This is a translation. Only the German version is legally binding.

German version

Viral Post Studio
Security

Trust Center

Security, privacy and documents from Viral Post Studio for procurement, data protection and IT

Last updated: 5 October 2026

Draft, not yet reviewed by a lawyer

This page and the templates under “Documents” are drafts. We are still clarifying details marked “to be confirmed” with our providers; they will appear here as soon as we have them in writing.

In short

  • Only your account can see your data: access rules in the database, two-factor sign-in and an activity log of all changes.
  • Images, PDFs, your logo and your profile picture are not stored publicly. The server only creates links to them for you, and they are valid for one hour.
  • We do not train AI models with your content, and we label AI content.
  • In the event of an incident, we inform affected business customers within 24 hours.
  • You can export your data and delete your account yourself at any time under “Settings → Account”.

1. Data location and hosting

The app runs on our hosting provider Lovable (“Lovable Cloud”, technically based on Supabase); the server functions are run by Cloudflare. We will confirm the regions here as soon as we have them in writing.

Database, sign-in and files (Lovable Cloud)
to be confirmed
Running the app (Cloudflare)
to be confirmed
AI models (via Lovable)
to be confirmed
Error reports (Sentry)
EU (Frankfurt, Germany) to be confirmed

2. Encryption

In transit
always encrypted (HTTPS with TLS)
Stored data at the hosting provider
to be confirmed
Access keys for channels and knowledge sources
additionally encrypted with AES-GCM, readable only by our server
Passwords
stored only as a hash, never in plain text

3. Access control and private files

  • Access rules in the database: Every query only sees the data of its own account (row level security). The database checks this itself, not just the user interface.
  • Two-factor sign-in: With an authenticator app, for every account. Once it is set up, the server also requires the second factor. You can end sessions on other devices yourself under “Settings → Security”.
  • Activity log: Who changed what and when, without post texts or access keys, kept for 365 days and downloadable as a CSV file.
  • Private files: Post images, carousel PDFs, logo and profile picture are kept in non-public storage areas. The server only creates links to them for your account, and they expire after one hour. When publishing, the platform receives a fresh link or the file itself.
  • Third-party access keys (LinkedIn, Telegram, knowledge sources) are stored in encrypted form. They never reach your browser.
  • Teams: Workspaces with roles and approvals are coming; until then, each account belongs to exactly one person.

4. Backups and recovery

Our hosting provider backs up the database. We will confirm the scope, location and target values for data loss (RPO) and recovery time (RTO) here as soon as we have them in writing and a restore has been tested.

Database backup
daily to be confirmed
Retention and location of backups
to be confirmed
Maximum data loss (RPO)
to be confirmed
Recovery time (RTO)
to be confirmed
Tested restore
to be confirmed

5. Monitoring, incidents and availability

Error monitoring
Sentry in the EU, without content, email or IP addresses to be confirmed
Availability and scheduling
Better Stack checks every minute and alerts the on-call team to be confirmed
Status page
status.viral-post.ai to be confirmed
Contractual availability (SLA)
no commitment yet
Incident notification to business customers
within 24 hours of becoming aware, detailed report within 72 hours

An operations manual governs alerts, on-call duty and customer notification. In the event of a data security breach that is likely to result in a high risk, we also report it as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC) under Art. 24 of the Swiss Federal Act on Data Protection (FADP). For customers in the EU, we, as processor, notify the controller without undue delay (Art. 33(2) of the EU General Data Protection Regulation, GDPR).

6. Sub-processors and recipients

This list is the same as in the privacy policy. We announce new sub-processors to business customers in advance; they can object.

Processors

  • Lovable

    Operation of the app: hosting, database, sign-in, file storage and sign-in emails (“Lovable Cloud”), as well as access to the AI models and to Stripe.

    Data
    All data in your account: sign-in, posts, images and PDFs, brand design, channels, activity log
    When
    always
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    Provider’s DPA (opens in a new tab) to be confirmed

  • SMTP2GO (email delivery)

    The app’s emails: sign-in and account, security, subscription, notices, tips, invitations and newsletter.

    Data
    Email address, name, language and the content of the email in question (e.g. confirmation link, plan, title of a post or name of the workspace)
    When
    with every email from the app, once delivery via SMTP2GO has been set up
    Location
    EU (data centre eu-api.smtp2go.com), company headquartered in New Zealand to be confirmed
    Legal basis
    Adequacy decision for New Zealand (EU and Switzerland) to be confirmed
    DPA
    to be confirmed

  • Amazon SES (email delivery)

    The app’s emails, if set up instead of SMTP2GO.

