This Policy explains what personal data viralizi.ai processes, why, who we share it with, how long we keep it and how you can exercise your rights. viralizi.ai is a Brazilian company, so this Policy is built on Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD). It also reflects principles common to other privacy laws, such as the GDPR and US state laws, where they apply. It covers the viralizi.ai website, the web app, the messages we send and our support.
In short. We use your data to provide the service you signed up for. Your image, your voice and your digital twin are sensitive data: we only process them with your specific consent, given before the capture, only to generate the videos you approve, or that the autopilot approves when you switch it on, and to post them to the channels connected with your permission. You can withdraw at any time under Twin › Revoke. We do not sell personal data. This summary does not replace the full text.
01Who is responsible for your data
The controller of the personal data described in this Policy is [RAZÃO SOCIAL], CNPJ [CNPJ], with its registered office at [ENDEREÇO] (viralizi.ai, we, us).
Our Data Protection Officer (the "encarregado" under the LGPD) is [ENCARREGADO (DPO)], who can be reached at [E-MAIL DE PRIVACIDADE].
02Who this Policy covers
- Visitors and prospects: people who browse the website or fill in the free audit form.
- Customers and users: professionals and clinics that buy the Service, and the members they invite.
- Professionals with a digital twin: people who record a capture and consent to the use of their own image and voice.
- Message recipients: people who agree to receive our emails or WhatsApp messages.
If you are a patient, staff member or anyone else who appears in photos or footage uploaded by a customer, without being a user of the Service, see section 13.
03What data we process
| Category | Examples | Source |
|---|---|---|
| Contact and audit | name, email, phone or WhatsApp, Instagram profile, field of practice and anything you enter in the form | you, through the website form |
| Account and session | name, email, Google account photo and ID, email sign-in link, language | you, and Google when you sign in with it |
| Professional and clinic profile | professional license number, specialty, city, tone of voice, members and invitations, brand logo, colors and font | you and the members of your account |
| Biometric data (sensitive) | face capture videos, voice samples, the trained twin (avatar and voice models) and the consent record | you, during the capture and consent |
| Content | topics, scripts, captions, generated videos, uploaded photos and b-roll, change requests by text or voice note, approvals and autopilot settings | you and the Service |
| profile ID and username, access tokens, media posted by the Service and metrics, based on the permissions you grant | Meta, with your authorization | |
| Levels, leaderboard and referrals | twin level, streaks, profile growth, leaderboard position, who referred whom | the Service and you |
| Payment and tax | name or company name, Brazilian tax ID (CPF or CNPJ), billing address, payment method, card brand and last digits, billing history | you and Stripe |
| Support and surveys | messages, attachments and satisfaction scores | you |
| Messaging | contact preferences, WhatsApp opt-in, delivery history, unsubscribe requests (SAIR, PARAR, STOP) | you and our messaging providers |
| Technical and security | IP address, access date and time, device, browser, Cloudflare Turnstile bot-check signals, account activity logs | your device and our infrastructure |
We do not ask for patients' health data, and we ask you not to upload it unless it is essential and allowed by your profession's rules.
04Why we use it and our legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Responding to your audit request and sending a proposal | steps taken at your request before entering into a contract (art. 7, V) |
| Creating and running your account, profile and members; providing the Service (topics, scripts, editing, approval, metrics) | performance of a contract (art. 7, V) |
| Creating, training and running your digital twin; generating and posting videos with your face and voice | specific and prominent consent (art. 11, I) |
| Checking that the person in the capture is the person who consented | consent (art. 11, I) and fraud prevention and protection of the data subject (art. 11, II, g) |
| Generating the free audit sample with your twin, when you ask for it | specific and prominent consent (art. 11, I) |
| Connecting Instagram, storing tokens and reading metrics | performance of a contract (art. 7, V), with the authorization you grant on Meta |
| Levels, leaderboard and referral rewards | performance of a contract (art. 7, V); appearing on a leaderboard visible to other customers only if you opt in |
| Billing, issuing tax invoices and keeping accounting records | performance of a contract and legal obligation (art. 7, II and V) |
| Keeping application access logs | legal obligation (article 15 of Brazil's Internet Civil Framework; art. 7, II) |
| Protecting the Service, preventing fraud and abuse, filtering bots on the form | legitimate interests (art. 7, IX) and fraud prevention |
| Providing support and sending satisfaction surveys | performance of a contract and legitimate interests (art. 7, V and IX) |
| Sending marketing by email and WhatsApp | consent (art. 7, I) |
| Improving the Service with aggregated, anonymized metrics | legitimate interests (art. 7, IX), never using biometric data |
| Proving consent, complying with orders from authorities and defending legal claims | legal obligation and exercise of rights in legal proceedings (art. 7, II and VI; art. 11, II, a and d) |
When we rely on legitimate interests, we check that they do not override your rights. You can object to that processing, as explained in section 9. If the GDPR applies to you, these purposes correspond to its contract, consent, legal obligation and legitimate interests bases, and biometric data is processed on the basis of your explicit consent (GDPR art. 9(2)(a)).
