Privacy Policy — Viral Video Tool

Version 1.0 · Effective October 22, 2026

1. Operator and privacy contact

Viral Video Tool, a sole-proprietor business operating in the United States, is responsible for the personal information it processes through viralvideotool.com. For privacy requests, account deletion, security reports or questions, email [email protected]. This policy accompanies our Terms of Service.

2. Information processed

• Account and access information: account name, email, profile information you provide, password hashes when password login is used, sessions and authentication records. If you choose an offered external sign-in method, we receive the account identifiers and profile details you authorize it to share.
• Creative inputs and results: photos, audio, selected roles, template and generation settings, generated videos, file properties and processing status. Photos can include faces and other personal characteristics needed for the requested transformation; we do not operate an identity-verification service or a face-recognition database.
• Orders and credits: purchased product, amount, currency, provider transaction references, payment and refund status, credit grants and consumption, and generation charges. Full card numbers and card security codes are not stored on our servers.
• Support and safety records: messages, tickets, rights reports, billing disputes and related investigation records.
• Technical and activity information: IP address, browser or user-agent information, request times, errors, session security information, template views and other recorded product actions. Infrastructure providers may receive network and device details when serving the website.

Do not include passwords, payment-card data or unrelated sensitive information in uploaded media or support messages. You are responsible for obtaining permission when submitting another person's information.

3. How and why we use information

We process information to authenticate accounts, deliver requested generations, manage credits, confirm payments, investigate errors, answer support requests and protect the service against fraud or misuse. We also keep records required for accounting, dispute resolution and legal obligations.

Where a legal basis is required, these activities rely on performing our contract with you, compliance with legal obligations, or legitimate interests in operating and securing the service, subject to your applicable rights. Processing that legally requires consent will rely on that consent. We do not sell personal information or share it for cross-context behavioral advertising. We do not use your inputs to train our own AI models.

4. Local previews and AI processing

Selecting a photo in an unavailable template's local-preview tool keeps that preview in your browser; that selection alone does not upload the file to our servers. An available generation tool uploads the selected media for processing. Submitting a generation sends the necessary inputs and settings to the provider selected for that template, including Fal where used. Required input access links can be made available to that provider for processing.

Our own application uses private media storage and access-controlled, short-lived links for user files. Results are not automatically public or posted to social networks. Third-party AI providers may retain processing copies under their own applicable terms; deleting a file here does not by itself erase every provider copy. Contact us for help with a provider-related deletion request. External reference or embedded videos are supplied by their respective platforms and may transmit browser and network information to them when loaded.

5. Payment and other service providers

When checkout is available, Waffo Pancake processes checkout and payment-card information on its payment interface. We receive transaction information needed to fulfill the purchase, manage credits, handle refunds and reconcile disputes. The payment provider may keep information for its own regulatory, fraud-prevention and payment obligations. Do not send card information to our support email.

We also use providers for hosting, databases, private file storage, transactional email and AI processing. Information is disclosed only as necessary for the relevant service. We may disclose records when legally required, to investigate fraud or rights claims, or in a business transfer subject to continued privacy obligations. Another disclosure for a different purpose requires an appropriate legal basis.

6. Cookies, analytics and messages

Session cookies help maintain login and secure account access. Functional cookies or browser settings remember choices such as language and appearance. Blocking necessary cookies can prevent login; you can manage cookies through your browser.

At this policy's publication, Google Analytics and Plausible are not enabled on this site, and we do not use advertising-tracking cookies. If we introduce optional tracking, we will update this policy and obtain any consent required before activating it. Product activity records described above support operations and security; they are distinct from a third-party advertising profile.

Account verification, password recovery, receipts, security alerts and support replies are service messages. We do not currently operate a marketing mailing list. If marketing is introduced, optional messages will provide an unsubscribe method and follow applicable consent requirements.

7. Retention and deletion

| Information | Normal retention rule | | ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Uploaded media not linked to a generation | Expires 24 hours after registration | | Inputs linked to a generation | Expires 7 days after association with the task | | Generated video and result media | Expires 30 days after registration of the result | | Account profile and authentication information | While the account is active; deleted or anonymized within 30 days after a verified closure request, except records retained under the rules below | | Payment, refund and necessary accounting records | Up to 7 years after the transaction, unless a different period is legally required | | Support correspondence | Up to 2 years after the issue is closed | | Routine security and access logs | Up to 90 days; evidence linked to a specific incident follows the investigation's necessary retention period |

Media expiry removes normal availability; physical removal is performed by the cleanup worker and may occur later if processing is active, a provider submission needs review or cleanup is temporarily unavailable. Account and business-record deletion requests are handled through support; those retention periods do not imply an automatic deletion feature in account settings. Legal holds, unresolved disputes and mandatory records may require longer retention of the relevant information. Restricted backup copies, if any, are removed through the backup lifecycle; they are not kept available for ordinary account use.

Download results you need before expiry. Local previews end when removed from the page or the page is closed. If you request deletion while a generation is running, we may need to complete or resolve that task before deleting its required inputs.

8. Your choices and rights

Depending on applicable law, you may request access, correction, a copy of your data, deletion, restriction or an objection to processing, and withdraw consent for consent-based processing. Email support using your registered email where possible. We may ask for proportionate identity verification to protect your account; do not email identity documents unless we first explain why they are needed and offer an appropriate submission method.

We aim to respond within 30 calendar days, or the period required by applicable law, and explain any lawful extension or refusal. We do not discriminate against you for exercising applicable privacy rights. You may also complain to the competent privacy regulator. These rights can be limited where records are needed for a legal obligation, an unresolved transaction or a legal claim.

9. International processing and security

The operator is in the United States, and service infrastructure or providers may process information in other countries. Protections and government-access rules can differ from those where you live. Where a transfer is restricted by applicable law, an appropriate lawful transfer mechanism is required. Contact support for information about the providers and arrangements relevant to your request; we do not represent that every provider holds a particular certification or transfer agreement.

We use HTTPS, account authorization, private media access and hashed password storage to reduce risk. No internet service guarantees absolute security. If a personal-data incident requires notification, we will notify affected people and competent authorities within applicable legal deadlines and explain available protective steps.

10. Age limits and policy changes

Accounts and purchases are intended for people aged 18 or older. We do not knowingly allow children to register. A parent or guardian who believes a child has submitted account information can contact support for review and deletion. Adult users submitting media of another person must have the necessary consent and comply with the Terms of Service.

We will publish changes here and update the date. Material changes will normally be announced at least 14 days in advance through the site or account email; urgent legal or security requirements may call for earlier changes. Where law requires consent for a new use, a policy update alone does not replace it.

Privacy and support: [email protected]

Operator: Viral Video Tool · Sole proprietor · United States