    Data
    Email address, name, language and the content of the email in question
    When
    with every email from the app, only if delivery via Amazon SES has been set up
    Location
    Switzerland (Zurich region, eu-central-2) to be confirmed
    Legal basis
    to be confirmed
    DPA
    to be confirmed

  • Perplexity

    Research into current topics (Pulse).

    Data
    Search queries based on your topics and your region, no account data
    When
    during research in Pulse
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    to be confirmed

  • Stripe

    Payment processing for subscriptions and balance top-ups.

    Data
    Email address, customer number, subscription and payments. You enter card details directly with Stripe; we do not receive them
    When
    when you take out a subscription or top up your balance
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    to be confirmed

  • Sentry

    Error reports for unexpected errors, so that we can fix disruptions quickly.

    Data
    Type and location of the error, page without parameters, browser type, time and a pseudonymous identifier; no content, email or IP addresses
    When
    only for unexpected errors
    Location
    EU (Frankfurt, Germany) to be confirmed
    Legal basis
    to be confirmed
    DPA
    to be confirmed

  • Better Stack

    Availability monitoring, scheduler heartbeat and status page.

    Data
    No data about you: Better Stack only calls our public addresses
    When
    continuously
    Location
    EU to be confirmed
    Legal basis
    not required (no personal data)
    DPA
    to be confirmed

  • Outstand

    Publishing on Instagram, Facebook, Threads, TikTok, Pinterest, Bluesky, X, YouTube, Google Business, Reddit, Vimeo, LinkedIn pages and the LinkedIn profile with statistics; metrics for the statistics; comments and Instagram messages in the inbox; sharing again and deleting on the platform; importing older posts.

    Data
    Account or page name, profile picture and account ID; text, images and videos or PDF of the posts, plus first comment, further thread parts and channel options (e.g. tagged people or collaborators) (at most 60 days there); metrics of your posts and accounts (for the LinkedIn profile, reactions, comments, reposts, impressions and reach of the posts plus the number of your followers and connections); in the inbox, comments, direct messages and your replies (90 days with us); when sharing again, your comment; when importing, older posts of your accounts with text, date, link and metrics (there until you disconnect the account)
    When
    only if you connect one of these channels or your LinkedIn profile with statistics
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    Provider’s DPA (opens in a new tab) to be confirmed

  • Cloudflare (template export and R2 file storage)

    Creates the PDF or image when you export a template (Browser Run) and stores uploaded images and videos, template exports and data exports (R2, storage location EU).

    Data
    When you export a template, your texts and figures and your corporate design (colours, font, account name, tagline, website, logo and profile picture); in storage, the images and videos you attach to posts, the finished template exports and your data exports
    When
    with every export in the template studio; once storage at Cloudflare is set up, also when you upload images and videos and with every data export
    Location
    Storage (R2): EU (bucket with EU jurisdiction); Browser Run: Cloudflare network, not bound to the EU; company based in the USA to be confirmed
    Legal basis
    Data Privacy Framework or standard contractual clauses in Cloudflare's data processing agreement (DPA) to be confirmed
    DPA
    Provider’s DPA (opens in a new tab) to be confirmed

Further sub-processors

  • Supabase · via Lovable

    Technical basis of Lovable Cloud: database, sign-in and file storage.

    Data
    All data in your account
    When
    always
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Lovable to be confirmed

  • Amazon Web Services · via Supabase

    Data centre for the database and files.

    Data
    All data in your account (transmitted in encrypted form)
    When
    always
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Supabase to be confirmed

  • Cloudflare · via Lovable

    Running the app (server functions) and delivering the pages.

    Data
    Data that passes through the app during a request, and technical information such as IP address and browser
    When
    always
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Lovable to be confirmed

  • Lovable email delivery · via Lovable

    Sign-in emails (confirmation, password reset).

    Data
    Email address and content of the sign-in email
    When
    when you sign in and when you change your password
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Lovable to be confirmed

  • Google (Gemini) · via Lovable

    Writing, rewriting and summarising texts, designing carousel slides.

    Data
    Topic, researched sources and pages whose links you add, your draft, your style profile, the post structure you choose and excerpts from knowledge sources that you select
    When
    for AI steps involving texts
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Lovable to be confirmed

  • OpenAI (GPT Image) · via Lovable

    Creating images.