05Image, voice and biometric data
Sensitive data. Capture videos, voice samples and the trained twin are biometric data, which the LGPD classifies as sensitive personal data (art. 5, II). We therefore process this data only with your specific and prominent consent, given before the capture in the Image and Voice Consent.
- We use this data only to create and run your twin, generate videos approved by you, or by the autopilot that only you can switch on, and post them to the channels connected to the account with your permission.
- We do not use your image, your voice or your twin in viralizi.ai's advertising without separate permission.
- We do not sell or license your twin to anyone. We do not use it to identify or track people, except to check that the person in the capture is the person who consented.
- We do not use your biometric data to train general-purpose AI models, and we contractually require the same of the providers that process it for us.
- You can withdraw consent at any time, free of charge, under Twin › Revoke or by writing to [E-MAIL DE PRIVACIDADE]. What happens to the twin, the capture and the generated videos is set out in sections 9 and 10 of the Consent, which are the single rule for this data.
06Who we share it with
Suppliers that process data on our behalf (processors), on our instructions and under contracts that require security and confidentiality:
- Infrastructure: Cloudflare, for hosting, file storage, running the Service and bot protection (Turnstile).
- Avatar and AI: HeyGen, the avatar provider, which receives the capture to train the twin and records the consent statement through its own link; and [PROVEDORES DE IA], for scripts, voice and video rendering.
- Messaging and support: [PROVEDORES DE E-MAIL, WHATSAPP E SUPORTE], to send emails and messages, including videos for approval, and handle support tickets.
Companies that process data as independent controllers, under their own privacy policies:
- Google, when you sign in with your Google account.
- Stripe, to process card and Pix payments.
- Meta, when we post to Instagram and read metrics with your authorization.
Other cases:
- Members of your account: people the Customer invites see data and videos according to the role they are given. A Professional's raw capture (face and voice) is accessible only to that Professional and to the viralizi.ai staff who run the Service.
- Other customers: if you opt in to the leaderboard, other customers may see your name, your profile and your position; if you refer someone, you and that person may learn about the referral.
- Authorities: when the law or a court or administrative order requires it.
- Corporate transactions: in a merger, acquisition or reorganization, with the same protections as this Policy.
We do not sell personal data. Unless you accept advertising cookies (section 12), we do not share it for cross-context behavioral advertising.
07International transfers
Some suppliers, such as Cloudflare, HeyGen, [PROVEDORES DE IA], Google, Stripe and Meta, process data outside Brazil, mainly in the United States. For suppliers that process data on our behalf, we use the standard contractual clauses approved by Brazil's data protection authority, the ANPD (Resolution CD/ANPD No. 19/2024), or another mechanism under article 33 of the LGPD. For biometric data, the transfer is also covered by your specific consent (art. 33, VIII), given in the Image and Voice Consent. You can ask which mechanism applies to each supplier at [E-MAIL DE PRIVACIDADE].
08How long we keep it
| Data | Retention |
|---|---|
| Contact and audit data of people who did not sign up | up to [PRAZO DE RETENÇÃO DE LEADS], or sooner if you ask |
| Free audit sample and the videos, voice and model used to make it | up to [PRAZO DA AMOSTRA DO DIAGNÓSTICO] if you do not sign up, or sooner if you withdraw |
| Account, profile and content | while the account is active and up to [PRAZO DE RETENÇÃO APÓS ENCERRAMENTO] after it closes; twin videos follow the next row |
| Capture, voice, twin and the videos generated with it | until you withdraw consent, or the account or your access to the clinic's account closes, then deleted within [PRAZO DE EXCLUSÃO BIOMÉTRICA]; never, including deletion and backups, longer than [PRAZO MÁXIMO DE RETENÇÃO BIOMÉTRICA] after your last interaction with the Service |
| Instagram tokens | until you disconnect the profile or close the account |
| Application access logs | 6 months (Brazil's Internet Civil Framework), or longer if an authority orders it |
| Payment and tax records | for the period required by tax and accounting law, usually 5 years |
| Consent, withdrawal, video approval and autopilot records | [PRAZO DE GUARDA DOS REGISTROS DE CONSENTIMENTO], to show we complied with the law |
| Support and surveys | [PRAZO DE RETENÇÃO DE SUPORTE] |
| Marketing preferences and unsubscribes | as long as needed to respect your request not to receive messages |
| Backups | removed in the rotation cycle, within [PRAZO DE BACKUP] |
At the end of the period, data is deleted or anonymized. We keep it longer only to meet a legal obligation (LGPD art. 16, I) or to exercise rights in legal proceedings (arts. 7, VI, and 11, II, d).
