensitive information in public content, submissions, chat, or support messages unless it is necessary.

7. International Data Transfers

Ratio Labs, Inc. is based in the United States, and our providers and campaign operations may process information in the United States and other countries that may have different data-protection laws from your country. Where applicable law requires a transfer mechanism, we use an available lawful mechanism, such as an adequacy decision, approved contractual safeguards, or a permitted exception. You may contact us for more information about safeguards relevant to your information.

8. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including for the duration of your account and campaigns and afterward as needed to complete payouts, maintain accounting or tax records, document campaign and review decisions, prevent repeat fraud or abuse, resolve disputes, enforce agreements, and comply with law.

Retention depends on the type of record, campaign and payout status, legal limitation periods, provider requirements, sensitivity, and security need. Financial, contract, and audit records may be retained for legally required accounting and recordkeeping periods. Security and fraud records may be retained for a reasonable period needed to prevent repeat abuse. Push tokens are disabled or removed when no longer needed. We delete or anonymize information when the relevant purposes no longer apply, unless law permits or requires further retention.

9. Account Deletion

You can request account deletion in VYRAL settings. We delete or anonymize profile, linked-account, payout-connection, banking, and notification information that no longer needs to be associated with you. Full encrypted bank details are deleted and public social source payloads linked to the account are cleared or anonymized as part of the deletion process.

We may retain limited submission, campaign, payout, audit, security, and dispute records where necessary for accounting, fraud prevention, legal compliance, or the rights of VYRAL, campaign sponsors, or other users. A deletion request does not delete content or data held independently by TikTok, Apple, a payout provider, a bank, or another third party.

10. Your Privacy Rights

Depending on where you live and subject to legal exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; restrict or object to processing; withdraw consent for future processing; and request human review of certain automated decisions. Withdrawing consent does not affect processing that already occurred or processing based on another lawful basis.

You may exercise a request by emailing support@tendar.dev. We may need to verify your identity and request before responding. You may use an authorized agent where local law permits. We will not discriminate against you for exercising a privacy right.

If European data-protection law applies, you may also lodge a complaint with the data-protection authority where you live, work, or believe a violation occurred. We encourage you to contact us first so we can try to address the concern.

11. Security

We use technical and organizational safeguards designed to protect information, including access controls, encrypted transport, encryption of full manual bank details, masked payment displays, private access controls for chat attachments, rate limiting, audit records, and restricted administrative access. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

12. Children

VYRAL's creator and payout services are not intended for anyone under 18, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

13. Changes To This Policy

We may update this Policy as the Service, providers, or legal requirements change. We will post the updated date and provide additional notice where required. If a change materially affects how we use information already collected, we will take any additional steps required by applicable law.

14. Contact

For privacy questions or requests, email support@tendar.dev or write to Ratio Labs, Inc., 169 Madison Ave., Suite 94369, New York, NY 10016, United States.