    Data
    Image description based on the topic and an excerpt of the post text
    When
    when you create an AI image
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    via the DPA with Lovable to be confirmed

Recipients on your instructions

  • LinkedIn

    Signing in to LinkedIn and publishing on your profile (with statistics via Outstand).

    Data
    When connecting, name, profile picture and member ID; when publishing, text and image or PDF, with statistics also several images or a video
    When
    when you connect LinkedIn and publish
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Telegram

    Sending to your chat or channel.

    Data
    Text and image of the post; Telegram loads the image via a link that expires after one hour
    When
    when you connect Telegram and publish
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Your website (WordPress, Webflow, Wix, Shopify, Ghost or a webhook)

    Creating or publishing blog articles on your website.

    Data
    Title, description, URL slug and article; if you wish, the post’s image (uploaded or via a link that expires after one hour)
    When
    only if you connect a website and send an article there
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Instagram, Facebook, Threads, TikTok, Pinterest, Bluesky, X, YouTube, Google Business, Reddit, Vimeo

    Publishing via Outstand; replies from the inbox.

    Data
    Text, images and videos or PDF of the post; your replies from the inbox
    When
    when you connect one of these channels and publish
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Google and Apple (sign-in)

    Sign-in with your Google or Apple account, technically via Lovable.

    Data
    Name and email address; with Apple, if you wish, only an anonymous forwarding address
    When
    when you choose “Continue with Google” or “Continue with Apple”
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • AI assistants that you connect (e.g. ChatGPT, Claude, Microsoft Copilot)

    Reading your style profile, trends and posts and creating drafts, but not publishing or scheduling anything.

    Data
    Whatever you allow the assistant to access
    When
    only if you connect an assistant
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Browser push services (Google, Apple, Mozilla, Microsoft)

    Delivering notifications to devices on which you turn them on.

    Data
    Encrypted notification (title, short text, link) and your device’s technical address with the push service
    When
    only if you turn on notifications on a device
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

  • Providers of your knowledge sources (e.g. Notion, Linear, Atlassian)

    Reading selected content with read-only tools that you approve.

    Data
    Your topic, your search query and the excerpts found
    When
    only if you connect a knowledge source or select it while writing
    Location
    to be confirmed
    Legal basis
    to be confirmed
    DPA
    no DPA (on your instructions)

Without any data about you

  • Public news feeds and articles: Research for Pulse; we do not transmit any data about you.
  • Your own sources (feeds, YouTube channels, websites): We only retrieve the sources that you add (for YouTube, the channel’s public feed) and do not transmit any data about you.
  • Your website (importing your brand design): We only retrieve the address that you enter and do not transmit any data about you.
  • Frankfurter (European Central Bank exchange rates): Converting prices and costs into Swiss francs.
  • Timestamping service for provenance information (C2PA), if set up: Only receives a checksum of the signature, no content.

7. Artificial intelligence

  • Models and providers: Texts are created with Gemini from Google (for “Premium”, the larger Pro model), images with GPT Image from OpenAI, both via Lovable’s AI gateway. Research runs via Perplexity.
  • Data: The models only receive what the step in question needs: the topic, researched sources, your draft, your style profile and excerpts from knowledge sources that you explicitly select.
  • A human decides: Nothing is published without you. Before they can be scheduled, posts with AI-generated content need an editorially responsible person and the confirmation “Content reviewed”.
  • Labelling (AI Act, Art. 50): Every post has an AI trail (step, model, time). You can turn on a visible notice “Created with AI” for each post. Provenance information from the model providers in images is retained, and with a fingerprint you can check whether a text comes from your account.
Regions of the AI models
to be confirmed
Training on your content by us
no
Storage and training at the AI providers
to be confirmed
Signed provenance information (C2PA) in images and PDFs
to be confirmed

8. Retention periods, export and exit

  • We store your account and content until you delete them or your account.
  • You request the data export (ZIP with JSON, CSV, images and PDFs) yourself; it remains available for 7 days.
  • If you delete your account, it is first locked for 7 days. After that, we delete all content, files and access credentials and document the deletion in a record that contains no personal data.
  • We keep billing records without any link to you for as long as the law requires (10 years).

