xvirals.

Privacy Policy

Last updated: 24 October 2026 · KVKK + GDPR compliant

1. Scope

This policy explains how personal data collected by Xvirals ("we") through xvirals.com and all related services is processed, protected and shared.

2. Data We Collect

2.1. Data you provide directly

  • When creating an account: email, display name, password (hashed).
  • For style profiling: your X (Twitter) handle — there is no account connection, authorisation or access token.
  • When generating content: topic, persona selection, source accounts.
  • From people who joined the waitlist (it is temporarily closed): email address, interface language, the label of where you joined from, first page, referring address (domain and path only), campaign tags (utm_*), time of consent and a one-way hash of your IP address. Details: Data Protection Notice, section 9.
  • When paying: billing name and billing address (transmitted to our Merchant of Record, Dodo Payments).

2.2. Data collected automatically

  • IP address, session duration, browser used.
  • Service usage metrics (number of generations, number of agent runs).
  • Error logs (anonymous, no email included).

3. How We Use Data

  • To provide your account and operate the service.
  • To manage plan limits and billing.
  • For security, fraud detection and meeting legal obligations.
  • For communication (important updates, invoices, support).

4. Sharing with Third Parties (Subprocessors)

  • Supabase Inc. — database and authentication (Frankfurt, Germany · eu-central-1).
  • Vercel Inc. — hosting (edge network) and cookieless, aggregate page-view analytics (Vercel Web Analytics; no cookies, no cross-site tracking).
  • Resend Inc. (USA) — email delivery: sending the one-time sign-up-open notice to waitlist addresses (not active yet; it starts only after the standard contract is signed).
  • Dodo Payments — payment processing, tax calculation and invoicing (Merchant of Record).
  • OpenRouter Inc. — AI model routing layer. Model providers reached through OpenRouter: DeepSeek, Google, Anthropic, OpenAI, xAI. The text you enter is processed solely to answer your request; it is not used for model training.
  • GetXAPI (primary) and TwitterAPI.io (fallback) — reading publicly available posts on X through official/licensed APIs (for discovery, research and persona extraction).
  • Perplexity (via OpenRouter) — web search in Research mode.
  • Public authorities — only under a court order or within the scope of KVKK art. 5/2(a).

We do not sell your personal data to third parties for marketing purposes.

5. Data Location and International Transfers

Our primary database is located in Frankfurt, Germany (Supabase eu-central-1). You approve this transfer via the explicit consent checkbox you actively tick when creating an account; the legal basis for the transfer is that explicit consent under KVKK art. 9.

Waitlist: waitlist entries are also stored in Frankfurt; the basis is the consent checkbox on the waitlist form, not the account checkbox. The sign-up-open notice will be sent through Resend Inc., based in the USA, so only the email address is transferred to the USA. This transfer relies on a standard contract under KVKK art. 9/4, with the consent on the form as an additional safeguard; sending does not start until the contract is signed and notified to the Board. Details: Data Protection Notice, section 9.

6. Cookies

See the Cookie Policy for details of our cookie use. Essential cookies are required for the service to work; we do not use analytics cookies.

7. Retention and Deletion

We retain your data for as long as your account is active. When you delete your account:

  • Deleted in the same operation: user profile, generation history, agent configuration andqueue, source lists and run records, style profiles, comparisons, gamification records (XP, quests, referrals), subscription, credit and usage records, and your identity record (email, password hash).
  • Retained — payment and invoicing records: kept because of document-retention obligations under the Turkish Tax Procedure Law.
  • Retained — generation quality measurement records: generation variants, edit records, post performance measurements, similarity (embedding) vectors and analytics snapshots. These records remain linked to your user identifier (UUID).
  • Retained — referral program records: referral reward records and acceptance records for the Program Terms and — once cash payouts open — payout, invoice and tax records are kept for the statutory retention periods. Because cash payouts are not open yet, no payout method details (IBAN, PayPal/Wise) or tax/identity documents are collected. Which data is processed, for what purposes and on what legal bases, and to whom and to which countries it is transferred, is explained in the "Referral Program" section of the Data Protection Notice.
  • Retained — trial credit record: not your email address itself, but a one-way hash (SHA-256) of its canonical form and the identifier (UUID) of the first account that received trial credits with it. The purpose is to prevent the free trial credits from being granted to the same mailbox twice; it is kept for as long as the trial credit offer exists and deleted when the offer ends.

You can request deletion of these remaining records too by writing to info@xvirals.com.

8. Your Rights

  • Access: download your data as JSON from your account settings.
  • Rectification: correct inaccurate information in your profile settings.
  • Erasure (right to be forgotten): permanent deletion from your account settings.
  • Portability: take the JSON export to another service.
  • Objection: for objections to the grounds of processing, write to info@xvirals.com.

9. Children

Xvirals is not a service directed at people under 18. We do not knowingly collect personal data from anyone under 18.

10. Changes

This policy may be updated. Material changes are notified to the email linked to your account.

11. Contact

For questions and requests: info@xvirals.com. All contact channels and business details: Contact & Business Details.