Privacy
Privacy policy
ViralPayouts keeps what it needs to credit sales and pay partners: account details, clicks, sales and payouts. Network addresses and buyers' emails are kept only as hashes, tax numbers are encrypted, our own analytics use no cookie, and the only third-party tracking script loads only if you allow it.
Last updated:
1. Who we are
ViralPayouts is run by Software Automated Ltd, a company registered in England and Wales (company number 17024080, registered office 20 Wenlock Road, London, N1 7GU, England). For the personal data described here we are the controller, with one exception: the details of a brand's customers that the brand sends us with its sales, and the clicks on its partners' links, we process for that brand under our data processing agreement. Contact us about anything in this policy at max@viralpayouts.com.
When a brand runs a program on ViralPayouts, the brand also receives details of its partners and their sales (section 5). The brand decides how it uses those details and is responsible for that use.
2. What we keep
| Who | What we keep |
|---|---|
| Brand users | Name, work email, a scrypt hash of your password (never the password), your two-step sign-in secret (encrypted) and recovery codes (stored only as hashes), your team role, and a log of actions taken in the console. |
| Partners | Name, email, country, your public handle, your answers when you apply to a program (how you promote, your reach, a link and a note), when you accepted each program's terms and a hash of the address you accepted from, your clicks, sales, earnings, payouts, messages with brands, and any postback URL you set. |
| Partners who are paid | The id of your Whop payout account and whether it can receive payouts. Whop, not ViralPayouts, checks your identity and holds your bank details. |
| Partners who file a tax form | Form type (W-9, W-8BEN or W-8BEN-E), legal name, business name and tax classification (W-9 only), country, address, your typed signature, and a hash of the address you filed from. Your tax number is encrypted with AES-256-GCM; we also keep its last 4 characters to show you which number is on file. |
| Brands' customers (buyers) | When a brand reports a sale, it may send the buyer's email. We use it once to check the buyer is not the partner, then keep only a keyed hash of it and a masked form such as a***@example.com. We also keep the order id, amount, currency, product and date. Partners are never told who bought. |
| People who follow a partner link | A keyed hash of your network address (we do not keep the address), your browser's user agent, the page you came from, your country (from our host's headers), the landing page, the partner's sub IDs, and any campaign tags in the link (utm_*, gclid, fbclid, ttclid, msclkid). |
| Visitors to our own site | Pages viewed (paths only, never query strings), the text of links and buttons clicked (with emails and long numbers removed), time on page and how far you scrolled, device type, and approximate location from our host's headers (country, region, city, and a point rounded to about 11 km). You are counted with a keyed hash of your hashed address and user agent, not a cookie. |
| People who ask about custom rates | Name, email, company, website, monthly payouts, the tool you use now and your message. |
| Everyone we email | A copy of each email we send, and whether you turned optional emails off. |
We do not ask for or keep payment card numbers or bank account numbers.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK and EU GDPR) |
|---|---|
| Running brand and partner accounts, crediting sales, invoicing brands and paying partners | Contract |
| Keeping tax forms and accounting records, and producing the 1099-NEC file a US brand must file | Legal obligation |
| Tracking which partner referred a sale (clicks and the attribution cookies) | Legitimate interests: paying partners correctly, which partners and brands ask us to do |
| Spotting fraud, self-referral and abuse; rate limits; security logs | Legitimate interests: protecting brands, partners and the service |
| Our own first-party analytics and A/B tests | Legitimate interests: improving the site. No cookie, nothing sent to anyone else |
| Ad measurement with the Whop Pixel | Consent. It only loads if you choose Allow |
| Service emails (sign-in links, sales, payouts, terms changes) | Contract |
| Optional emails (summaries and reminders) | Legitimate interests. Every one has an unsubscribe link |
6. International transfers
Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK or the EEA we rely on the safeguards the law provides, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses. Ask us at max@viralpayouts.com for details of the safeguard for a given provider.
7. How long we keep it
| Data | Kept for |
|---|---|
| Our own site analytics | 400 days, then deleted automatically |
| Hashed addresses a console or portal was used from (fraud checks) | 90 days after last seen |
| Copies of emails we sent | 90 days |
| One-time sign-in links | Deleted a day after they expire |
| Finished background jobs and error counters | 30 and 30 days |
| Your account, applications and messages | Until you delete your account |
| Clicks on partner links | No automatic deletion yet. They hold no address, only a keyed hash |
| Sales, the ledger, payouts, invoices and tax forms | As long as tax and accounting law requires, even after an account is deleted, without your contact details |
| Custom-rate enquiries | Until you ask us to delete them |
8. Your rights
Under UK and EU GDPR you can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, to move it to another service, and to withdraw consent at any time.
- Partners can download everything we hold about them, and delete their account, from the privacy card in the partner portal. Deleting removes your name, email, country, application, postback URL, sessions and messages at once. It is refused while money is still owed to you, so you never lose earnings by accident: you are told how much and by whom.
- Brand users and anyone else: email max@viralpayouts.com from the address on your account. We answer within one month.
You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority. We would like the chance to fix it first.
9. California residents (CCPA)
In the last 12 months we collected these categories of personal information, for the purposes in section 3: identifiers (name, email, handle, hashed network address), commercial information (sales, commissions, payouts), internet activity (pages viewed, link clicks), approximate geolocation, and, for partners who file a tax form, a tax identification number, which we use only for tax reporting.
We do not sell personal information. The Whop Pixel, which could count as “sharing” for advertising, only loads if you choose Allow. You have the right to know, delete and correct your personal information, to opt out of sale or sharing, and not to be treated differently for using these rights. Email max@viralpayouts.com to use them.
10. How we protect it
- Network addresses and buyers' emails are kept only as keyed hashes. Tax numbers are encrypted. Passwords are hashed with scrypt.
- Sessions are signed and kept in httpOnly cookies, sent only over HTTPS on the live site. Brand users can turn on two-step sign-in.
- Webhooks and events are only accepted with a valid signature. Sign-in, events and links are rate limited.
- Only a brand's owners can download tax files, and each download is logged.
11. Children
ViralPayouts is not for anyone under 18. Partners must be at least 18 to join a program.
12. Changes to this policy
We will update this page when what we keep or who we share it with changes, and change the date at the top. See also the terms of service and program terms.