Fixed periods apply to the following data. When they expire, we delete the data automatically:

Fixed retention periods
DataPeriod
Sign-ins in progress with LinkedIn, channels via Outstand and knowledge sources (valid for 15 or 30 minutes)1 day
One-time codes for connecting ChatGPT, Claude or Copilot (valid for 10 minutes)1 day
Revoked or expired access for ChatGPT, Claude or Copilot30 days
Interim results of AI actions (so that a dropped connection doesn’t cost credits twice)7 days
Data exports (ZIP files for download)7 days
Exports from the template studio (PDF and PNG files, plus template, format and who exported them) and templates used as posts (channel, status; form data for one day only)30 days
Uploaded images and videos whose upload was not completed (for example, the page was closed during the upload)up to 1 day
Invitations to a team workspace (email address and role) after they have been accepted, withdrawn or have expired30 days
Trend ideas you didn’t turn into a post60 days
Researched news articles30 days
Autopilot runs (time, selected stories with an excerpt, result, credits)90 days
Devices for notifications (push service address, key, device name) that have neither opened the app nor received a notification180 days
Inbox: comments and Instagram direct messages (text, attachments as links, name and username of the person, delivery status), from receipt or sending90 days
Imported older posts (excerpt, date, link, channel and numbers from the platform), from publication; for disconnected channels after 7 days395 days
Delivery log of automatic emails (template, language, result; without address or content)180 days
Account and subscription events for customer support (signed up, opened the payment page, started or cancelled a subscription)365 days
Newsletter sign-ups without confirmation and unsubscribed addresses30 days
Completed background tasks, e.g. “Publish post” (IDs only)30 days
Failed background tasks (for troubleshooting)90 days
Error reports at Sentryup to 90 days
Activity log (who changed what and when)365 days
Billing records (credit and cost transactions), with no link to you after an account has been deleted10 years
Confirmed sessions for the passkey step (session ID, time); signed-out sessions at the next clean-up30 days
Handovers to the browser extension for LinkedIn (post, hash of the one-time access key, reported link), after expiry or use1 day
Access keys of the browser extension’s side panel (hash of the key, workspace, label, last use), after revocation or expiry30 days

9. Accessibility

Our goal is WCAG 2.2 AA in all main workflows. With every change, axe-core checks all pages on desktop and mobile, and keyboard tests also run (creating a post, scheduling it and moving it in the calendar without a mouse).

The accessibility conformance report (ACR based on VPAT 2.5, self-assessment) is available: 44 criteria met, 4 partially met, 0 not met, 8 not applicable. “Partially” mainly means that post images do not yet have descriptive alternative texts and that some forms only show errors as a short notification. Testing with a screen reader (VoiceOver) is still pending. You can get the report on request via the contact details below.

10. Audits and certificates

Two-factor sign-in for our team at Lovable
to be confirmed
External penetration test
to be confirmed
Own certification (ISO 27001, SOC 2)
none yet

11. Documents

We will make these documents available for download here once they have been reviewed. Until then, you can get them on request via the contact details below.

  • Data processing agreement (DPA)

    In accordance with the FADP and Art. 28 GDPR, with addenda for FINMA and DORA

    Draft, review pending

  • Technical and organisational measures (TOMs)

    Measures in accordance with Art. 8 FADP and Art. 32 GDPR

    Draft, review pending

  • Deletion and exit concept

    Retention periods, export and proof of deletion

    Draft, review pending

  • Incident response plan

    Procedure for incidents and notification of customers within 24 hours

    Draft, review pending

  • AI factsheet

    Models, data flows, training and labelling

    Draft, review pending

  • DPIA template for corporate influencer programmes

    Data protection impact assessment for companies that have their employees post content

    Draft, review pending

  • Record of processing activities

    As controller and as processor (extract on request)

    Draft, review pending

  • Accessibility conformance report (ACR)

    WCAG 2.2 AA, success criterion by success criterion (based on VPAT 2.5)

    Self-assessment, on request

  • Security questionnaire (CAIQ Lite)

    Answers from this Trust Center

    in preparation

  • Penetration test summary

    Will follow after the first external test

    in preparation

12. Contact and vulnerability reporting

Have you found a security vulnerability? Please report it to us confidentially at hallo@viral-post.ai. Machine-readable details for automated tools are available in our security.txt.

  • Describe what you found and how we can reproduce it.
  • Do not access other people’s data, do not change or delete anything and do not put load on the app (no load or spam tests).
  • Give us time to fix the issue before you publish anything.
  • We will confirm receipt and keep you informed about the fix.

We answer questions about contracts, documents or a security questionnaire via the same contact details.