09Your rights
At any time and free of charge, you can (LGPD arts. 18 and 20):
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- ask for unnecessary or excessive data, or data processed unlawfully, to be anonymized, blocked or deleted;
- ask for your data to be ported, under the ANPD's rules;
- ask for data processed on the basis of your consent to be deleted;
- find out who we share your data with;
- be told that you can refuse consent and what happens if you do;
- withdraw consent;
- object to processing based on legitimate interests or another basis that does not require consent, where it does not comply with the LGPD;
- ask for a review of decisions made solely by automated processing.
To exercise your rights, write to [E-MAIL DE PRIVACIDADE] from your account email or use support in the app. We may ask for information to confirm your identity. Confirmation of processing and access requests are answered immediately in simplified form, or within 15 days as a full statement (LGPD art. 19). Other requests are handled as quickly as possible, and we will tell you if something prevents us from acting right away. If you are not satisfied, you can lodge a complaint with Brazil's National Data Protection Authority (ANPD) and with consumer protection bodies.
To delete your data, see also the Data Deletion page.
10Additional rights depending on where you live
- European Economic Area, UK and Switzerland. If the GDPR or a similar law applies to you, you also have the right to restrict processing, to object to processing based on legitimate interests and to lodge a complaint with your local supervisory authority.
- United States. Depending on your state, you may have the right to know, access, correct and delete your personal information, and to limit the use of sensitive personal information. We do not sell personal information, and we use sensitive personal information, including biometric data, only to provide the Service you asked for. We will not discriminate against you for exercising your rights. If you are in a state with specific biometric privacy laws, the retention and deletion rules in the Image and Voice Consent apply to your biometric data.
To exercise these rights, use the same channel described in section 9.
11AI and automated decisions
The Service uses AI to suggest topics, write scripts, score hooks, pick posting times and generate videos. You decide what to approve and post. If you switch on autopilot, videos with no response within the period shown in the app are approved automatically, and you can switch it off at any time. If an automated decision affects your interests, you can ask for a review and for information about the criteria used, subject to trade secrets (LGPD art. 20).
12Cookies, sessions and similar technologies
We use cookies and browser storage to:
| Type | What it is for | Can you refuse it? |
|---|---|---|
| Strictly necessary | keeping you signed in, remembering your language, protecting against fraud and bots (including Cloudflare security cookies) | no, because the website and app do not work without them |
| Analytics and advertising | [FERRAMENTAS DE ANALYTICS E PUBLICIDADE, SE HOUVER] | yes; they are only enabled with your consent |
You can delete or block cookies in your browser settings, but that may sign you out or stop the app from working.
13Patient and third-party data uploaded by customers
When a customer uploads photos, footage or information showing patients, staff or other people who are not users of the Service, the customer is the controller of that data and viralizi.ai acts as its processor, handling it only to provide the Service to that customer and under section 19 of the Terms of Use. If you are one of those people, please send your requests to the professional or clinic responsible. If you contact us, we will forward your request to the customer and help them respond.
14Messages and marketing
- Messages about your account, approvals, billing and security are part of the Service and are sent by email and in the app while your account is active. On WhatsApp, only if you opt in to that channel.
- We send marketing by email or WhatsApp only if you agreed to receive it. You can stop at any time using the unsubscribe link in our emails or by replying SAIR, PARAR or STOP on WhatsApp.
- After you unsubscribe, we keep only what we need to avoid contacting you again.
15Children and teenagers
The Service is for people aged 18 or over. We do not knowingly collect data from children or teenagers as users. If a customer uploads images of children, the customer must have specific consent from at least one parent or legal guardian (LGPD art. 14, § 1); for images of teenagers, the customer must have an appropriate legal basis and image-use permission from their parents or guardians, always in their best interests. If you become aware of minors' data being processed improperly, tell us at [E-MAIL DE PRIVACIDADE] so we can delete it.
16Security
We use technical and organizational measures to protect personal data (LGPD art. 46), such as encryption in transit, role-based access for our staff, logging of back-office access, protection of access tokens and confidentiality agreements with suppliers. No system is completely immune to failures. If a security incident could create a significant risk or harm, we will notify the ANPD and the people affected under LGPD article 48 and ANPD Resolution CD/ANPD No. 15/2024.
17Changes to this Policy
We may update this Policy to reflect changes in the Service or in the law. The date of the last update is shown at the top. We will tell you about material changes by email or in the app and, where a change requires new consent, it will only apply once you give it. This Policy is also published in Portuguese at /br/privacidade; if the two versions conflict, the Portuguese version prevails, unless mandatory law where you live requires otherwise.
18Contact
[RAZÃO SOCIAL] · CNPJ [CNPJ] · [ENDEREÇO]. Data Protection Officer: [ENCARREGADO (DPO)] · [E-MAIL DE PRIVACIDADE].