xvirals.

Data Protection Notice

Last updated: 24 October 2026 · issued under article 10 of Turkish Law no. 6698 (KVKK)

1. Data Controller

Xvirals ("Xvirals", "we") processes your personal data as a data controller within the meaning of Turkish Law no. 6698 on the Protection of Personal Data ("KVKK").

2. Categories of Personal Data Processed

  • Identity: display name.
  • Contact: email address.
  • Transaction security: user identifier (UUID), IP address, session tokens.
  • Usage: generated tweet/quote/reply content, agent configuration, source account lists.
  • Payment: plan information, subscription status, invoice history. Card details are not stored by Xvirals — payments are processed through our Merchant of Record, Dodo Payments.
  • Social account: the X (Twitter) handle you provide for style profiling, and that account's publicly available posts. No X access token is requested or stored.

3. Purposes of Processing

  • Providing the service (content generation, agent draft runs).
  • Managing and securing the user account.
  • Operating payment and subscription processes.
  • Meeting legal obligations (invoicing, tax).
  • Improving service quality (aggregate, anonymous analytics).

4. Legal Bases (KVKK art. 5)

  • Formation/performance of a contract (membership and service provision).
  • Compliance with a legal obligation.
  • Explicit consent (for international data transfers).
  • Legitimate interest (service security, fraud prevention).

5. International Data Transfers

Your data is processed on servers in Frankfurt, Germany (eu-central-1) operated by Supabase Inc. This transfer relies on the explicit consent you give under KVKK article 9 by ticking the international transfer checkbox when creating an account. An account cannot be created without that consent; if you wish to withdraw it, deleting your account ends the transfer.

Data is shared with our Merchant of Record Dodo Payments for payment processing — billing name, email, billing address, payment amount and plan information are transferred in that process.

All subprocessors established abroad and the purpose of each transfer are listed below. All of these transfers rely on the explicit consent you gave when creating your account, under KVKK article 9.

  • Supabase Inc. — database and authentication (Frankfurt, Germany · eu-central-1).
  • Vercel Inc. — hosting (edge network) and cookieless, aggregate page-view analytics (Vercel Web Analytics; no cookies, no cross-site tracking).
  • Resend Inc. (USA) — email delivery: sending the one-time sign-up-open notice to waitlist addresses (not active yet; it starts only after the standard contract is signed).
  • Dodo Payments — payment processing, tax calculation and invoicing (Merchant of Record).
  • OpenRouter Inc. — AI model routing layer. Model providers reached through OpenRouter: DeepSeek, Google, Anthropic, OpenAI, xAI. The text you enter is processed solely to answer your request; it is not used for model training.
  • GetXAPI (primary) and TwitterAPI.io (fallback) — reading publicly available posts on X through official/licensed APIs (for discovery, research and persona extraction).
  • Perplexity (via OpenRouter) — web search in Research mode.

6. Your Rights under KVKK Article 11

As a data subject you have the right to:

  • learn whether your personal data is processed;
  • request information if it has been processed;
  • learn the purpose of processing and whether the data is used in line with that purpose;
  • learn the recipients to whom data is transferred domestically or abroad;
  • request rectification if the data is incomplete or inaccurate;
  • request erasure or destruction within the conditions of KVKK art. 7;
  • object to an outcome against you produced solely by automated analysis;
  • claim compensation if you suffer loss due to unlawful processing.

From your account settings you can download your data as JSON and permanently delete your account. For further requests: info@xvirals.com.

7. Retention

Your personal data is retained for as long as your account is open. When you delete your account, your userprofile, generation history, agent configuration and queue, style profiles and comparisons, subscription/credit records and your identity record (email, password hash) are deleted from the database in the same operation.

Three groups of records are retained after deletion:

  • Payment and invoicing records — retained because of document-retention obligations under the Turkish Tax Procedure Law.
  • Generation quality measurement records — generation variants, edit records, post performance measurements, similarity (embedding) vectors and analytics snapshots. These remain linked to your user identifier (UUID).
  • Trial credit record — not your email address itself, but a one-way hash (SHA-256) of its canonical form and the identifier (UUID) of the first account that received trial credits with it. The purpose is to prevent the free trial credits from being granted to the same mailbox twice (KVKK art. 5/2-f, legitimate interest); it is kept for as long as the trial credit offer exists and deleted when the offer ends.

You may also request deletion of these records under KVKK art. 11 by writing to info@xvirals.com.

8. Security

Your data is transmitted over TLS 1.2+ encrypted connections and stored in Supabase Postgres with disk encryption (AES-256). Access is limited to role-based authorised systems.

