Privacy Policy

1. Who we are

ViralCart AI ("we", "us") provides a multi-tenant software platform that helps TikTok Shop sellers manage products, content, creators, orders, inventory, and profitability. This policy explains what personal data we process, why, and the rights you have over it. It applies to viralcartai.com and every subdomain and application we operate.

2. Data we collect

We collect only the data needed to operate the service:

• Account data: name, email address, password hash, locale, and time zone.
• Workspace data: organization details, team membership, and roles you configure.
• Connected-platform data: products, orders, creator collaborations, and financial records imported from TikTok Shop or other commerce platforms you explicitly authorize.
• Billing data: subscription tier and PayPal subscription identifiers. We never see or store your full payment credentials — payment is processed by PayPal.
• Usage data: feature interactions, device and browser information, and diagnostic logs.

3. How we use data

We use your data to provide and secure the service, synchronize your connected shops, generate AI-assisted recommendations you request, send operational notifications you have enabled, enforce plan entitlements, and comply with legal obligations. We do not sell personal data and we do not use your shop data to train foundation models.

4. AI processing

When you use AI features, relevant context (for example, a product listing you ask us to improve) is sent to the AI provider configured for your workspace (such as Anthropic, OpenAI, or Google). Providers process this data under their API data-processing terms. Sensitive agent actions always require human approval and are recorded in your workspace audit log.

5. Legal bases

Where the GDPR or similar laws apply, we process data to perform our contract with you, to pursue legitimate interests such as security and fraud prevention, with your consent where required (for example, marketing emails), and to comply with law.

6. Sharing

We share data only with:

• Sub-processors that host and operate the platform (cloud hosting, database, email delivery, error monitoring).
• Platforms you connect, such as TikTok Shop, strictly to execute the actions you request.
• PayPal, for subscription billing.
• Authorities where required by law.

7. Security

All data is encrypted in transit. Provider tokens are encrypted at rest with AES-256-GCM. Tenant data is isolated with organization-scoped access controls and PostgreSQL Row-Level Security. Privileged operations are audit-logged.

8. Retention and deletion

We retain workspace data while your account is active. You can request export or deletion of your organization's data at any time; deletion is completed within 30 days except where law requires longer retention (for example, billing records).

9. Your rights

Depending on your jurisdiction you may have rights to access, correct, export, restrict, object to, or delete your personal data, and to lodge a complaint with a supervisory authority. Contact us at privacy@viralcartai.com to exercise any right.

10. Changes

We will notify you of material changes to this policy by email or in-app notice before they take effect.