9. Waitlist

If you joined the waitlist (it is temporarily closed and not taking new entries), the data below is processed even though you have no account. This processing is separate from the account processes described above.

  • Data processed: your email address and its canonical form (so the same mailbox is not listed twice), your interface language, a short label for where you joined from (e.g. "landing-hero" or "tools/twitter-shadowban-checker"), the path of the first page you visited, the address of the page that referred you (domain and path only; the query string is dropped), the campaign tags in the link (utm_source, utm_medium, utm_campaign), the time of consent and the version of the text you consented to, and a one-way hash of your IP address keyed with a server secret (HMAC-SHA256). The raw IP address is not stored.
  • Purpose: to send you one email when xVirals opens for new accounts; the hashed IP is used only to prevent bulk fake sign-ups to the list; the page label, first page, referring address and campaign tags are used only to measure, in aggregate, which channels bring sign-ups.
  • Legal basis: the explicit consent you give by ticking the box on the form (KVKK art. 5/1). For the hashed IP, legitimate interest (KVKK art. 5/2-f, abuse prevention). For the channel measurement data, legitimate interest (KVKK art. 5/2-f, aggregate measurement of promotion channels).
  • International transfer: the data is stored on Supabase Inc. servers in Frankfurt, Germany (eu-central-1). This transfer relies on your explicit consent (KVKK art. 9), stated in the same checkbox.
  • Email delivery: the sign-up-open notice will be sent through Resend Inc., based in the USA, so only your email address is transferred to the USA. This transfer relies on a standard contract signed with Resend under KVKK art. 9/4; the explicit consent you give in the same checkbox is an additional safeguard. This sending does not start until the standard contract is signed and notified to the Board.
  • Retention: the list is deleted no later than 30 days after the email announcing that sign-ups are open has been sent. If you withdraw your consent, your address is removed from the list.
  • Withdrawing consent: write to info@xvirals.com. Your rights in section 6 apply to this data as well.

10. Referral Program

If you join the Referral Program, the following data is processed in addition to the data listed above for your account. Because cash payouts are not open yet, no payout method details or tax/identity documents are collected; this data is collected only after cash payouts open and only if you request a payout, and this notice will be updated accordingly before then.

  • Data categories processed now: contact (email), referral and reward records (referral code, number of accounts you referred, number of paying referrals, tier, reward amounts and statuses), transaction security (acceptance records for the Terms: version, time, rate/tier table at acceptance, browser information and a one-way hash of your IP address keyed with a server secret) and abuse-prevention signals (matches with accounts you referred, such as the same email alias or the same private domain).
  • Additional data processed once cash payouts open and you request a payout: identity (name, the name on your payout account, identity verification/KYC documents), financial (IBAN, PayPal email, Wise account details, payout records) and tax (tax identification number, invoice/receipt details).
  • Purposes: calculating, recording and (once payouts open) paying referral rewards; meeting tax and accounting obligations; proving acceptance of the Terms; preventing fake/collusive referrals and payment abuse (analysis of suspicion signals and suspension/review decisions based on them); protecting rights in disputes.
  • Legal bases: formation and performance of the relationship established by accepting the Program Terms (KVKK art. 5/2-c) — reward calculation and payouts; legal obligation (KVKK art. 5/2-ç) — tax and record retention; establishing, exercising or defending a right (KVKK art. 5/2-e) — acceptance and transaction records; legitimate interest (KVKK art. 5/2-f) — abuse prevention and suspicion-signal analysis. Suspicion signals alone never produce an automated decision; suspension and removal decisions are made by human review.
  • Recipients: the data is stored on Supabase servers (Frankfurt, Germany). Once cash payouts open, depending on the payout method you choose, PayPal, Wise and intermediary/correspondent banks; where legally required, competent public authorities and our accountant.
  • International transfers: the transfer to Supabase relies on the explicit consent described in section 5. Once cash payouts open: PayPal and Wise are established abroad; your payout details are transferred to them to the extent necessary to make the payment. This transfer relies, under KVKK art. 9, on an occasional transfer necessary for the performance of the relationship (art. 9/6-b) and, where available, standard contractual safeguards.
  • Retention: reward, payout, invoice/receipt and tax records are kept for 10 years from the start of the year following the relevant year under article 253 of the Tax Procedure Law and article 82 of the Turkish Commercial Code; acceptance records for the duration of participation and 10 years after it ends (general limitation period under the Code of Obligations); KYC documents and suspicion-signal records for at most 10 years after participation ends; payout account details (IBAN/PayPal/Wise) are deleted no later than 1 year after payout obligations end. Deleting your account does not shorten these statutory retention periods.
  • Your rights: your KVKK article 11 rights in section 6 apply to this data as well; write to info@xvirals.com.